VALIDATION RISK ASSESSMENT ASSESSMENT RATIONALE

The question - how much validation - has been an open subject for many years. Numerous companies brought in validation consultants, and or regulatory compliance experts, to guide them through these problems, but every so often, there would be clashes, or at least variations in opinion, in what the appropriate scope and depth of validation was. It was accepted by the regulators that there was going to be equipment used, that full validation was inappropriate for, yet the design or misuse of that piece of equipment, could be critical to product quality. This cannot be acceptable, so how do we prevent it occurring?

When we move away from these simple devices, to the average type of production equipment, here we find a range of equipment varying from purely mechanical (but intricate) equipment, to mechanical equipment assisted and or monitored and or managed by some degree of electronics. Then at the very pinnacle of validation we have the mainly electronic systems running extremely complex sophisticated software programs. All these systems play a major role in the product manufacturing process, they all require thorough validation using the existing framework of IQ – OQ - PQ, but they do not all require the same level of validation. How do we define the appropriate level?

First we have to look at validation and how the level of validation can be varied independently of the scope. If we list all the tasks we consider essential to complex software driven equipment validation, then drop off the tasks we consider inappropriate to the next level of equipment complexity, and so on. We appear to have four levels, with a significant step change between each of them.

• Mechanical/electronic/electrical/full life cycle software, validation.
• Mechanical/electronic/electrical/software, validation.
• Mechanical/electronic/electrical/software, calibration.
• None

The requirement for 21 CFR Part 11 compliance, can occur at all three of the upper levels of validation and so is addressed in the Validation Risk Assessment protocol as a separate requirement. To find that a piece of laboratory equipment requires the same degree of validation as a Distributive Control System may be disquieting, however any equipment that uses software alone, to automatically derive whether the product passes, or fails to pass, an inspection stage, must be subjected to FLCV. The laboratory equipment may have one such stage, the DCS will have many, however, one or many, the software lineage for each system, must follow similar methodologies.

Our Validation Risk Assessment (VRA) takes you through this assessment process and enables you to make a documented and justified decision as to the level of validation each piece of equipment will receive. This fulfils your obligation to ensure that all software is assessed, as to FLCV applicability.