PHARMADEVILS

IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

DISTRIBUTION
1. Quality Assurance
2. Validation & Calibration
3. Information Technology
4. Production
5. Engineering
6. Quality Control
7. Analytical Research & Development
8. Microbiology
9. Archive Copy
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

1. PURPOSE:
The purpose of this procedure is to carry out Computerized System Validation (CSV) activities. It defines the procedure
and the essential requirement(s) to maintain computer system in validated state.

2. SCOPE:
The scope of this procedure applies to validation activities regarding all GxP critical Computer System.
a) PLC/HMI based Automated Equipment.
b) SCADA based Automated Equipment.
c) Micro Controller Based/ Embedded Automated Systems.
d) Software based QC Laboratory Equipment.
e) Any Software running.
Computer Systems that are not critical to product quality (though important for the efficient and economic operation of
the facility) will not be covered under this scope.

3. RESPONSIBILITIES:
3.1 System Owner/ Process Owner:
3.1.1 Providing adequate resources to support the development and validation of the system.
3.1.2 Ensuring adequate training for the users.
3.1.3 Ensuring that SOPs required for the operation of the system exist, are followed, and are reviewed periodically.
3.1.4 Ensuring changes are approved and managed.
3.1.5 Provide all documents required for CSV.
3.2 Engineering:
3.2.1 Provide resources to support the validation team
3.2.2 Review validation documents
3.2.3 Provide all documents required for CSV.
3.3 IT Department:
3.3.1 Provide IT Infrastructure
3.3.2 Support the execution of the phases in this CS-VMP
3.3.3 Prepare and revise Inventory List for Computerized System
3.3.4 To review Validation documents
3.3.5 Managing validation/ project deliverables in line with the project plan.
3.3.6 Managing project scope and change control and escalating issues where necessary.
3.3.7 Review and define procedures for development and testing of systems, which includes: validation methodologies,
testing activities, documentation, and version release protocols.
3.3.8 Assistance in preparation of Validation Master Plan and Validation deliverables.
3.3.9 Provide training on CSV related SOP/VMP & validation protocol to the concern personnel.
3.3.10 Provide adequate resources to support third party service provider for the system validation (when necessary).
3.3.11 Reviewing assessment/ audit reports, responding to findings and taking appropriate actions to ensure GxP compliance.
3.3.12 Take CSV related document number.
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

3.3.13 LogCSV related document number in the logbook.
3.4 Vendor (OEM/ Supplier):
3.4.1 Development, Installation, setup and customization of the computerized system as applicable
3.4.2 Perform calibrations as applicable
3.4.3 Perform validation activity where applicable
3.4.4 Provide the required supporting documents
3.4.5 Support for validation of the computerized systems
3.4.6 Perform for validation of the computerized systems
3.4.7 Support for maintenance and troubleshooting of Computerized System
3.5 Quality Assurance:
3.5.1 Approval of all validation documentation.
3.5.2 Agreeing with the approach to managing discrepancy with approval of any supporting rationales
3.6 Validation Agency/ CSV Team (Where applicable):
3.6.1 Define procedures for development and testing of systems, which includes: validation methodologies, testing activities,
documentation, and version release protocols.
3.6.2 Assistance in preparation of Validation Master Plan and Validation deliverables.
3.6.3 To provide third party validation services where applicable
3.6.4 Develop, review, and approval of Deliverables
3.6.5 Assistance in preparation of User Requirement Specification.
3.6.6 Carrying out GxP assessment and Functional Risk Assessments
3.6.7 Developing and execution of Qualification Protocols (IQ/ OQ/PQ) for Computerized Systems.
3.6.8 Explanation and guidance for protocols execution
3.6.9 To provide a Validation Summary Report for Computerized System.
3.7 User Department:
3.7.1 Prepare URS/SRS.
3.7.2 Provide trained person to support validation department
3.7.3 To execute approved protocol (if necessary)
3.7.4 Review all CSV related documents.
3.8 Validation Agency (where applicable):
3.8.1 To provide third party validation services
3.8.2 Assistance in preparation of Validation Master Plan and Validation deliverables.
3.8.3 Assistance in preparation of User Requirement Specification.
3.8.4 Carrying out GxP assessment and Functional Risk Assessments.
3.8.5 Define procedures for development and testing of systems, which includes: validation methodologies, testing activities,
documentation, and version release protocols.
3.8.6 Developing and execution of Qualification Protocols (IQ/ OQ) for Computerized Systems.
3.8.7 Explanation and guidance for protocols execution
3.8.8 To provide Validation Summary Report for Computerized System.
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

4. TRAINING REQUIREMENTS:
Training is required for those employees who are involved with the CSV activities.

5. ASSOCIATED DOCUMENTS:
Validation Master Plan for Computerized System
Handling of Deviation.
Change Control Procedure.
Electronic Data Backup, Archival and Restoration (Retrieval) Procedure
Access Control, Security Policy and User Management.
Control of users and user level security for PLC/HMI based equipment

6. ABBREVIATIONS AND DEFINITIONS:

SOP : Standard Operating Procedure
CSV : Computerized System Validation
URS : User Requirement Specification
FRS : Functional Requirement Specification
FS : Functional Specification
IQ : Installation Qualification
OQ : Operational Qualification
PQ : Performance Qualification
DQ : Design Qualification
FRA : Functional Risk Assessment
VMP : Validation Master Plan
IT : Information Technology
DS : Design specification
FU : Formulation Unit
OEM : Original Equipment Manufacturer
CS VMP: Validation Master Plan for Computerized System
IQP : Installation Qualification Protocol
OQP : Operational Qualification Protocol
PQP : Performance Qualification Protocol

URS (User Requirement Specification)/ SRS (System requirement Specification):

An URS/ SRS is an approved statement that outlines the basic requirements for any system and therefore URS/ SRS
contains a set of criteria or conditions that have to be met.
The URS/ SRS will be a point of reference throughout the validation life cycle.

Functional Configuration Specification (FCS)/ Functional Design Specification (FDS):

The functional/ business configuration specification defines the functional configuration capabilities that are required to
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

achieve the end-user operational, control and security requirements. The software manual, technical specification
and/or any other documents containing functional configuration capabilities and configuration details like software
functionality, will be considered as the one delivered under the functional configuration specification requirements.

Installation Qualification (IQ):

IQ is defined as “Establishing confidence that process equipment and ancillary systems are capable of consistently
operating within established limits and tolerances”. It should ensure that the equipment and ancillary systems are
installed in accordance with approved design, specifications and regulatory requirements.

Operational Qualification (OQ):

The documentedverification that the facilities, systems and equipment, as installed or modified, perform as intended
throughout the anticipated operating ranges.

Performance Qualification (PQ):

The documented verification that the facilities, systems and equipment, as connected together, can perform effectively
and be replicated, based on the approved process method and product specification.

Validation:
An action proving, in accordance with the principles of Good Manufacturing Practice, that any procedure, process,
equipment, material, activity or system actually leads to the expected results. A documented programmed that provides
a high degree of assurance that a specific process, method or system will consistently produce a result meeting.

Revalidation:
Revalidation means documentation and execution of the complete set of validation activities and deliverables that were
initially performed.

Requalification:
Requalification means documentation and execution of the complete set of qualification activities and deliverables that
were initially performed.

Template:
A format to be used in the preparation of documents for general activities such asequipment qualification, process
validation etc. Templates contain outlines of the minimumrequirements that should be included in a protocol.

Validation Protocol:
A written plan stating how validation will be conducted and definingacceptance criteria. For example, the protocol for
a manufacturing process identify processingequipment,criticalprocess parameters/operating ranges, product
characteristics, sampling, test data to be collected, the number of validation runs andacceptable test results.

Periodic Review:
Periodic reviews are performed to ensure that the computer system remains within both company and regulatory
compliance, and is fit for its intended use. The review evaluates the compliance status of the entire system and plans
any required corrective action activities.
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

7. PRECAUTIONS:
7.1 Keep Computerized System validated throughout the lifecycle of that Computer System.

8. PROCEDURE:
8.1 VALIDATION APPROACH:

Square Pharmaceuticals is committed to the concept of validation and all Computerized Systems are put through
qualification and validation cycles to demonstrate their acceptance for use.

The validation exercise will follow the typical ‘V’ diagram approach (Fig.1) as advocated by GAMP 5. The diagram is
shown below as reference.

Fig. 1: ‘V’ diagram approach

8.2 Life Cycle Approach
Square Pharmaceuticals Ltd. follows major four phases of System Life Cycle for Computerized System (Fig.2) where
applicable:
✓ Concept Phase
✓ Project Phase
✓ Operational Phase
✓ Retirement Phase
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

Fig. 2: Life Cycle Phases

8.3 Document Procedure
8.3.1 A list of systems that need to be qualified/ validated shall be added in Inventory List for Computerized System as per
Appendix-1. Addendum of Inventory shall be prepared as and when new Computerized System are procured and
Appendix-6 will be performed to identify computerized system. Appendix-1 shall be used for preparing the addendum
of inventory and only the newly installed system shall be added in the addendum. At the end of the year, list (i.e.
Appendix-1) shall be revised with all the addendums.
8.3.2 Prepare URS/ SRS if a newly instrument is to be procured as per Appendix 2a.
8.3.3 Once URS is prepared, procure DS/ DQ from OEM vendor as per URS requirement where applicable.
8.3.4 On receiving DS/ DQ from vendor perform the supplier assessment/ vendor assessment (wherever required) (as per
Appendix 2b/ 2c) based on system criticality through one of the following:
a) Basic checklist
b) A postal questionnaire
c) An onsite audit
8.3.5 Once vendor assessment is completed, FS/CS/FCS/FDS should be procured from OEM vendor where applicable.
8.3.6 Upon receiving FS/ CS/ FCS/ FDS from OEM vendor, prepare System Assessment (SA) as per Appendix 2d for
comparing points of URS and FS/ CS/ FCS/ FDS where applicable. Additionally end user/ Engineering will request
validation document number for OEM provided CSV documents through Appendix 7: Validation Document Number
Request Form and IT will provide it as per validation document number procedure.
8.3.7 FAT & SAT will be performed as per requirement where applicable.
8.3.8 IT Infrastructure qualification/server qualificationwill be carried out (as per Appendix 2o) once FAT & SAT is
completed and before Installation of application software/ instrument.
8.3.9 IQ, OQ and PQ will be executed by vendor for newly procured system where applicable.
8.3.10 Once vendor provided qualification is completed, computerized system validation will start with GxP Assessment
which will be prepared as per Appendix 2e. Here following things will be covered:
✓ GxP Assessment
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

✓ Electronic Records and Electronic Signatures Applicability
✓ System Nature (Open/ Close)
✓ Software and Hardware Category
8.3.11 GAP Assessment will be prepared and carried out for already installed system as per Appendix 2f.
8.3.12 A separate Validation Plan (VP) will be prepared as per Appendix 2g system wise.
8.3.13 If system is already installed and in use than prepare SRS to define all the requirements as per Appendix 2a In case all
the requirements are covered in approved User Requirement Specification (URS), System Requirements Specification
(SRS) shall be omitted.
8.3.14 FCS/ FDS will be prepared as per Appendix 2hto define functional and configuration specification of the system.
8.3.15 Functional Risk Assessment will be prepared as per Appendix 2ito assess the risk associated with the system.
8.3.16 Follow relevant SOP for access control, security policy and user management.
8.3.17 Perform Network Qualification as per Appendix 2owhere server-client based architecture is available if required.
8.3.18 Prepare IQ protocol as per Appendix 2jforcomputerized system.
8.3.19 Prepare OQ protocol as per Appendix 2jfor computerized system.
8.3.20 Prepare PQ protocol as per Appendix 2jand execute PQ protocol wherever necessary.
8.3.21 IQP & OQP or OQP & PQP may be clubbed together in single document as IOQP or OPQP as per require ment and
executed.
8.3.22 Write down any discrepancies or variations observed during the execution of the qualification as per Appendix 2k If
any of the discrepancies observed at the time of validation are not resolved and are not acceptable, they will be handled
as per relevant SOPs.
8.3.23 Prepare summary report as per Validation Summary Report (VSR) as per Appendix 2l. Traceability Matrix will be a
part of Validation Summary Report (VSR).
8.3.24 Raise formal change control (as per relevant SOP) for any change to computerized system.
8.3.25 Evaluate change control through risk assessment for the extent of revalidation/requalification (as applicable) for
thatcomputerized system.
8.3.26 Take decision for revalidation requirement and the extent of revalidation/requalification (as applicable) for
computerized system based on evaluation (periodic evaluation or change control evaluation)
8.3.27 Prepare and execute simple verification protocol (proving that the software is configured as per following relevant SOP
as before change)if same version of software is reinstalled.
8.3.28 Determine the competence and reliability of external validation agency. Audit Validation agency if required (based on
system criticality).
8.3.29 Ensure vendor qualification where external validation agency is involved for CSV
8.3.30 Ensure formal agreement between company and external validation agency that include clear statements of
responsibilities.
8.3.31 Follow relevant SOPfor Handling of Backup and Restoration of Electronic Data.
8.3.32 Data will be archived as per Data archive and retrieval SOP.
8.3.33 Follow relevant SOP for disaster management.
8.3.34 The frequency of Periodic Review is kept as 5 years ± 02 months and should be prepared as per Appendix 2m. A
separate periodic review log will also be prepared at the end of the year as per “Appendix 3-Template of Computerized
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

System Periodic Review Log” to maintain a list of all the systems validated and need periodic review as and when
required. The periodic review log will be revised once at the end of the year to incorporate all the validated systems
completed in that ongoing year as per Appendix-3.
8.3.35 Re-validation will also be event-driven. Criteria (not exhaustive) of revalidation are given below. However final
decision should be based on risk assessment of change (Appendix 2m: Template of Periodic Review or Re-validation
Assessment).
• Periodic Review Evaluation
• Major changes, which also impact the structure
• Major system faults
• New hardware and/or software added to existing system.
• New functionality added to the existing computerized system application.
8.3.36 Raise CCR (as per relevant SOP) or equivalent process for any changes/modificationsto be implemented in
computerized system. CCR initiator or SME will include IT/ VAL team in the impact assessment of the CCR.
8.3.37 Generate a retirement protocolas per Appendix-2n, in case of a validated computerizedsystem is to be retired.Take at
least the following considerationsinto account:
a) Archiving of data and records retention requirements
b) Hardware decommissioning.
8.4 Validation Approach for Existing Systems
As the system is already in operation using the initial qualification, the following steps demonstrate the approach that
Square Pharmaceuticals Limited takes to bring legacy systems to a validated status. Periodic review, Revalidation, and
Retirement plan will be followed as per the life cycle approach.
a) Make an inventory (master list) that includes all Computerized Systems currently in use in the Laboratory
and Manufacturing. The inventory list shall be prepared such that it can be easilyupgraded.
b) Categorize the Equipment and Computerized System based on impact to product quality and business
impact, use yes or no. (yes = requires validation, no = does not require validation) (GxP Assessment of
Computerized System)
c) Further, categorize the Computerized System as per GAMP 5category.
d) Further GAP Assessment will be carried out to find out if there is any requirement missing for already
installedsystems.
e) Prepare a plan to validate the selectedsystems
f) Perform riskassessment.
g) Execute qualification as per approvedprotocol.
h) Reporting for the validatedsystem.
Prepare the following documents where applicable:
✓ GxP Assessment
✓ GAP Assessment
✓ Validation Plan
✓ URS/ SRS
✓ FCS/ FDS
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

✓ FRA (Functional Risk Assessment)
✓ NQ, IQ, OQ, PQ and Execution
✓ Validation Summary Report
✓ Periodic Review
✓ Revalidation
✓ Retirement Plan (Protocol and Report)
8.5 Validation Approach for Newly Implemented Systems
The approach considered for newly implemented Computerized System is a Prospective
Validation approach.
The following steps demonstrate the approach that Square Pharmaceuticals Limited
takes to bring newly implemented Computerized System to a validated status.
a) Categorize the Computerized System based on impact to product quality submission and business impact, use
yes or no. (yes = requires validation, no = does not require validation) (GxP Assessment of Computerized
System).
b) Further categorize the Computerized System as per GAMP 5 category.
c) Perform Vendor Qualification where necessary.
d) Follow Life cycle approach for validation.
Prepare following documents where applicable:
✓ URS
✓ DS/ DQ
✓ Vendor Assessment
✓ FS/ CS/ FCS/ FDS
✓ System Assessment
✓ FAT Protocol and Execution
✓ SAT Protocol and Execution
✓ IT Infrastructure Qualification
✓ NQ/ IQ/ OQ/ PQ of Vendor and Execution
✓ GxP Assessment
✓ Validation Plan
✓ SRS
✓ FCS/ FDS
✓ Functional Risk Assessment
✓ IQ, OQ, PQ and Execution
✓ Validation Summary Report
✓ Periodic Review
✓ Revalidation
✓ Retirement Plan (Protocol and Report)
Square follows System Life Cycle for Computerized System wherever applicable for newly implemented
Computerized System.
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION

8.6 Validation Approach for Instrument Vendor/Supplier Provided CSV Documents
If CSV is in the scope of Instrument Vendor/Supplier then provided CSV documents will be mapped with Life Cycle
approach for Computerized System.

9. REFERENCES:
9.1 GAMP-5: A Risk-Based approach to Compliant GxP Computerized Systems (2008)
9.2 EU GMP Annex 11: Computerized System (2011)
9.3 US FDA 21 CFR Part11 (Rule for Electronic Records and signatures)
9.4 MHRA GXP Data Integrity Guidance and Definitions; Revision 1: March 2018

10. APPENDIX:
Appendix 1: Template of Inventory List for Computerized System
Appendix 2a: Template of URS/ SRS
Appendix 2b: Template of Basic Vendor Assessment
Appendix 2c: Template of Vendor Assessment
Appendix 2d: Template of System Assessment
Appendix 2e: Template of GxP Assessment
Appendix 2f: Template of GAP Assessment
Appendix 2g: Template of Validation Plan
Appendix 2h: Template of FCS/ FDS
Appendix 2i: Template of Functional Risk Assessment
Appendix 2j: Template of IQ/ OQ/ PQ/ IOQ/ OPQ/ IOPQ Protocol
Appendix 2k: Template of Discrepancy Form
Appendix 2l: Template of Validation Summary Report
Appendix 2m: Template of Periodic Review or Re-validation Assessment
Appendix 2n: Template of Retirement Protocol
Appendix 2o: Template of IT Infrastructure Qualification/ Network Qualification
Appendix 3: Template of Computerized System Periodic Review Log
Appendix 4: Template of Computerized System Progress Report
Appendix 5: Template of Document number assignment for logbook
Appendix 6: Template of Computerized System Assessment
Appendix 7: Template of Validation Document Number Request Form

11. CHANGE HISTORY:

ANNEXURE
 PHARMADEVILS
IT DEPARTMENT

SOP FOR COMPUTER SYSTEM VALIDATION