​The EBR Implementation Guide Part 5: Validating EBR​

Computer System Validation makes up a significant proportion of the work involved during the implementation of EBR; with careful supplier selection and planning then it need not be an overly demanding or complex task. This article addresses some of the considerations and gives tips for selecting and validating an EBR system. 

Define the Validation Approach with support from supplier

The validation approach will largely depend on the extent to which the supplier has designed, developed, and qualified the EBR product. The validation effort may be significantly reduced if GxP compliance is provided by the core functionality (US FDA 21 CFR Part 11, EU GMP, PIC/S Annex 11) and if the supplier can provide assurance that the system is ready for use in the regulated environment.

One indicator to look for, is asking the supplier to explain their Software Development Lifecycle (SDLC) and Quality Management System (QMS); its important to understand how the supplier implements the necessary quality steps within their SDLC and QMS, and to ensure they align with current best practices (GAMP5 SE). This will justify leveraging the supplier involvement and provides confidence to the users, and to the regulator!  

Evidence provided by the supplier in the form of reports additionally supplements standard Supplier Assessments, and tells a story so that supplier activities can be leveraged during the validation project (from User Requirements, Risk Assessments to Testing).

Another assurance indicator is if the supplier has extensive experience in GxP compliance and provides recommendations or document templates for validation; its industry best practice to apply these when appropriate and they can rapidly accelerate the validation process.    

Software as a Service (SaaS) Infrastructure Qualification

One advantage of adopting SaaS solutions for GxP usage is much responsibility for managing and qualifying underlying infrastructure is outsourced and split across parties. Companies need a clear understanding for where the responsibilities lie; ultimately the user remains accountable so it’s important to understand how the SaaS provider ensures that quality standards are adhered to. Some of the large cloud service providers have published white papers which explain how their infrastructure and platform is qualified to GxP expectations and how they frequently undergo assessments to standard certifications such as SOC and ISO 27000.  

Validation Execution.

A risk-based validation approach should avoid creating non-value added documentation and repeating supplier activities such as testing. Leveraging supplier involvement means that validation can focus effort on user specific aspects critical to the EBR implementation, such as qualifying local infrastructure components, device integration and the user specific EBR configuration.

• How to manage and maintain the system configuration?
• Where User Acceptance Testing should be applied with the most benefit?
• How to provide an effective business continuity and disaster recovery plan?
• What procedural controls are needed to ensure data integrity and maintain continued compliance of the EBR?

Much of the risk for the user lies in how EBR processes are configured within the Master Batch Record and an efficient but rigorous approach to authoring, verification and testing should be applied – suppliers may have experience with this and be able to provide guidance and document templates.     

In conclusion, EBR validation concerns can be addressed early on during the supplier selection with a few questions:  

• Is the EBR system designed with GxP compliance requirements as core functionality?
• Does the supplier qualify the EBR and cloud platform in line with regulatory GxP expectations?
• Can you assess the supplier and gain confidence in their SDLC (Software Development Life Cycle) and qualification processes?
• Does the supplier have validation experience? do they provide recommendations and document templates?
• Does the supplier provide guidance for managing and verifying Master Batch Records?