Validation requirements for building automation systems in pharmaceutical and bio-medical manufacturing facilities

InfoTrac OneFile (R)
Building Design & Construction , 05/01/2003 44 5
Validation requirements for building automation systems in pharmaceutical and bio-medical manufacturing facilities. Renna, Agostino *~|~*Weddle, Gregory *~|~*
COPYRIGHT 2003 Reed Business Information, Inc. (US)

Most information Technology (IT) professionals can recall the nervous anxiety they experienced at 11:59 pm on December 31, 1999 in anticipation of what some thought would be the implosion of the computerized world. The great news is that Y2K came and went without incident, and IT professionals now reminisce about the good old Y2K days when computer system budgets were large and IT was king. We are among the many people who believe that the reason Y2K came and went with no major consequence was not because it was a hoax, or that the risks identified with regards to computer systems were not real, but rather because most organizations took a systematic global approach to solving the problem.
Title 21 CFR Part 11, more commonly known as Electronic Records/Electronic Signatures, or just "Part 11," became law in August of 1997. Part 11 defines the criteria under which the FDA will consider electronic records and signatures to be equivalent to hand-written records and signatures in highly regulated environments that must comply with FDA requirements. In June of 2000 the application of Part 11 was furthered when then President Clinton signed into law the "Electronic Signatures in Global and National Commerce Act," which gave electronic signatures equivalent weight to hand written signatures.
Although Part 11 had been a law for more than two years when Y2K came around, it was lower down on the list of priorities for most pharmaceutical organizations. Though not publicly stated, perhaps the FDA clearly understood that asking pharmaceutical organizations to pull their IT intellectual capital off of Y2K resolution to have them focus on Part 11 compliance could be detrimental to the industry.
After the Y2K challenge had passed, the agency became very proactive about Part 11. In the FDA's fiscal year 2000, the agency recruited and hired a significant number of new investigators who were neither biochemists, molecular biologists nor genetic engineers but IT professionals whose mandate it would be to audit regulated pharmaceutical facilities for Part 11 compliance. Ten Part 11 related 483s (warning letters) were issued by the FDA in 2000 and the number is steadily increasing; simply stated, Title 21 CFR Part 11 became real.
Industry experts estimate that Part 11 resolution will cost pharmaceutical organizations three to five times what it cost them to resolve Y2K related issues. Part 11 differs from Y2K in key ways due to the fact that as technology advances and the interpretation of the Code matures, the compliance target mines. However, there are also many similarities between the two initiatives.
For example, getting there quickly and cost effectively is critical. No computer system is exempt, whether legacy or new. Also, like Y2K, computer systems need to be prioritized with regard to criticality, gaps identified and assessed, remedy plans created, funds secured and finally solutions implemented. Validation, defined by the Food and Drug Administration (FDA) means establishing documented evidence providing a high degree of assurance that a specific system, process, or facility will consistently produce a product meeting its predetermined specifications and quality, attributes. FDA Title 21, CFR 11/58 / 210 / 211 / 820 defines the manufacturing and laboratory testing requirements for Pharmaceutical and Bio Medical manufacturers. These industries are bound to the FDA and must prove compliance to these regulations through solid testing and documentation practices.
Manufacturing processes for drugs and medical devices must be validated to ensure compliance to FDA regulations in order to make sure products are safe for sale to the public. Computer systems controlling these processes--and the HVAC systems that provide the tempered environment around these processes--must be validated in order to comply with these regulations.
One of the most difficult challenges facing our customers is determining what portions of their Building Automation Systems (BAS) require validation. Our experiences with dozens of pharmaceutical and medical device manufactures has shown that it is a combination of three conditions that create the validation target for systems--those are a company's interpretation of the FDA codes; the environmental impact to product / employees, and a company's internal policies.
Interpretation of FDA Code can be found in a company's Master Validation plan and will discuss application to diverse activities like research, pilot production, production, stability warehousing and distribution. It should provide direction and response to the codes identified earlier in this document. One industry common reference to interpretation of FDA codes comes from a consortium of pharmaceutical manufacturers called ISPE (International Society of Pharmaceutical Engineers). ISPE, along with other organizations, has issued guidance to interpreting the codes through the GAMP or Good Automated Manufacturing Practices guidelines. GAMP recently released a baseline guide on commissioning and qualification that has been a tremendous help to companies struggling with these issue.
Environmental impact to product/employees can be broken down into two aspects, product quality and employee safety. First is the impact the space environmental conditions have on product consistency or quality. The GAMP (Good Automated Manufacturing Practice) Guide on Commissioning and Validation provides guidance and reasoning to determine environmental conditions with "direct," "indirect" or "non-impact" on the product.
In essence, this is a process that evaluates the Basis of Design conditions for product or research against the building and control components and deliverables that are controlled. It culminates in a series of boundaries drawn around control components and mechanical/electrical systems. The GAMP guide indicates "direct" and "indirect" systems should be validated, "non-impact" systems should be commissioned. Safety issues may deal with contamination or exposure. Where risks are identified, those systems that operate to protect employees should be validated.
Internal Company Policies must also be considered when determining what systems require validation or other higher level testing and commissioning. These policies can touch many aspects of system application, so care must be taken to obtain a clear understanding of these requirements. Typically we find policies around these business issues to most greatly impact BAS validation, security access to the facilities or special areas, information technology (IT) requirements, maintenance procedures, and quality reporting.
For example, if your IT department has a written policy which indicates all computer systems will require computer system validation, then every computer, whether cGMP or not, must be validated unless a rationale indicating otherwise can be written and approved by IT and QA.
We recommend working together to create a rationale statement that defines direct, indirect and non impact systems and what validation or commissioning steps will be applied to each. It is important to define in detail tire procedures for both validation and commissioning efforts to standardize on both efforts and understand the delivery use and approval requirements of both.
The diagram below helps to identify the difference between commissioning and validation.
The horizontal dotted line represents a transition from non-critical above, to critical or cGMP systems below. In the upper left quadrant a process is indicated involving Good Engineering Practices for the design, build and commissioning of your facility. Facilities systems that fall in this quadrant will be built to specifications and requirements defined by general building practices and building codes.
[ILLUSTRATION OMITTED]
BAS systems that apply here might be administrative spaces, cafeteria and some central plant utility equipment. The process below the dotted line in the lower right quadrant represents the plan, design, build and qualification steps required for cGMP or critical systems. This process is known in the life sciences industry as the validation "V" and is the foundation of the FDA's expectations of manufacturers for how they build and operate facilities and systems where product quality impact exists. The primary difference between the two processes are the addition of procedures and formal approval/testing/signoff (qualification) required on the cGMP systems.
Activities in the lower right quadrant will involve your quality department and key technical experts in the area of approval and signoff for each step. All actions performed in the quadrant must be documented, organized, trained and maintained throughout your Facility life cycle. This documentation is what defends your operation in event of an audit by the FDA.
BAS network considerations: Many of our customers combine validated and non-validated systems on the same BAS network and separate operator access via logical security. Other customers place validated systems on dedicated Network Controllers that connect to a common BAS network. Still others provide physically separated networks for validated and non-validated BAS net works. The direction taken here leads to how your networks will need to be maintained.
Common networks allow a single BAS operations staff to manage and maintain both validated and non-validated systems, but require that special attention (Change Control) be given to non-validated systems added or deleted from that network. Segregated networks force dual operating staffs or a single staff managing dual graphical user interfaces and managing the question of which network that system is on. However, segregated networks divorce changes on non critical systems from the validated network, simplifying validation maintenance. Each approach should be weighed against your operating staff capabilities, legacy system installations, and the complexity of validation efforts for your sites.
Proper project planning is essential to the success of a project and ensuring compliance to FDA regulations. Detailed project planning, system design and development and system testing to ensure that the design functions as intended are key components to successful validation efforts. Proper operation and monitoring of the systems by trained personnel and an ongoing preventative maintenance program incorporating Standard Operating Procedures (SOPs) ensure that systems continue to function consistently and reliably. The goals of all manufacturers are to increase product quality and decrease downtime while at the same time minimize the risk potential to the public and to themselves. The techniques used to comply with FDA regulation aid to these goals.
Compliance to FDA regulations often produces several by-products that can benefit these regulated industries. The means to compliance, if properly planned and executed, result in company and vendor standards, consistent practices, and procedures that produce a quails, product, decrease process downtime, and ultimately reduce the costs of producing a product. Recently, computer chip manufacturers and other high tech industries, not necessarily under the jurisdiction of the FDA, have incorporated standard testing and documentation practices because they understand and appreciate the value and benefits that such practices offer.
Conclusion: It is our experience that the scope of a validation effort on a BAS installation must reflect three key issues:
* Your company's current interpretation of the FDA codes for the building type and activity.
* Your company's policies regarding IT, security and safety. There must be clearly identified rationale and approval for any deviation from these policies.
* You must be focused on direct and indirect product quality, impact of the controlled variables managed and recorded by the BAS.
Each of our current pharmaceutical and medical device customers are in some way validating their BAS installations and operations today. The application by the FDA of Title 21, CFR Part 11 (electronic records/electronics signatures) has heightened the need for compliant and validated systems. It has also forced BAS vendors to provide a more complete and usable environmental package for its customers. A win/win for both parties.
Appendix: Johnson Controls focus in the Life Sciences Market
Johnson Controls Inc. has been validating HVAC systems for over fourteen years, primarily in the pharmaceutical and medical device markets. Johnson Controls expanded its capabilities in the validation market by forming a team that focuses on assisting our offices and global customers in designing, installing, testing, and operating facility environmental systems to cGMP requirements. This team, called Validation Support Services (VSS), reviews and interprets cGMP regulations and applies these regulations to the HVAC controls business and in particular, systems applied to cGMP facilities. VSS has developed and processes and procedures that have been refined and tested over time and can be adapted to existing customer standards or can be the basis for new applications in the pharmaceutical, medical device, and food processing industries. These processes integrate seamlessly into new and retrospective validation opportunities and have application to non-regulated industries a!
s well.
The validation process developed by VSS stresses that the success of a project stems from early involvement, especially during the planning and design phases of a project. Johnson Controls stresses the importance of being part of the design team to ensure that product is accurately selected and correctly applied to mechanical systems, and that the product selected will function within the design criteria forth by the customer.
Detailed processes for planning, designing and testing systems and facilities have been developed to minimize a customer's time to production, to reduce errors and rework and to build in reliability. Standard acceptance test documentation, such as installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) produces are available for use on nay system. Software development guidelines and tools have been developed to gain efficiencies and ensure standardization and consistency in the design and development of such documentation. Yet the guidelines offer flexibility so that they can be easily modified to meet specific customer requirements and standards.
The cGMP guidelines for the pharmaceutical and medical device industries define the minimum requirements for compliance to the regulations. These regulations define what must be done, not how to do it. The process established by Validation Support Services of Johnson Controls is designed to assist customers in defining the "how to" aspect of validation for the pharmaceutical and medical device industries. The standard methodology ensures that systems are properly designed, completely commissioned, validated, and fully operational. The completed project documentation provides a good defense for FDA audits. Customers that must rely on historical information can rely on documentation that is well prepared and properly executed. Regardless of the level of regulations that various industries are bound to the processes and procedures designed and developed by Johnson Controls can be efficiently adapted to any industry and any regulation.
--Agostino Renna is Director, Life Sciences for Johnson Controls in Milwaukee, Wis. and Gregory Weddle is Manager of Validation Support Services for Johnson Controls in Indianapolis, Ind.

InfoTrac OneFile (R)