Regulations for software validation of automated processes

FDA regulation of software validation of automated processes that are used as part of production or quality systems by IVD manufacturers has been evolving during the past several decades. Although required since 1978 by the original good manufacturing practices regulations, FDA scrutiny of software validation of automated processes has increased significantly since 1996, when the agency promulgated the quality system regulation, 21 CFR 820. FDA also began to enforce section 820.70(i), as evidenced by the increasing number of observations and warning letters from the agency, which cited the industry’s lack of compliance with software validation requirements.

Examples of potential automated processes that require software validation include systems with software related to the following functions: corrective and preventive action (CAPA), production and process control, design control, management control, and other areas of the quality system such as device tracking, clinical trials monitoring, document control processes, and electronic recordkeeping systems. Many automated processes may also include electronic records and signatures. Although these processes would fall under 21 CFR 11, the latest Part 11 scope and application guidance defers FDA enforcement of its software validation requirements for systems to the predicate regulation, 21 CFR 820.70(i).

Identifying the automated processes that require software validation and the level of effort to implement validation activities and documentation for the identified systems are key concerns that can overwhelm IVD manufacturers. To address FDA compliance expectations, a manufacturer needs to develop a master validation plan for software in automated processes. The plan should include a prioritized scheme based on safety and regulatory risks for validating manufacturing and quality system software.

Once such a master plan is established, an IVD manufacturer should develop a practical approach to address software validation for the prioritized systems to attain the appropriate level of validation within reasonable cost and time-frame constraints. The main focus areas in such an approach to software validation should include documentation coverage that is identified as part of project planning related to those key areas in the quality system inspection technique (QSIT) guide for FDA investigators. This guide to inspections of quality systems instructs investigators to look for a software validation plan, software requirements documents, software validation protocols, software validation results, and software change controls to confirm that the software will meet user needs and its intended use, along with any applicable vendor purchasing data for off-the-shelf (OTS) software.