International IT Regulations and Compliance

Siri Segalstad has worked with quality and validation of IT systems since 1988 in and with the pharmaceutical industry. She set-up her own consulting company, Segalstad Consulting AS, covering these issues in 1995, and has hands-on experience with major companies in the US and in 10 countries in Europe, including Alpharma, AstraZeneca, Bayer, GE Health, Lundbeck, Nycomed, Pharmacia & Upjohn, Statoil, and various accredited laboratories. She has published more than 20 papers and given presentations and taught classes on validation from Hong Kong, Singapore, Taiwan, and Dubai in the East to California in the West.She has been on the board of the GAMP (Good Automated Manufacturing Practice) Nordic Steering Committee since its inauguration in 2001, and has participated in preparing standards in ASTM and GAMP.

• Preface and Acknowledgements. 1. Quality Standards.1.1 What Quality is.1.2 Mandatory and Voluntary Standards.1.3 Pharmaceutical Industry Regulations.1.4 US GXP Regulations.1.5 European GXP Regulations.1.6 Other GXP Regulations.1.7 Good Manufacturing Practice - GMP.1.8 Good Laboratory Practice - GLP.1.9 Good Clinical Practice - GCP.1.10 Medical Device Standards.1.11 It Systems in The GXP And Medical Device Regulations.1.12 GAMP.1.13 Mandatory Quality Standards in Other Industries.1.14 Legal Issues.1.15 ISO.1.16 ASTM.1.17 IEEE.1.18 TASKS.2. Regulatory Requirements for IT Systems.2.1 Introduction.2.2 US Requirements.2.3 EU Requirements.2.4 21 CFR Part 11.2.5 The "Part 11 Project".2.6 EU GMP Annex 11.2.7 PIC Document PI 011 Recommendation on Computerised Systems In Regulated "GXP" Environments.2.8 GAMP.2.9 ISO 9000-Series.2.10 Comparison Between the Standards.2.11 Conclusion.2.12 Tasks.3. IT Security.3.1 Introduction.3.2 Continuous Connections - Wireless Networks.3.3 Threats.3.4 Security Policy.3.5 Tasks.4. Quality Management Systems.4.1 Introduction to QMS.4.2 Definitions.4.3 Principles for Quality Management.4.4 Quality Management System Levels.4.5 Creating a QMS.4.6 Roles and Responsibilities.4.7 Work Processes.4.8 Controlled Documents.4.9 Quality Policy--QP.4.10 Quality Manual--QM.4.11 Standard Operating Procedures.4.12 The Art of Writing an SOP.4.13 Tasks.5. IT Integrated In the QMS in a User Organization.5.1 Introduction.5.2 How to Integrate the IT Systems in the QMS.5.3 Generic Standard Operating Procedures (SOPS).5.4 Procedures for Each System.5.5 Tasks.6. IT Integrated in the Supplier’s QMS.6.1 Introduction.6.2 Which Standards to Use?6.3 Quality Management System.6.4 System Development Models.6.5 Documents for the Software Development.6.6 Customer-Supplier Relationship.6.7 Tasks.7. Organization for an IT System.7.1 Introduction.7.2 Roles and Responsibilities for a Live System.7.3 Groups in the IT System Organization.7.4 Roles and Responsibilities for an IT Validation Project.7.5 Outsourcing.1.1 Service Level Agreement for Outsourcing.7.6 Consultants.8. The Legal Implications of an IT System.8.1 Introduction.8.2 Pharmaceutical Regulations.8.3 Financial Systems.8.4 Patent Systems.8.5 Human Resource (HR) Systems.8.6 Healthcare Systems.8.7 Systems for Legal Information.9. Advanced Quality Management Systems.9.1 Introduction.9.2 The Live QMS is a Good QMS.9.3 Changes.9.4 How to Keep the QMS Updated.9.5 Training and Understanding.9.6 How to Use A QMS Effectively As A Tool In The Organization - Not As a Straightjacket.9.7 Tasks.10. Audits.10.1 Introduction.10.2 ISO 9000 Series.10.3 Tickit.10.4 Why Audit?10.5 Audit In A Risk-Based Environment.10.6 Audit Scope.10.7 Supplier Audit Preparations.10.8 During the Audit.10.9 What To Look For.10.10 Other Issues.10.11 Findings/Discrepancies.10.12 Closing Meeting/Wash-Up Meeting.10.13 Audit Report.10.14 Conducting an Audit from the Receiving End Of The Table.10.15 Tasks.11. Validation of IT Systems.11.1 Introduction.11.2 External Requirements for Validation.11.3 Internal Requirements for Validation.11.4 Validation Cost.11.5 Inspectors.11.6 Validation Scope Is Changing.11.7 Computer Validation Project.11.8 Which Hardware and Software Shall Be Validated.11.9 Network.11.10 Software.11.11 Risks and System Categories.11.12 Qualifications.11.13 DQ - Development Qualification.11.14 IQ - Installation Qualification.11.15 OQ - Operation Qualification.11.16 PQ - Performance / Process Qualification.11.17 Validation Master Plan VMP.11.18 Validation Plan VP.11.19 Validation Report.11.20 Tasks.12. Risk Assessment and Risk Management.12.1 Introduction.12.2 Addressing Risks.12.3 Risk Assessment Tools.12.4 Risk Assessment.12.5 Risk Management.12.6 Tasks.13. Development Qualification.13.1 Introduction.13.2 User’s Point Of View.13.3 Supplier’s Point of View.13.4 Project: The New System in the User Organization.13.5 The Four Assessments of System Selection.13.6 Functional Specification and System Implementation.13.7 Tasks.14. Installation Qualification.14.1 Introduction.14.2 IQ Organizational Issues.14.3 IQ Plan.14.4 IQ Testing.14.5 IQ Report.14.6 Tasks.15. Operational Qualification.15.1 Introduction.15.2 OQ Framework.15.3 What If The Supplier Has Done OQ?15.4 OQ Plan.15.5 OQ Testing.15.6 Documentation of the Testing.15.7 OQ Report.15.8 Tasks.16. Process/Performance Qualification.16.1 Introduction.16.2 PQ Plan.16.3 PQ Test Plans.16.4 Documentation During the Testing.16.5 PQ Report.16.6 Ongoing PQ.16.7 Tasks.17. Laboratory Instrument Systems.17.1 Introduction.17.2 Instruments.17.3 Analytical Instruments in the Laboratory.17.4 Raw Data and Meta Data.17.5 Devices.17.6 Biometric Devices.17.7 Electronic Lab Notebooks ELN.17.8 Validation of Computerized Instrument Systems.17.9 Pure Computer Systems.17.10 Computerized Instruments That Can Run ‘Barefoot’.17.11 Integrated Computerized Instruments.17.12 Qualification of Laboratory Instruments.18. Laboratory Information Management Systems.18.1 Introduction.18.2 Build or Buy a New LIMS?18.3 The Real Cost Of LIMS.18.4 Differences Between Commercial LIMS Systems.18.5 Static and Dynamic Data.18.6 Static Data.18.7 Dynamic Data.18.8 LIMS Functionality.18.9 Types of Production.18.10 Analytical Methods.18.11 Calculations in Analytical Methods.18.12 Specifications and Limits.18.13 Standards, Solutions and Chemicals Used In the Lab.18.14 Instrument Connections and Definitions.18.15 Instrument Information.18.16 Do We Store The Data In The Instrument System Or In LIMS?18.17 Stability Studies and Stability Testing.18.18 Pharmacokinetic Studies and Testing.18.19 Dissolution Testing.18.20 Patients/Animals Information.18.21 Customer Information.18.22 Bar Coded Labels.18.23 RFID.18.24 Chain of Custody.18.25 Sample Scheduling and Workload.18.26 Status.18.27 Security.18.28 Specifying and Choosing the New LIMS.18.29 Trace Matrix.18.30 List of Sops for a LIMS.18.31 Tasks.18.32 Further Reading.19. Building Management System (BMS) and Heating, Ventilation, Air Conditioning.19.1 Introduction.19.2 BMS Systems.19.3 PLC.19.4 SCADA.19.5 Control Parameters and Instrumentation.19.6 Sterile Facilities.19.7 Regulatory Requirements and Validation Enforcement.19.8 Validation of Old HVAC / BMS Systems.19.9 New Systems.19.10 Risk Assessment.19.11 Electronic Records in the BMS.19.12 Validation.19.13 IQ.19.14 OQ/PQ.19.15 Standard Operating Procedures.19.16 Tasks.Appendix 1 Regulation comparisons.Appendix 2 Terminology.Index.

“This book is a good reference for everyone dealing with IT systems in a regulated environment. The style and content are targeted to entry- and middle-level professionals. The author provides readers with a broad picture and strong overall understanding of IT systems.” (Pharmaceutical Technology, June 2009)