Equipment Software / Firmware V&V, Part 11 Issues

QUES:  I read some of your articles on IVT network. Content of the articles are very clear and informative. I still have some questions though. Can I ask if you don't mind ? For medical device manufacturing industry, we follow 21 cfr 820, 21 cfr 11. Under 21 cfr 820 there is Device Master Record, Device History Record & Device History File.

 Let's say there are 3 machines used for manufacturing a FDA regulated medical device. 1. Inspection Machine, 2. Assembly Machine, 3. Blister Machine. Q:Will these machines at any stage create electronic Record that we must preserve under FDA regulations? E.g., Recipes/ configurations, Visual Inspection (Quality Related) pictures of Labels, Alarms

ANS:  The CGMPs for devices, 21 CFR 820 require a DMR or recipe for how the device is built (BOM template, references to applicable assembly and test SOPs, drawings, required labeling, traveler template, etc.). The DHR or lot record provides proof that the DMR was followed for that lot, e.g., the BOM is filled out with lot numbers and quantities of each part used, the traveler documents line clearances, machine settings, QC test results, etc.. These records may be kept manually / paper, or electronically. If kept electronically, or if E-SOPs, etc., are used, then 21 CFR 11 becomes operable, and any computer systems used to generate, use, save, change those e-records / e-signatures must be validated, to include Part 11 issues, e.g., audit trails, date / time stamping, et al. That would include the three pieces of equipment you mention; if they generate an e-record to be used in proving CGMP compliance (to 820) to be retained in the DHR, etc., then they have to include Part 11 issues as part of the required validation. Since all equipment must be validated, and all software / firmware must be validated. If the equipment uses software to run, but not to generate records (i.e., you record the information to set or run the equipment and capture any data manually (e.g., manually write info on the traveler), then the equipment and its software would be validated as normally (e.g., IQ, OQ, PQs), but Part 11 elements would not be part of the validation. Part 11 only becomes a requirement if you are using e-records and/or e-signatures in lieu of paper records and/or manual signatures, to prove or satisfy a CGMP requirement / provide a CGMP record.

QUES:  Thanks a lot John for the Answer 🙂 To give you a clearer picture, We have SAP which creates the batch number, expiry date, units to be produced etc and sends to SCADA. Machines receive this information from SCADA. So there is no communication from Machine Control system to SAP. What else SCADA communicates to Machines & vice versa? Recipe Name, good/bad items produced, Machine states(Running/stopped/aborted, etc.) but no Alarms are communicated. Also, there is a significant amount of Machine Parameters configurations (also a part of Machine recipe) needed to produce the Items, remain in machine. It's not recorded anywhere else, only in machine. But machines don't have Electronic signature at any stage. SCADA also maintains the EBR. Like line clearance, goods received etc Electronic signature is maintained in SCADA to validate the changes. We also have Electronic Document Management System where we have DMR, DHF. Change control is maintained in this EDMS.  

ANS:  Basically what you described fits what I sent you previously.  Not only does the computer systems need to be validated per 21 CFR 820, but those computer / electronic systems involved in facilitating and/or  documenting CGMP actions (if any) also need to be validated to 21 CFR 11 on top of the general CGMP validation (I usually add Pt 11 test cases to the OQ).

-- Jel@jelincoln.com

Also, where validated machines generate data that needs to be retained in the GMP record, instead of the normal data integrity requirement of two signature, one entry, one verification, only one signature is required, one verification. -- JEL 09/19/2023