FDA Compliance Policy Guides Manual - Computerized Drug Processing
FDA Compliance Policy Guides Manual
- Computerized Drug Processing
2004.3
IVS
유재훈
black@validation.co.kr
www.validation.co.kr
FDA 에서 발행하는 문서로 cGMP 준수 정책이다. 매우 역사가 깊은 문서로 상위문서이다.
CPGs(Compliance Policy Guides)의 주소는 아래와 같다.
http://www.fda.gov/cvm/index/cpg/cpgdirectory.htm
Computerized Drug Processing 에 대해서만 정리하였으며 해석은 하지 않았다.
Sub Chapter 425 - Computerized Drug Processing
Sec. 425.100 Computerized Drug Processing; CGMP Applicability To Hardware and
Software* (CPG 7132a.11)
Sec. 425.200 Computerized Drug Processing; Vendor Responsibility (CPG 7132a.12)
Sec. 425.300 Computerized Drug Processing; Source Code for Process Control
Application Programs (CPG 7132a.15)
Sec. 425.400 Computerized Drug Processing; Input/Output Checking (CPG 7132a.07)
Sec. 425.500 Computerized Drug Processing; Identification of "Persons" on Batch
Production and Control Records (CPG 7132a.08)
1/6쪽
FDA Compliance Policy Guides Manual - Computerized Drug Processing
원본 : http://www.fda.gov/ora/compliance_ref/cpg/cpgdrg/cpg425-100.html
Sec. 425.100 Computerized Drug Processing; CGMP Applicability To Hardware and
Software* (CPG 7132a.11)
BACKGROUND:
The use of computers in the production and control of drug products is quickly
increasing. Questions have been raised as to the applicability of various sections of the
Current Good Manufacturing Practice Regulations to the physical devices (hardware)
which constitute the computer systems and to the instructions (software) which make
them function.
POLICY:
Where a computer system is performing a function covered by the CGMP regulations
then, in general, hardware will be regarded as equipment and applications software1 will
be regarded as records. The kind of record (e.g., standard operating procedure, master
production record) that the software constitutes and the kind of equipment (e.g.,
process controller, laboratory instrument) that the hardware constitutes will be governed
by how the hardware and software are used in the manufacture, processing, packing, or
holding of the drug product. Their exact use will then be used to determine and apply
the appropriate sections of the regulations that address equipment and records.
1Applications software consists of programs written to specified user requirements for
the purpose of performing a designated task such as process control, laboratory
analyses, and acquisition/processing/storage of information required by the CGMP
regulations.
*Material between asterisks is new or revised*
Issued: 10/19/84
Revised: 9/4/87
2/6쪽
FDA Compliance Policy Guides Manual - Computerized Drug Processing
원본 : http://www.fda.gov/ora/compliance_ref/cpg/cpgdrg/cpg425-200.html
Sec. 425.200 Computerized Drug Processing; Vendor Responsibility (CPG 7132a.12)
BACKGROUND:
Computer systems used in the production and control of drug products can consist of
various devices (hardware) and programs (software) supplied by different vendors, or in
some cases by a single vendor. It is important that such computer systems perform
accurately and reliably, *and* that they are suitable for their intended use.
Questions have arisen as to the vendor's responsibility in assuring computer systems
performance and suitability. When an integrated system, composed of elements from
several different vendors, fails, it can be especially difficult to attribute the cause of a
problem to one particular vendor.
POLICY:
The end user is responsible for the suitability of computer systems (hardware and
software) used in manufacture, processing or holding of a drug product.
*The vendor may also be liable, under the FD&C Act, for causing the introduction of
adulterated or misbranded drug products into interstate commerce, where the causative
factors for the violation are attributable to intrinsic defects in the vendor's hardware and
software. In addition vendors may incur liability for validation, as well as
hardware/software maintenance performed on behalf of users.*
*Material between asterisks is new or revised*
Issued: 1/18/85
Revised: 9/4/87
3/6쪽
FDA Compliance Policy Guides Manual - Computerized Drug Processing
원본 : http://www.fda.gov/ora/compliance_ref/cpg/cpgdrg/cpg425-300.html
Sec. 425.300 Computerized Drug Processing; Source Code for Process Control
Application Programs (CPG 7132a.15)
BACKGROUND:
An increasing number of pharmaceuticals are being manufactured under the control of
computer systems. The manufacturing procedures, control, instructions, specifications
and precautions to be followed within such automated systems are embodied in the
computer program(s) which drive the computer. Depending of the complexity of the
programs, they may also contain controlling data on product formulation, batch size,
yields and automated in-process sampling/testing procedures. In a manual system such
procedures, instructions, specifications, precautions and other controlling data would be
embodied in master production records which must be reviewed and approved before
implementation and which must be maintained, as required by the current good
manufacturing practice regulations (CGMP's). Such manual records are, of course,
prepared in human readable form.
In the case of computerized drug process control, certain information required by
CGMP's to be in a master production record is contained in the source code for the
application program. (An application program is software written to specified user
requirements for the purpose of performing a designated task.) Source code is the
human readable form of the program, written in its original (source) programming
language. Source code must be compiled, assembled, or interpreted before it can be
executed by a computer. Because the source code ultimately has a direct and significant
bearing on drug product quality as manual master records, it is vital that source code
and supporting documentation be reviewed and approved by the drug manufacturer
prior to implementation, and be maintained as the CGMP's require for master production
and control records. (E.g., see 21 CFR 211.100, 211.180, and 211.186.) Careful review
of source code and its documentation is especially important for assuring that process
specifications, conditions, sequencing, decision criteria, and formulas have been properly
incorporated into the computer program; source code should also be reviewed to detect
and remove dead code--non-executable instructions which are usually artifacts of earlier
versions of the program.
Supportive program documentation, such as flow diagrams and explanatory narratives,
can be useful in understanding and reviewing source code. However, such
documentation is not an acceptable substitute for source code itself.
POLICY:
We regard source code and its supporting documentation for application programs used
in drug process control to be part of master production and control records, within the
meaning of 21 CFR Parts 210 and 211.
Accordingly, those sections of the current good manufacturing practice regulations which
pertain to master production and control records will be applied to source code.
Issued: 4/16/87
4/6쪽
FDA Compliance Policy Guides Manual - Computerized Drug Processing
원본 : http://www.fda.gov/ora/compliance_ref/cpg/cpgdrg/cpg425-400.html
Sec. 425.400 Computerized Drug Processing; Input/Output Checking (CPG 7132a.07)
BACKGROUND:
Section 211.68 (automatic, mechanical, and electronic equipment) of the Current Good
Manufacturing Practice Regulations requires, in part, that input to and output from the
computer or related system of formulas or other records or data be checked for
accuracy. This requirement has generated questions as to the need for and extent of
checking a computer's input and output.
The agency received several petitions to delete or modify the requirement on the
grounds that a validated computer system need not have its input/output routinely
checked. The request to delete or modify the requirement was denied because our
experience has shown that input/output error can occur, even in validated systems.
Printouts, for example, can contain errors as a result of faulty input, programming, or
equipment malfunction. More significantly, there is the human element which can induce
errors. At worst, input/output errors can result in serious production errors and
distribution of adulterated or misbranded products. Several recalls have, in fact, been
conducted because of insufficient input/output checks.
Despite the general need for input/output checks, not all input and output need be
checked. The regulation is, in fact, deliberately silent on the required frequency and
extent of data checking to afford firms the necessary flexibility. Also, the use of efficient
input edits, for example, could mitigate the need for more detailed manual data checks.
POLICY:
Input/Output checks of data for computer systems, as required by 21 CFR 211.68, are
necessary to assure the quality of a drug product processed using such systems. The
extent and frequency of input/output checking will be assessed on an individual basis,
and should be determined based upon the complexity of the computer system and built
in controls.
Issued: 9/20/82
Reissued: 9/4/87
5/6쪽
FDA Compliance Policy Guides Manual - Computerized Drug Processing
원본 : http://www.fda.gov/ora/compliance_ref/cpg/cpgdrg/cpg425-500.html
Sec. 425.500 Computerized Drug Processing; Identification of "Persons" on Batch
Production and Control Records (CPG 7132a.08)
BACKGROUND:
Section 211.188(b)(11) of the Current Good Manufacturing Practice Regulations requires
that batch production and control records include documentation that each significant
step in the manufacture, processing, packing, or holding of a batch was accomplished,
including identification of the persons performing, directly supervising or checking each
significant step in the operation.
Questions have been raised as to acceptable ways of complying with this requirement
when the "person" performing, supervising or checking each step is, in fact, not a
human being, but rather an automated piece of equipment, such as a computer system.
The intent of the regulation is to assure that each significant step in a process was, in
fact, performed properly and that there is some record to show this. It is quite possible
that a computerized system can achieve the same or higher degree of assurance. In this
case it may not be necessary to specifically record the checks made on each of a series
of steps in the production of the product.
POLICY:
When the significant steps in the manufacturing, processing, packing or holding of a
batch are performed, supervised or checked by a computerized system an acceptable
means of complying with the identification requirements of 21 CFR 211.188(b)(11)
would consist of conformance to all of the following:
1. Documentation that the computer program controlling step execution contains
adequate checks, and documentation of the performance of the program itself.
2. Validation of the performance of the computer program controlling the execution of
the steps.
3. Recording specific checks in batch production and control records of the initial step,
any branching steps and the final step.
NOTE: In assessing how well a computer system checks a process step it is necessary to
demonstrate that the computer system examines the same conditions that a human
being would look for, and that the degree of accuracy in the examination is at least
equivalent.
Issued: 11/2/82
Reissued: 9/4/87
6/6쪽