A Perspective on Computer Validation 2

A discussion about regulations would be incomplete without including 21 CFR Part 11 regulations of electronic records and electronic signatures. In 1991, industry and FDA representatives met to determine how to accommodate paperless record systems under 21 CFR Parts 210 and 211. Specifically, industry requested FDA's official position on substituting 21 CFR Part 211, section 186 "full signature, handwritten" with an electronic signature (12). In response, FDA publshed its progress report Electronic Identification/Signature Working Group in 1992 (13). The report identified seven key issues: legal acceptance, regulatory acceptance, enforcement integrity, validation and reliability, security, standards, and freedom of information. The final regulation was published in 1997, and although the regulation is now 10 years old, discussions and issues still revolve around most of these points. Former FDA Commissioner David Kessler is believed to have said that he was surprised by the number of experts he found when he searched the topic of Part 11 on the Internet, especially because FDA was still trying to address and develop a better understanding of the implementation and enforcement of the regulation. Even more interesting in hindsight is how the initial request for FDA to address a specific section of 21 CFR Part 211 has now evolved and encompassed all other aspects of the GMPs.
Even now, some uncertainty about Part 11 regulations remains. A contributing factor to this confusion may be the fact that earlier FDA guidelines on the regulation were revoked in 2003 (14) and replaced by a single guideline (15) with the intention of adding other guidelines later. FDA's reasoning behind withdrawing these guidelines (Fed. Register, Docket 00D-1540 in Feb. 2003) was "to avoid loss of time spent by industry in their efforts to review and comment on Part 11 issues that may no longer be representative of FDA's approach under the new GMP initiative." Since then, no additional guidelines have been issued, but FDA is working on a Part 11 amendment (16).
Perspective on the industry's approach

Figure 1. "Waterfall" life cycle method.

While FDA published its official regulations and guidelines, the industry also was actively addressing computer validation. In the late 1980s to the early 1990s, the Pharmaceutical Manufacturers Association (PMA, now Pharmaceutical Research and Manufacturers of America, PhRMA) Computer System Validation Committee (CSVC) led by Ken Chapman was the industry's main forum to discuss computer-validation issues. One series of discussions about system-development life cycle (SDLC) methodology resulted in the selection of the waterfall life cycle model (see Figure 1). In the mid 1990s, a variation of this waterfall model, the V model, became more popular (see Figure 2) and is still the model of choice. Looking back, there is no significant change in the computer validation SDLC. This is rather surprising because in some cases, using other methodologies might be advantageous (e.g., rapid prototyping methodology, which involves configuring how software should operate first, then documenting the final configuration and functional operation, followed by the software's operational verification). 
PMA also published other computer validation related articles, mainly in Pharmaceutical Technology, which has published more than 40 articles about computer validation. Historically, this publication played a key role in shaping and spreading understanding of computer validation in our industry. Even individuals from FDA published articles in the journal back then (17). Sadly, this is no longer the case because, for better or worse, FDA is now stricter about allowing its employees to publish. (A list of computer validation–related articles is online at http://pharmtech.com/.) The PMA CSVC was dissolved in the mid 1990s, and the US Parenteral Drug Association (PDA) became the industry's main forum. Part of PDA's computer-validation committee efforts focused on software-supplier audit and the creation of an audit repository center (ARC) (18). The ARC concept, however, has had varying success. Currently, the repository is managed by Syntegra. Since the late 1990s, the main industry forum for computerized systems validation has been the ISPE good automated manufacturing practice (GAMP ) group. The GAMP guideline is widely considered to be the de facto pharmaceutical-industry standard in computer validation. The current GAMP 4 version introduced the risk-management concept into computer validation in 2001, aligning with FDA's effort on GMPs for the 21st century. Currently, GAMP is working on version 5, which is slated for publication in late 2007 or early 2008. It is important to note that GAMP 4 explicitly excludes 21 CFR Part 11, although a separate guideline has been produced.
The healthcare industry has actively addressed Part 11 regulations. ISPE/GAMP and PDA both have published guidelines on Part 11, hoping to help clarify the implementation and compliance to the regulation. As discussed previously, there was much confusion about the implementation of Part 11 when it was initially introduced. Accordingly, PDA arranged a public FDA conference about Part 11 in June 2000 (19). The conference reinforced the public's concerns about Part 11, and based on industry's reaction, FDA issued the final guidance on Part 11 in August 2003 (15). FDA also scheduled a Part 11 public hearing in June 2004, again allowing the public to voice concerns and suggestions about Part 11. Unfortunately, President Ronald Reagan's funeral fell on the same day as the scheduled public hearing date, and the day was declared a federal holiday. The meeting was therefore cancelled and never rescheduled, prompting industry, as a "21 CFR Part 11 Coalition" to file a public petition letter in September 2004 (20). Since then, there has been a semblance of calm on the topic as FDA considers rewriting Part 11 and industry adjusts to a risk-based approach. The resulting decline in the number of Part 11 483s may be related to the fact that FDA is citing the predicate rule directly, rather than Part 11. Until the new amendment is issued, FDA is indeed showing enforcement discretion regarding the implementation of Part 11. It should be noted, however, that Warning Letters with severe consequences were sent to Able Labs, MDS Pharma, and Ranbaxy, and the warnings related to electronic records, even though Part 11 was not mentioned.