FDA Warning Letter - Change Control

Date: 25 Aug 11
Link: FDA Warning Letter (New Window)

Observation

This observation relates to the revalidation following changes of a Cutting and Packing Machine, however it could be applied to any computerised system. 2. Your firm failed to ensure that the automatic, mechanical, or electronic equipment, or other types of equipment including computers or related systems, will perform a function satisfactorily [21 C.F.R. § 211.68(a)]. For example:

a. The initial qualification for the (b)(4) Cutting and Packing Machine, Model (b)(4) was completed on June 7, 2007. Approximately 25 major and minor changes were implemented between June 14, 2007, and July 15, 2010, before your approval of the re-qualification report for equipment (b)(4).

In your response, your firm states that (b)(4) Cutting and Packing Machine is a custom-made unit. The unit consists of subunits that perform functions independently of one another and that modification to one subunit does not necessarily adversely impact other subunits or the equipment as a whole. You added that the requalification requirement was documented in each approved Change Control. Your response, however, is inadequate because you have neither provided documentation to demonstrate your claims of independently functioning subunits, nor have you provided your rationale why each equipment change did not necessitate a re-qualification and/or a re-validation of the (b)(4) Cutting and Packing machine.

In addition, your firm states that further system enhancement will be made to validation procedures. However, it is not clear as to your estimated completion date because the content of your proposal entitled, “(b)(4),” is so broad. Furthermore, we are not able to evaluate the adequacy of your corrective actions without sufficient details of your proposed enhancement.

Comment

Although this change may relate to mechanical and / or software changes the FDA regulatory requirement could apply to any Computerised System (automation, laboratory or IT system).

It is rarely practical or possible to perform a full revalidation following a change, particularly for large automation systems. However each change should be Risk Assessed to determine the potential impact on the overall system. For software systems the modularity of the software can be used to support mitigation, but a sound rationale must be provided to determine that the correct level of verification has been performed for each change and that the impact to patient safety, product quality and data integrity have been maintained.

Following a Risk Based approach to the validation and control of the system the risk assessments performed during the design phases should have identified the Quality Critical Attributes. This also should be used to support the approach to the verification following a change. Should a change be performed that has the potential to impact a Quality Critical Attribute of the system then the risk assessment for the change should identify consider the potential impact. Following the commissioning of the change (to demonstrate that the change functions as required) then re-verification of the critical attribute should be tested; this may be as simple as running the initial test script.

Managing risk and formally documenting the risk assessment process will provide sufficient detail to demonstrate that the change to a computerised system has been implemented and the risk to quality controlled and minimised.

A formal periodic review process should also consider the cumulative impact of change, along with quality events (incidents / deviations) to determine whether further controls or verification are required to maintain the computerised system within a qualified state.

Comments are always welcome.

Related Posts
Computer System Periodic Review
FDA Warning Letter - Computer System Periodic Review