1. Международные требования к использованию электронных систем в клинических исследованиях
Timur Galimov, CTO

2. Why regulate?
Patient safety
Product quality
Data integrity

3. computer system validation (CSV)
Key terms
computer system validation (CSV)
computer system
computerized system
GxP record
electronic record
paper
record
electronic signature

4. Terms: computer vs computerized
Computer system
A functional unit, consisting of one or more computers and associated peripheral input and output devices, and associated software, that uses common storage for all or part of a program and also for all or part of the data necessary for the execution of the program; executes user-written or user-designated programs; performs user-designated data manipulation, including arithmetic operations and logic operations; and that can execute programs that modify themselves during their execution. A computer system may be a stand-alone unit or may consist of several interconnected units.
<FDA Glossary of Computer System Software Development Terminology (8/95)>
Computerized system
Includes hardware, software, peripheral devices, personnel, and documentation; e.g., manuals and Standard Operating Procedures.

5. Terms: computer vs computerized
software
hardware
server
COMPUTER
SYSTEM
IZED
users
procedures

6. Terms: GxP record GxP mandate: GxP? GxP record paper electronic
Good Laboratory Practice
Good Clinical Practice
Good Manufacturing Practice
Good Distribution Practice
Good Pharmacovigilance Practice
GxP mandate:
what records must be maintained;
the content of records;
whether record signatures are required;
how long records must be maintained.
GxP record
paper
electronic

7. Examples of GxP records
Good Practice
GxP
Example of records
Good Clinical Practice
GCP
Patient data information, Recruitment Information, SOPs, Drug Inventory, Monitoring Reports, Training records
Good Laboratory Practice
GLP
Patient Test Results, SOPs, Product Specifications, Certificates of Analysis, Training records
Good Manufacturing Practice
GMP
Batch records, Artwork, Patient Information Leaflets, SOPs, Training records
Good Distribution Practice
GDP
Batch Data (e.g., Lot No and Expiry Dates), SOPs, Shipping Notifications, Temperature Records, Training records

8. Terms: electronic signature
Electronic signature means a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature. <21 CFR Part 11, Sec (7)>

9. Regulations on CS in GxP
1983
1992
1992
1996
1996
1997
1997
2000
2000
FDA Blue Book
EU GMP Guide Annex 11
ICH E6 GCP
FDA 21 CFR Part 11
ICH Q7 GMP

10. Guidelines/practices
PIC/S PI ‘Good practices for computerized systems in regulated “GXP” environments’ (2007)
GAMP® 5: A Risk-Based Approach to Compliant GxP Computerized Systems (2008)
‘21 CFR Part 11: Complete Guide to International Computer Validation Compliance for the Pharmaceutical Industry’ (Orlando Lopez, 2004)
FDA Guidance for Industry: ‘General Principles of Software Validation’ (2002)
FDA Guidance for Industry: ‘Computerized systems used in clinical investigations’ (2007)

11. 21 CFR Part 11 The most commonly applied requirements used to audit CS
The 21 CFR Part 11 requirements set forth the criteria under which the FDA considers electronic records and electronic signatures to be:
trustworthy
reliable
generally equivalent to paper records and handwritten signatures executed on paper

12. Scope of 21 CFR Part 11
21 CFR Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in the FDA’s regulations
21 CFR Part 11 does not apply to paper records that are, or have been, transmitted by electronic means.

13. 21 CFR Part 11 technical controls
Audit trail
Password expiration
User access control (limited to authorized individuals)
The ability to generate copies of e-records
E-signature components
The printed name of the signer
The date and time when the signature was executed
The meaning (such as review, approval, responsibility, or authorship) associated with the signature
E-signature shall be irretrievably linked to their respective electronic records
Operational system checks to enforce permitted sequencing
Security safeguards (e.g., https protocol)

14. 21 CFR Part 11 procedural controls
Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks.
The establishment of written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification (e.g., policy on use of electronic signatures).
Use of appropriate controls over systems documentation (controls over the distribution of/access to documentation, change control)

15. How evidence CS compliance?
GCP
EudraLex Volume 4
GMP Annex 11
FDA
21 CFR Part 11
GMP
SYSTEM
VALIDATION

16. Validation definition
FDA:
Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality characteristics.
IEEE (Institute of Electrical and Electronics Engineers Standards Association):
Confirmation by examination and provisions of objective evidence that the particular requirements for a specific intended use are fulfilled.

17. CSV definition
Computer System Validation (CSV) - establishing documented evidence which provides a high degree of assurance that a specific system will consistently produce result (e.g., control information, data) meeting its predetermined specifications and quality attributes.

18. System Lifecycle VALIDATION Project definition Requirements Design
Coding
Testing
Deployment
VALIDATION

19. Validation definition
USER
COMPUTERIZED SYSTEM
USER REQUIREMENTS
COMPUTER SYSTEM
PROCEDURES & TRAINING
VALIDATION

20. Do we have to validate? 21 CFR Part 11:
applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations.

21. Do we have to validate? ICH GCP E6:
5.5.3 When using electronic trial data handling and/or remote electronic trial data systems, the sponsor should:
(a) Ensure and document that the electronic data processing system(s) conforms to the sponsor’s established requirements for completeness, accuracy, reliability, and consistent intended performance (i.e. validation).
(b) Maintains SOPs for using these systems.
(c) Ensure that the systems are designed to permit data changes in such a way that the data changes are documented and that there is no deletion of entered data (i.e. maintain an audit trail, data trail, edit trail).
(d) Maintain a security system that prevents unauthorized access to the data.
(e) Maintain a list of the individuals who are authorized to make data changes (see and 4.9.3).
(f) Maintain adequate backup of the data.
(g) Safeguard the blinding, if any (e.g. maintain the blinding during data entry and processing).

22. How much validate?
Risk posed by the system shall be determined (risk-based approach) in terms of system impact on:
Patient
Safety
Product
Quality
Data
Integrity

23. Quality & regulatory risk (example)
GMP: high
GCP: medium
GLP: low

24. Functionality risk (example)
Assign values based on functions the system performs:
EDC
Submission creation, data analysis 2
Data/document storage 1

25. Distribution risk (example)
Custom system
Multi-industry, limited use 4
Regulated industry, limited use 3
Regulated industry, broad use 2
Multi-industry, broad use 1

26. GAMP® 5
A guideline issued by International Society for Pharmaceutical Engineering (ISPE) that provides pragmatic and practical industry guidance to achieve compliant computerized systems fit for intended use by regulated organizations in an efficient and effective manner (risk-based approach).

27. GAMP® 5 software categories
Category
Product
Example 1
Infrastructure software
Infrastructure software in its most simple form is the operating system on which the application software resides. Infrastructure is qualified but not validated. 2
Discontinued!!! 3
Non-configured software
Non Configurable Software is sometimes called COTS (Commercial-Off-The-Shelf-Software) or just OTS (Off-The-Shelf-Software). The software is capable of operating and automating the business process without any modification. 4
Configured software
The software applications that are configured to meet user specific business needs. 5
Custom software
This software could be written in-house and is possibly the highest risk of the software categories as it is customised and there is a higher level risk of errors within the application code.

28. Regulations on use of eCLinical systems in GxP environment
QUIZ
Regulations on use of eCLinical systems in GxP environment

29. CTMS software is intended for?
Management of clinical trials in clinical research to maintain planning, performing and reporting functions, along with tracking deadlines and milestones of the clinical trial
Training & SOP management
Safety reporting

30. Which system is used for collection of subjects’ clinical data in electronic format received within clinical trials?
eTMF
IWRS
EDC

31. Which system is used to manage randomization, subject enrollment and drug supply management in the clinical trial?
IWRS
LMS
IVRS

32. Which organization has issued 21 CFR Part 11?
WHO
FDA
EMA

33. What is an electronic record in scope of 21 CFR Part 11?
Any paper GxP record that is, or has been, transmitted by electronic means.
A record in electronic form that is created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in the FDA’s regulations and/or submitted to the FDA under requirements of the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if such records are not specifically identified in the FDA’s regulations.

34. Which system creates/modifies/maintains/archives/ retrieves/transmits electronic records?
LMS
eTMF
Pharmacovigilance Reporting Software

35. Monitoring Visit report Any e-record
Which record(s) can be identified as a GxP record?
Monitoring Visit report
Any e-record
Training record

36. ‘Computerized system’ includes?
Software application used in GxP environment
Software application and hardware (e.g., server, where software is installed)
Hardware, software, peripheral devices (if applicable), personnel, and documentation (e.g., manuals and Standard Operating Procedures)

37. The extent of validation depends on?
Risk posed by the system that may impact patient safety, product quality, and data integrity
Implementation timelines
The extent is always the same, since the approach is pretty formalized

38. Which regulation or standard states the requirement for system validation?
21 CFR Part 11
ICH Good Clinical Practice E6
ICH Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients Q7
EudraLex, The Rules Governing Medicinal Products in the European Union, Volume 4, Annex 11

39. Validation is the process which shall be performed?
Before the implementation of the computerized system by supplier
Before the implementation of the computerized system by supplier and end-user
Throughout the whole lifecycle of the computerized system

40. The Good Automation Manufacturing Practice (GAMP®) 5 is?
A guideline issued by International Society for Pharmaceutical Engineering (ISPE) that provides pragmatic and practical industry guidance to achieve compliant computerized systems fit for intended use by regulated organizations in an efficient and effective manner
The only prescriptive standard in the industry related to CSV issued by ISPE
A regulation issued by FDA that states risk-based approach for validation of computerized systems

41. 3 categories 4 categories 5 categories
The Good Automation Manufacturing Practice (GAMP®) 5 categorizes systems into?
3 categories
4 categories
5 categories