Values That Stand The Test of Time A CASE STUDY: The modification of a legacy process control system [The case for data integrity without “Part 11" compliance] Presented by John T. English Validation & Regulatory Compliance

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity Preliminary Observations Part 11 compliance has meta-expectations Part 11 compliance has meta-expectations Not every system is a mainframe or networked Not every system is a mainframe or networked Criticality is in the eye of the beholder! Criticality is in the eye of the beholder! Not all data is created equally. Not all data is created equally.

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity Response to a production need Adapt an existing custom application platform Adapt an existing custom application platform Use ‘proven’ technologies to avoid delay Use ‘proven’ technologies to avoid delay Have all calculations and record-keeping be as automated and paperless as possible Have all calculations and record-keeping be as automated and paperless as possible Let the operators do their jobs and ‘just walk away’ Let the operators do their jobs and ‘just walk away’

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity What were the results? What were the results?

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity SYSTEM DESIGN INFRASTRUCTURE: Intel Processor/ Windows 9X PLC INFRASTRUCTURE: Intel Processor/ Windows 9X PLC APPLICATION ENVIRONMENT: Custom/bespoke applications Higher level language program for instructions Graphic tool for HMI Standard tool for Ladder Logic APPLICATION ENVIRONMENT: Custom/bespoke applications Higher level language program for instructions Graphic tool for HMI Standard tool for Ladder Logic ORGANIZATIONAL Procedures ORGANIZATIONAL ProceduresDocumentationTraining

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity ISSUES: 1. SDLC Informal Methodology, not an elaborate Model. 2. SECURITY 2. SECURITY The ‘ ON/OFF’ switch security approach Locked doors do not = locked system 3. PROCEDURES 3. PROCEDURES Covered system operation NOT system data 4. DATA ARCHIVING 4. DATA ARCHIVING See Number 3 – ‘NOT’ 5. AUDIT TRAILS 5. AUDIT TRAILS None apparent.

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity Response: Lack of Data Integrity Solution: A. Write the SOP to document the existing data backup “practice” ‘Take credit for …’ copying file, maintaining drive, storing transmittal media and archive of date to network directory under security and archive of date to network directory under security B. Overcome Objections: It’s not fully compliant The FDA won’t like it They only want to see optical media

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity Response: Lack of Data Integrity Solution: C. Demonstrate the ability to retrieve data All files were available Rapid retrieval IT security combined with departmental procedures Time and date stamping

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity Source for the following : US FDA Office of Regulatory Affairs Investigation Operations Manual (2003) Chapter 5 Establishment Inspection  Subchapter Evidence Development Sections

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity Data Integrity of Records Provided by Firm Many manufacturers are using computers to store records concerning complaints, failure data, returned goods, servicing, testing results and others. Record traceability and data integrity are always concerns when you copy or use computerized data. Many manufacturers are using computers to store records concerning complaints, failure data, returned goods, servicing, testing results and others. Record traceability and data integrity are always concerns when you copy or use computerized data. It is difficult to determine what records are to be designated as originals or copies of original records. It is important, when obtaining hardcopy or copy of computerized data, for you to capture some method of dating. The date of an electronic file can be captured by recording the date and time from a file listing in DOS or with File Manager in Windows. It is difficult to determine what records are to be designated as originals or copies of original records. It is important, when obtaining hardcopy or copy of computerized data, for you to capture some method of dating. The date of an electronic file can be captured by recording the date and time from a file listing in DOS or with File Manager in Windows. This may not always be possible, but some attempt should be made to date and time stamp electronic data.

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity FINAL NOTES Compliance is not supposed to an unattainable goal Compliance is not supposed to an unattainable goal Errors are expected – and expected to be controlled Errors are expected – and expected to be controlled ‘A good procedure today is better than a plan to make a perfect system some time in the future.’ ‘A good procedure today is better than a plan to make a perfect system some time in the future.’ In a perfect world, data integrity will NOT be an issue. For the rest of us, there is still the FDA. In a perfect world, data integrity will NOT be an issue. For the rest of us, there is still the FDA.

TECHNIP B IO P HARM, INC. Values That Stand The Test of Time A Case Study: Legacy and Data Integrity A Reflection: “Machines are built by men and will always be at risk of failing. All we can do is make them as safe as possible and ensure that those who operate the machines act responsibly."