Preface |
|
xv | |
Author |
|
xix | |
Contributors |
|
xxi | |
1 Introduction |
|
1 | (6) |
|
|
5 | (2) |
2 SLC, Computer Validation, and Annex 11 |
|
7 | (6) |
|
|
11 | (1) |
|
|
11 | (2) |
3 Annex 11 Principles |
|
13 | (6) |
|
|
13 | (4) |
|
|
13 | (2) |
|
|
15 | (2) |
|
|
17 | (1) |
|
|
17 | (2) |
4 Risk Management |
|
19 | (10) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
20 | (2) |
|
|
22 | (3) |
|
|
25 | (1) |
|
|
25 | (1) |
|
Risk Monitoring and Control |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
5 Personnel |
|
29 | (4) |
|
|
29 | (1) |
|
|
29 | (1) |
|
|
30 | (3) |
6 Suppliers and Service Providers |
|
33 | (6) |
|
|
33 | (1) |
|
|
34 | (4) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (1) |
7 Validation |
|
39 | (12) |
|
EU Annex 11-4, Project Phase |
|
|
39 | (1) |
|
|
40 | (5) |
|
Primary Life-Cycle Processes |
|
|
45 | (3) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
47 | (1) |
|
Operation and Maintenance Processes |
|
|
48 | (1) |
|
|
48 | (3) |
8 Data |
|
51 | (10) |
|
|
EU GMP Annex 11-5, Operational Phase |
|
|
51 | (1) |
|
|
51 | (1) |
|
Impact of Other Sections of Annex 11 |
|
|
51 | (2) |
|
Preserving the Content and Meaning of Data |
|
|
53 | (1) |
|
Some Data Transfer Options |
|
|
54 | (1) |
|
Manually Driven Electronic File Transfers |
|
|
55 | (1) |
|
Copy and Paste/Drag and Drop Electronic Transfers |
|
|
55 | (1) |
|
|
56 | (1) |
|
Automatic Methods of Electronic Data Transfer |
|
|
57 | (1) |
|
|
57 | (1) |
|
Validation Considerations for Data Transfer |
|
|
58 | (1) |
|
|
59 | (2) |
9 Accuracy Checks |
|
61 | (4) |
|
EU Annex 11-6, Operational Phase |
|
|
61 | (1) |
|
|
61 | (1) |
|
Accuracy Checks Performed by Computer Systems |
|
|
62 | (2) |
|
|
64 | (1) |
10 Data Storage |
|
65 | (6) |
|
EU Annex 11-7-Operational Phase |
|
|
65 | (1) |
|
|
65 | (1) |
|
|
66 | (1) |
|
|
66 | (2) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
69 | (2) |
11 Printouts |
|
71 | (4) |
|
EU Annex 11-8, Operational Phase |
|
|
71 | (1) |
|
|
71 | (4) |
12 Audit Trails-Ensuring Data Integrity |
|
75 | (8) |
|
|
EU GMP Annex 11-9, Operational Phase |
|
|
75 | (1) |
|
|
75 | (1) |
|
Relationship of Clause 9 to Other Sections in EU GMP |
|
|
76 | (1) |
|
Chapter 4: Documentation Essentials |
|
|
76 | (1) |
|
Security Section Clause 12.4 |
|
|
77 | (1) |
|
Annex 11 Audit Trail Requirements |
|
|
78 | (3) |
|
Additional Audit Trail Requirements |
|
|
81 | (1) |
|
|
81 | (2) |
13 Change and Configuration Management |
|
83 | (8) |
|
EU Annex 11-10, Operational Phase |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
83 | (3) |
|
|
86 | (1) |
|
|
87 | (1) |
|
Retirement (If Applicable) |
|
|
88 | (1) |
|
|
89 | (2) |
14 Periodic Evaluation: Independent Review to Ensure Continued Validation of Computerized Systems |
|
91 | (20) |
|
|
EU Annex 11-11, Operational Phase |
|
|
91 | (1) |
|
|
91 | (2) |
|
Overview of a Periodic Review |
|
|
93 | (1) |
|
Objectives of a Periodic Review |
|
|
93 | (2) |
|
Reviewer Skills and Training |
|
|
95 | (1) |
|
How Critical Is Your System? |
|
|
96 | (1) |
|
When to Perform a Review? |
|
|
97 | (1) |
|
|
98 | (1) |
|
Writing the Periodic Review Plan |
|
|
99 | (1) |
|
Preparation for a Periodic Review |
|
|
100 | (1) |
|
Activities during the Periodic Review |
|
|
101 | (2) |
|
Who Is Involved and What Do They Do? |
|
|
103 | (1) |
|
Review of the Last System Validation |
|
|
104 | (2) |
|
Reviewing Requirements: Role of Traceability |
|
|
106 | (1) |
|
|
106 | (1) |
|
|
106 | (1) |
|
IT Department Involvement |
|
|
107 | (1) |
|
Reviewer's Closed Meeting |
|
|
107 | (1) |
|
Observations, Findings, and Recommendations |
|
|
108 | (1) |
|
|
108 | (2) |
|
Documenting the Periodic Review |
|
|
110 | (1) |
|
|
110 | (1) |
15 Security |
|
111 | (10) |
|
EU Annex 11-12, Operational Phase |
|
|
111 | (1) |
|
|
111 | (1) |
|
|
112 | (1) |
|
|
113 | (1) |
|
|
114 | (2) |
|
|
116 | (2) |
|
Database Security/Integrity |
|
|
118 | (1) |
|
|
119 | (2) |
16 Incident Management |
|
121 | (6) |
|
EU Annex 11-13, Operational Phase |
|
|
121 | (1) |
|
|
121 | (2) |
|
Process Equipment-Related Malfunction |
|
|
123 | (1) |
|
Software/Infrastructure Component Malfunction |
|
|
123 | (1) |
|
Incorrect Documentation or Improper Operation |
|
|
124 | (1) |
|
|
124 | (1) |
|
|
124 | (3) |
17 Electronic Signatures: Electronic Signing Requirements |
|
127 | (8) |
|
|
EU GMP Annex 11-14, Operational Phase |
|
|
127 | (1) |
|
|
127 | (2) |
|
Interpretation of Annex 11 Electronic Signature Regulations |
|
|
129 | (3) |
|
Impact of Annex 11 Electronic Signature Requirements on Software Design |
|
|
132 | (1) |
|
|
133 | (2) |
18 Batch Certification and Release |
|
135 | (10) |
|
|
EU Annex 11-15, Operational Phase |
|
|
135 | (1) |
|
|
135 | (1) |
|
|
136 | (1) |
|
Legal and Regulatory Background |
|
|
136 | (1) |
|
|
136 | (1) |
|
Certification, Confirmation, and Certificates |
|
|
137 | (1) |
|
IT Systems and QP Certification/Confirmation |
|
|
138 | (2) |
|
The QP Relying on the Pharmaceutical Quality System |
|
|
140 | (3) |
|
|
143 | (2) |
19 Business Continuity |
|
145 | (4) |
|
EU Annex 11-16-Operational Phase |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
148 | (1) |
20 Archiving |
|
149 | (4) |
|
EU Annex 11-17-Operational Phase |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
150 | (1) |
|
|
151 | (1) |
|
|
151 | (2) |
21 SLC Documentation |
|
153 | (10) |
|
|
153 | (1) |
|
|
153 | (7) |
|
|
160 | (1) |
|
|
160 | (3) |
22 Relevant Procedural Controls |
|
163 | (4) |
|
|
163 | (3) |
|
|
166 | (1) |
23 Maintaining the Validated State in Computer Systems |
|
167 | (8) |
|
|
167 | (1) |
|
|
168 | (1) |
|
|
169 | (3) |
|
|
172 | (1) |
|
|
173 | (1) |
|
|
173 | (2) |
24 Annex 11 and the Cloud |
|
175 | (32) |
|
|
|
|
175 | (1) |
|
|
176 | (2) |
|
|
178 | (2) |
|
|
178 | (1) |
|
|
179 | (1) |
|
Physical Location of the Server |
|
|
180 | (1) |
|
Summary of GXP and Legal Requirements |
|
|
180 | (1) |
|
|
180 | (1) |
|
Customer Requirements for Cloud Computing |
|
|
181 | (1) |
|
|
182 | (1) |
|
Cloud Services Delivery Modes |
|
|
183 | (1) |
|
Managing and Mitigating Regulatory Risk |
|
|
183 | (1) |
|
SaaS Service Cloud Options |
|
|
183 | (3) |
|
Single or Multi-Tenant Options |
|
|
184 | (2) |
|
Requirements for Compliant IT Infrastructure |
|
|
186 | (1) |
|
IT Infrastructure Elements |
|
|
187 | (2) |
|
Service Providers: Requirements for Audits and Agreements |
|
|
189 | (1) |
|
Auditing a Cloud Provider |
|
|
190 | (1) |
|
|
191 | (1) |
|
What Are We Auditing Against? |
|
|
191 | (1) |
|
Does ISO 27001 Certification Provide Compliance with GXP Regulations? |
|
|
191 | (4) |
|
Methods of Auditing a Supplier |
|
|
195 | (3) |
|
|
195 | (1) |
|
Questionnaire Plus Follow-Up |
|
|
196 | (1) |
|
Questionnaire Plus On-Site Audit |
|
|
196 | (2) |
|
How to Select an IT Service Provider |
|
|
198 | (4) |
|
Stage 1: Review Provider Websites |
|
|
198 | (1) |
|
Stage 2: Remote Assessment of the Quality Management System (QMS) |
|
|
199 | (1) |
|
Stage 3: On-Site Audit of the Service Provider |
|
|
200 | (2) |
|
What Do We Need in an Agreement? |
|
|
202 | (2) |
|
Contract Management: How to Write a Contract |
|
|
204 | (1) |
|
Operation and Monitoring Phase |
|
|
205 | (1) |
|
|
205 | (2) |
25 EU GMP Chapter 4-Documentation and Annex 11 |
|
207 | (22) |
|
|
|
207 | (3) |
|
Overview EU GMP Chapter 4 Documentation |
|
|
210 | (1) |
|
Documentation-Basic Setup and Requirements |
|
|
211 | (3) |
|
Paper versus Electronic Records |
|
|
214 | (1) |
|
What Is a Computerized System? |
|
|
215 | (1) |
|
|
216 | (1) |
|
|
217 | (2) |
|
Timelines and Life Cycles |
|
|
219 | (2) |
|
And Again Something about Audit Trails |
|
|
221 | (2) |
|
|
223 | (2) |
|
Data Rich-Information Poor (DRIP) |
|
|
225 | (1) |
|
|
225 | (1) |
|
Validation and Data Integrity |
|
|
226 | (3) |
26 Annex 11 and Electronic Records Integrity |
|
229 | (24) |
|
|
229 | (2) |
|
|
231 | (10) |
|
Annex 11 E-recs Integrity Basis |
|
|
241 | (1) |
|
Annex 11 E-recs Integrity Approach |
|
|
242 | (3) |
|
|
245 | (5) |
|
|
250 | (3) |
27 Annex 11 and 21 CFR Part 11: Comparisons for International Compliance |
|
253 | (10) |
|
|
253 | (1) |
|
|
254 | (1) |
|
|
254 | (2) |
|
11.50(a)(1) and (3); 11.50(b) |
|
|
255 | (1) |
|
|
255 | (1) |
|
11.200(a)(1)(i) and (ii); 11.200(a)(3); 11.200(b) |
|
|
255 | (1) |
|
|
256 | (1) |
|
Controls for Closed Systems |
|
|
256 | (5) |
|
|
257 | (1) |
|
The Ability to Generate Accurate, Complete Copies of Records (11.10(b)) |
|
|
258 | (1) |
|
Protection of Records (11.10(c) and (d)) |
|
|
259 | (1) |
|
Use of Computer-Generated, Time-Stamped Audit Trails |
|
|
|
(11.10(e), (k)(2) and Associated Requirements in 11.30) |
|
|
259 | (1) |
|
Use of Appropriate Controls over Systems Documentation |
|
|
260 | (1) |
|
System Access Limited to Authorized Individuals (11.10(d), (g) and (h)) |
|
|
260 | (1) |
|
|
261 | (1) |
|
|
261 | (2) |
Appendix A: EMA Annex 11, Rev 1992 |
|
263 | (4) |
Appendix B: EMA Annex 11, Rev 2011 |
|
267 | (8) |
Appendix C: Glossary of Terms |
|
275 | (26) |
Appendix D: Abbreviations and Acronyms |
|
301 | (4) |
Appendix E: Comparison between EU Annex 11 and US FDA-211, 820, 11; Other Guidelines and Regulations |
|
305 | (22) |
Appendix F: Case Study SCADA and Annex 11 |
|
327 | (14) |
References |
|
341 | (6) |
Index |
|
347 | |