RETROSPECTIVE VERIFICATION AND VALIDATION (V&V)
Based my 30+ years experience with the FDA, "deviations" and
definitions as "legacy" won't cut it with them regarding omitting a validation.
The FDA does accept retrospective V&V on processes and production / test
equipment, and expects the documentation to be thorough, though much of your data
can be reduced by a review of the last several lots through that process /
equipment. With a retrospective validation, you do what you can, but I would certainly
include an IQ, OQ, and several PQs (or DHR reviews, documented, covering
varying operating conditions, shifts, operators, and RM lots) as part of that.
Your procedures for such V&V should be addressed in an SOP and/or a
Validation Master Plan, as well.
Software must be fully validated, and hardware
/ equipment can be validated to the extent that there is no 100% downstream
verification (QC / inspection) performed / documented. As part of Lifecycle
considerations, you are required to re-V&V or at least re-evaluate the need
for additional V&V, periodically (defined in your SOP / VMP) any way, so, if
not done at all up to the Current time, you would be expected to do it starting
as of the present. I've never seen the FDA give a company a "pass" on
validation just because it wasn't done previously, and have lost several
arguments along that vein with their auditors and the relevent FDA District
Office.
However, the FDA prefers prospective V&V, because, by definition,
retrospective means product was built and released previously using
non-V&V'd processes / equipment, in violation of the CGMPs, and hence that
product is technically "adulterated" -- challenges to such by
companies have ended up in court, and no matter the outcome in the court, have
been extremely costly to the company in terms of share value, lost market share,
public reputation, and an adversairial relationship with the Agency, and have
not changed the Agency's policies to such situations.
True, you can reference ASTM E2500 to justify not using the terms IQ, QO,
PQ, but are still expected to "verify" (qualify, inspect, check ...)
proper installation (or "IQ"), proper selection (and initialization)
of settings / parameters / tolerance ranges (or "OQ"), and consistent
reliability / reproducibility, et al, of your equipment / processes, under
allowable "worst case" conditions (all worst shift variations, RM / lot variations, power / air fluctuations ...; or "PQs"). And as evident
by some forum discussions, define your terms in your documents (validate,
verify, qualify, commission, FAT, SAT, etc) with your own "working
definitions" under the broader (but harder to "real world"
implement definitions under the CGMPs and/or ISO. --
