B.

Rusjan 1-24

COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

COMPUTER SYSTEM VALIDATION: EXAMPLE OF

QUALITY MANAGEMENT SYSTEM DESIGN AND OF
PROCESS IMPLEMENTATION

Borut Rusjan*
Received: 26. 12. 2019 Original scientific paper
Accepted: 14. 11. 2020 UDC 005.6:004
DOI: https://doi.org/10.30924/mjcmi.25.2.1

Abstract
The purpose of this paper is to present a computer-aided system validation example.
Quality Management System (QMS) for computer Empirical part employed two research strategies:
systems validation and to identify and demonstra- a single case study and action research. Presented
te the validation process on a practical case of a computer system validation QMS and process
pharmaceutical company. Based on the European can provide a guideline for all companies where
and the US legal requirements, we define QMS for computer systems are important. Although the pre-
computer system validation elements. Validation sented QMS and process for the computer system
process example based on the use of a general validation are related to a specific pharmaceuti-
V-model provides a thorough understanding of cal company case and its legal requirements, the
the actual validation implementation in practice. experience from this highly regulated industry can
Computer system validation in a concrete organi- be appropriately used in other less regulated indu-
zation can be implemented, based on general and stries. For verification of the proposed model, they
specific standard operating procedures which form need to be further tested within the pharmaceutical
the QMS. Planning, Specifying, Development/ and other less regulated industries.
Building, Verification and Report validation
activities are presented through process dia- Keywords: Quality Management System,
grams based on a practical Supervisory Control computer systems, validation, V-model, pharma-
and Data Acquisition (SCADA) manufacturing ceutical industry

1. INTRODUCTION reliable systems that detect and display er-

rors. To ensure the integrity of the data, the
In today’s world, when we operate with
regulatory authorities require the computer
electronic records, the possibility of chang-
systems validation in accordance with their
ing or copying the contents of electronic
requirements. The world’s leading regulato-
records, without leaving any visible trace
ry bodies that set minimum conditions and
of the change, is extremely high. According
limitations, both in general and in the field
to the European Compliance Academy
of computer-aided systems in the pharma-
(2011a, p. 8), even in the case of the use
ceutical industry, are the US Food and Drug
of computer systems, regulatory authori-
Administration (FDA) and the European
ties want to ensure data integrity through
Medicines Agency (EMA) (European

*
Borut Rusjan, PhD, Professor, University of Ljubljana, School of Economics and Business, Kardeljeva ploščad
17, 1000 Ljubljana, Slovenia, Phone: +386 1 5892 553, E-mail: [email protected], ORCID: https://orcid.
org/0000-0002-7061-9242

1
Journal of Contemporary Management Issues

Commission, 2013a, 2013b; US FDA, drafts, we define standard operating proce-

2013a, 2013b). Pharmaceutical companies dures, which interpret regulatory require-
are expected to establish a quality system ments in more detail, and form the elements
at all levels of the organization and assure of the Quality Management System (QMS)
traceability of production and supportive for computer system validation. The third
processes (MetricStream, 2014). The pa- step is execution of validation activities on
per deals with the computer system quality an actual computer system, by using the es-
assurance in the pharmaceutical industry, tablished QMS.
where data integrity is crucial (Sai et al.,
2019; Ranbaxy Laboratories Limited, 2014, Based on legal requirements of the phar-
pp. 1-20), since today there is virtually no maceutical industry, Sallubier and Rusjan
production process that is not regulated and (2017) developed a general model of QMS
controlled by a single, or multiple computer for computer systems validation and con-
systems. cluded that we can distinguish between gen-
eral and specific standard operating proce-
The regulation of computer system dures. They emphasised the need of testing
validations is, on the one hand, very gen- the appropriateness of the presented general
eral, but on the other, it states quite clear- model by using it within the pharmaceutical
ly what is required from an organization. industry.
According to Velkovrh Remec (2007), both
the US and the EU legislations require the The purpose of this paper is to present a
validation of all critical procedures, pro- QMS for computer systems validation and
cesses and systems and the education of to identify and demonstrate the validation
all individuals, involved in the process. process on a practical case of a pharmaceu-
Regulatory bodies also give numerous rec- tical company. QMS is established, based
ommendations for the implementation of on the European and the US regulatory re-
specific systems validation. In the field of quirements, which are basic and general,
computer system validation in the pharma- and, therefore, cannot be directly applied
ceutical industry, the well-known profes- within a company. Instead, every regulatory
sional manual of the International Society requirement needs interpretation and for-
for Pharmaceutical Engineering Good malization in the company procedures, and
Automated Manufacturing Practice- ISPE we must assure that following activities are
GAMP5 (2008) has been developed. ISPE performed, according to these interpreta-
GAMP5 interprets regulatory requirements tions and procedures.
for the computer systems validation and The paper addresses two basic research
aids in setting up a quality system for vali- questions:
dating computer systems.
1. What are the standard operating proce-
In terms of quality of computer systems dures forming a specific pharmaceuti-
in the pharmaceutical industry, we distin- cal company QMS for computer sys-
guish between three concepts. The first is tem validation;
to create a quality model, where we move
from legal requirements to the first drafts 2. How to perform the validation of the
and frameworks, defining what we need to computer system, considering the
provide in the field of computer systems pharmaceutical industry regulatory
in the pharmaceutical industry. From these requirements.

2
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

To answer these questions, the paper its early stages (Eisenhardt, 1989), when it
first outlines the legal requirements gov- is used to persuade (Siggelkow, 2007), and
erning the pharmaceutical industry and by when used as a representative/typical, or
comparing them defines the basic QMS ele- a revelatory case (Yin, 2009). Action re-
ments for computer system validation. This search is a practice-oriented intervention-
is followed by an example of the process of ist research method that aims to address a
validating a computer-supported produc- phenomenon in its practical context, i.e.
tion system in the pharmaceutical industry, to solve a practical problem through col-
which provides a thorough understanding laboration between researchers and prac-
of the actual validation implementation in titioners. It is focused on the improvement
practice and its connections with regulatory of both practice and body of knowledge
requirements. As a basic starting point for through intervention (Gill, Chew, 2019).
identifying the process of validating a com- Being a participatory approach, it is ide-
puter system, we used the V-model method- ally suited to monitoring change process
ology approach to validation, which is the and outcomes (Koshy et al., 2011). Testing
most widespread within the area of comput- practical computer system validation
er-based system ​​validation in the pharma- against conceptual frameworks follows the
ceutical industry. suggestion that action research should have
implications beyond the immediate project
and that results could inform other contexts
(Saunders et al., 2009), in our case other
2. METHODS
less regulated industries.
The paper identifies the European and
the US legal requirements governing the
pharmaceutical industry by using descrip-
3. REGULATORY
tive and comparison methods. Then, we
design a QMS for computer systems valida- REQUIREMENTS IN THE
tion, by using classification and compilation PHARMACEUTICAL
methods. INDUSTRY

The usefulness of the designed QMS When considering current European

was tested on a specific case within phar- regulatory requirements, we rely on the
maceutical company. In this empirical EU Legislation rules for governing medici-
part, we, therefore, employed two research nal products in the European Union, called
strategies; a single case study and action EudraLex. EudraLex guidelines consist of
research. We intended to analyse whether 10 volumes and computer systems are de-
the general and specific standard operating scribed in Volume 4, which regulates good
procedures, which form the QMS, provide manufacturing practice (GMP). Although
an appropriate framework for the validation Volume 4 includes several chapters and an-
of a concrete project of Supervisory control nexes, only two of them are directly related
and data acquisition (SCADA) manufac- to the validation of the computer systems:
turing computer system implementation. Chapter 4, which describes good docu-
The validation example was based on the mentation practices and Annex 11, which
use of a general V-model for validation of describes computer systems (European
computer systems. A single case study may Commission, 2013a). Qualification and
be justifiable, when the research topic is in validation in general are described in Annex
15.

3
Journal of Contemporary Management Issues

As stated in EudraLex, Volume 4, For validation of computer systems, 21

Chapter 4 (European Commission, 2011a, CFR Part 211 and 21 CFR Part 11 are im-
p. 2), document management is a key part portant. Number 21 represents the section
of quality assurance and of operating in ac- of foods and medicines, Part 211 repre-
cordance with good manufacturing prac- sents current good manufacturing practices
tice. Annex 11 relates to all types of com- (cGMP), and Part 11 represents electronic
puter systems, which are classified as records and electronic signatures (U.S.
GxP. GxP refers to systems used in good Food and Drug Administration - FDA,
practices, where »x« represents a variable. 2013a, 2013b).
So GxP can for example be GMP (Good
Manufacturing Practices) or GLP (Good Crucial for the computer system vali-
Laboratory Practices) etc. IT applications dation from FDA point of view is 21 CFR
and IT infrastructure, which are subject to Part 11, which covers electronic records
qualification activities, are also included and electronic signatures and includes (U.S.
into these guidelines. Regulation empha- Food and Drug Administration - FDA,
sise that using computer systems instead 2013b):
of manual operations shall not have nega-
• System controls (closed and open type
tive impact on the product quality, process
of computer system) – system valida-
control or quality assurance and should not
tion, electronic records security, unau-
increase the process overall risks (European
thorized access controls, system change
Commission, 2011b, p. 2).
management etc.,
According to the European Compliance • Controls for electronic signatures –
Academy (2011a, pg. 11) the follow- signee identification, timestamp, re-
ing are the key points from Annex 11 that sponsibility (e.g. author, reviewer,
should be considered in computer system approver),
validation:
• Connection between electronic signa-
• Described principles apply for GxP and ture and electronic data,
not only for GMP.
• Users identification – biometrical iden-
• Risk based approach should be consid- tification, username and password, user
ered in all areas. administration etc.
• Electronic records are acceptable. Lopez (2012) states that 21 CFR Part
11 requirements are considering more
• During validation, the focus is on
technical and procedural controls in case
checking system design,
of electronic records (creation, modifica-
• External suppliers of GxP relevant IT tion, storage, archiving, copy, restoration)
systems are taken into consideration, and electronic signatures. Annex 11, on the
other hand, covers all activities, needed for
• Milestone between the validation phase
computer system validation. To be able to
and the operational phase of IT systems
validate computer systems, we, therefore,
should be clear
also need to consider a broader picture,
US regulatory agency FDA and its regu- which includes the regulatory requirements
latory requirements can be found in the sec- 21 CFR Part 211 (for computer systems
tion Code of Federal Regulations (CFR). subsections D (§211.68) and E (§211.80).

4
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

4. ESTABLISHING QUALITY From the point of view of regulatory

SYSTEM FOR COMPUTER requirements, this means that all com-
SYSTEM VALIDATION puter system users should be adequate-
ly trained, based on the latest valid
To develop a quality system for the work instructions or user manuals;
computer systems validation, the le-
gal requirements must be respected and • Procedures, which prescribe inter-
fully implemented in the quality system. nal audits implementation in the
Establishing a successful quality system organization;
requires creating instructions and policies • Procedures, which prescribe supplier
(which represent standard operating pro- audits, in regard to their quality system
cedures - SOP), that summarize the parts appropriateness and their regulatory re-
of the legal requirements, which are then quirements knowledge;
followed by all employees in the organiza-
tion. We can distinguish between general • Procedures, which monitor deviations
and specific standard operating procedures from good practices management.
(Sallubier and Rusjan, 2017). These procedures can also include
guidelines for conducting investigation
The general SOP, developed in case of a of deviations;
pharmaceutical company, which are intend-
• Procedures, which prescribe suppliers
ed for use within most of the activities and
and suppliers’ contracts management.
business processes of the organization, are
as follows: In addition to the general SOP, which
support multiple business processes in an
• Procedures for good documentation organization, we also need specific SOP
practice; for the implementation of computer system
• Procedures, which determine ap- validation. These are procedures that are re-
proaches and time periods of archiv- lated to the specifics of validation, and the
ing for different records types in both, most important ones in the case of a phar-
electronic and paper form. This is im- maceutical company are:
portant for record accessibility and is
• The overall general procedure that
needed, e.g. in cases of product recalls
prescribes the computer systems
from the market, if investigations of
validation;
deviations from good manufacturing
practices need to be conducted, or in • Execution of High-Level Risk
other cases when records are evidence Assessment;
of proper implementation of processes • Assessment of computer system
(e.g. manufacturing, laboratory); supplier;
• Procedures which prescribe trainings • Management of changes in computer
for users, e.g. frequency and type of systems;
trainings. From the computer system
point of view, this is very important, • Computer system access control and
because when a system’s functional- authorization management;
ity is developed or upgraded, conse-
quentially, the work instructions or
user manuals are changed accordingly.

5
Journal of Contemporary Management Issues

• Performing backups, archiving elec- The project phase is subject to the com-
tronic records, and restoring a comput- plete computer system validation, where we
er system; follow the V-model. In the computer system
validation and IT applications, the V-model
• Computer system operational continu-
is primarily used for the purpose of mini-
ity assurance;
mizing the quality risks of the computer-
• Computer system Configuration aided system, or IT applications and for
management; improving quality (International Society for
Pharmaceutical Engineering - ISPE, 2008).
• Computer system Incident
management; Once the project phase is completed,
• Computer system inventory; the computer system enters the operat-
ing phase, which means the computer sys-
• Computer system periodic reviews; tem production use. Once the system is in
To assure appropriate use of the SOP regular use, users can request the system
social aspect is of critical importance. Sing upgrade and add new functionalities to the
et al. (2018) identify and explain common computer system, but there may also be a
problems related to social issues challenges process change, or some other change to
in organization and governance, execution, the computer system that needs to be im-
training, and personnel. plemented. In the case of changes that do
not significantly affect the computer system
operation, we do not need to revalidate the
entire computer system, but only the part of
5. COMPUTER SYSTEM LIFE the system that has changed. Therefore, the
CYCLE WITH VALIDATION validation scope is smaller.
CASE EXAMPLE

5.1. Computer system life cycle

To ensure regulatory compliance, as
well as that the computer system operates
within the required specifications, we must
consider the computer system life cycle
(PIC/S, 2007, p. 7), which provides an un-
derstanding of the requirements that have
to be met, regarding the computer system
and systematic development activities, im-
plementation, application and computer
system retirement. Figure 1 shows the com-
puter system life cycle concept as a whole,
composed of four phases, as indicated in
the GAMP5 (International Society for
Pharmaceutical Engineering - ISPE, 2008, Figure 1. Computer system life-cycle model
p. 26) and the five fundamental activities
for the computer system project phase/vali-
dation - planning, specifying, building/de-
velopment, verification and report.

6
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

Over time, when a computer system can user, who begins writing User Requirements
no longer be used to the full extent, or is re- Specifications (URS) for a computer system.
moved from operational use for any other In our case, this system is SCADA, which
reason, we move into the retirement phase, enables monitoring and controlling the pro-
where such a system needs to retire, accord- duction process. Therefore, the technolo-
ing to the prescribed general procedures. gist in our case needs functionality of the
Upon computer system retirement, the great- SCADA system, displaying on the screen the
est attention should be given to the retention necessary information and enabling them to
of GxP relevant electronic records (data) on check the historical process data, e.g. graphi-
a computer system, so that they remain ac- cally (x axis: time, y axis: critical parameters
cessible to authorized persons and fully read- value, e.g. temperature, mixing speed, mix-
able for a number of years (usually 10 years) ing time....). Important functionality needed
after the computer system retirement. In case also include the temperature and the mix-
when the retired computer system is replaced ing speed regulation. Additionally, it would
by a new computer system, we can perform make sense to have recipes stored on the
data migration into a new system, thus en- SCADA system, and consequently provide
suring the data availability. The project phase automatic step sequencing and execution
will be explained in more detail, since it is of of the functions of tempering, mixing, etc.
key importance, if we want to successfully Another user requirement is that production
validate the computer system. can run in two modes; manual and automatic
mode, where technologist only checks the
5.2. Validation process example SCADA system occasionally and intervenes
only, when corrections are necessary.
Computer-based systems validation
is logically defined as a project (project Examination of regulatory requirements
phase), as illustrated in Figure 1, since the and professional literature (US FDA, 2002,
computer system validation ends, when the pp. 1-34; US FDA, 2003, pp. 1-9; US FDA,
system enters the production phase (opera- 2004, pp. 7-8; US FDA, 2006, pp. 3-24; US
tional use). To facilitate illustration of the FDA, 2013a; US FDA, 2013b; European
computer-based system validation through a Commission, 2011a, pp. 2-5; European
concrete case, we provide key information Commission, 2011b, pp. 2-9; European
about the selected computer system. Compliance Academy, 2011a, pp. 2-12;
European Compliance Academy, 2011b,
A technologist in the production of a pp. 3-46; European Compliance Academy,
pharmaceutical company wants to replace 2011c, pp. 3-31; International Society for
a manually driven process with the auto- Pharmaceutical Engineering - ISPE, 2008, pp.
matic one, to be able to improve production 65-79; PIC/S, 2007, pp. 1-50; Huber, 2012)
process control and management. This indi- leads us to the computer system validation
vidual must continuously review and adjust process model, described in the next section.
critical process parameters, such as tempera-
ture, speed, and time of mixing in the pro- Through the process diagrams, we pre-
duction process so that parameters do not sent an example of the SCADA computer
exceed specified limits. Their activities also production system validation process,
include sequencing of production steps, in composed of planning, specification, build-
accordance with the instructions of the batch ing/development, verification, and report
record. In this case, the technologist is a sub-processes.

7
Journal of Contemporary Management Issues

5.3. Computer system project phase/

validation process
5.3.1. Planning sub-process
Planning sub-process diagram (Figure
2) shows first activities that should be im-
plemented in case when a new computer
system is introduced.

Figure 2. Sub-process diagram - Planning

A more detailed description of the spe- [K1] New system requirement

cific steps within the planning sub-process The user in the production is thinking
is presented below. about a new computer-based system that
would give them useful information, re-
garding the production process and enable

8
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

the management and control of the produc- the computer supported system. An indi-
tion process. Specifically, the user is consid- vidual at this position also adds require-
ering the SCADA system. ment for enabling events history, which
can show us who worked on the SCADA
[K2] Create User Requirement system, what they were doing, when and,
Specification (URS) under certain conditions, why they took a
The user writes down his ideas of the certain step. Additionally, the same person
computer system, in our case - the SCADA establishes the rules for controlling access
system. Each requirement has its own to the SCADA system, periodic scans of the
unique identifier (e.g. URS-01 etc.), in or- SCADA system, managing deviations from
der to assure traceability of the require- good manufacturing practice, managing
ments in the next steps of validation and to changes on a computer system, etc. Other
help preventing omitting any of the desired participants, contributing to identifying
system functionalities in the process of the the requirements, are those responsible for
computer system development. Unique health, safety, and environment (HSE) and
identification facilitates control of whether information security officers. The result is
all system functionalities were tested. creation of an URS [R1] document.
The technician, who is a SCADA sys- Table 1 provides an example of an URS
tem user and an expert in the production document with three very simple require-
process management field, usually does ments for the computer-based system func-
not have sufficient knowledge of computer tionality: in the first column, we define a
systems regulations, and therefore the qual- unique request identifier (ID) for the pur-
ity assurance (QA) manager, an expert in pose of ensuring traceability; in the second
the field of computer systems (eCompli- column, we specify the request for a com-
ance), gets involved in the process. In our puter-supported system, and the third col-
case, the QA manager adds additional sys- umn specifies the requirement criticality, in
tem requirements for data integrity man- terms of the level of importance related to
agement (e.g. data deletition prevention, this requirement. For example, we can say
user data access restrictions, system access that the requirement is Essential, Important,
levels etc.), requirements for alarm moni- or Desired.
toring, and versioning of recipes stored in
Table 1. Example of URS – Functionalities in the URS document
URS ID Requirement Criticality
URS-x-01 … Essential/Important/Desired
… … …
Screen display of control system must show the entire
URS-F-49 Essential
production process on one screen with process values.
The control system must show on the screen display, who is
URS-F-50 Essential
signed in, and the date and time.
The control system must record all process parameters in the
URS-F-51 graph with the time on the x-axis and parameter values on Essential
the y-axis and enable a real-time display of these parameters.
… … …
URS-x-n User requirement – n Essential/Important/Desired

9
Journal of Contemporary Management Issues

[K3] Create High Level Risk choosing the best one, in order to assess
Assessment (HLRA) that the supplier is able to develop com-
With HLRA, we perform the original puter systems, in accordance with the phar-
computer-based system classification - GxP maceutical industry standards and company
relevance of the computer-based system internal standards. The assessment shall be
and the computer system/application cate- recorded in the Supplier Evaluation Report
gorization. With the purpose to ensure easi- [R3] document. In case that we already
er approach to validation, computer systems conducted supplier assessment in the past
are classified into one of the GAMP catego- (e.g. 5 years) and supplier obtained posi-
ries that represent a standard for computer tive assessment results, the assessment im-
systems in the pharmaceutical industry plementation is not necessary, when vali-
(International Society for Pharmaceutical dating a new computer system/application.
Engineering - ISPE, 2008, pp. 128-132; Nevertheless, we conduct the supplier as-
Tedstone, 2012; McDowall, 2010, pp. 22- sessment once again, if the supplier has
31). As far as the SCADA system catego- been gone through a major organizational
rization, we determined it belongs to the change.
GAMP4 category (for controlling and man-
aging production), being a configurable [K5] Create Validation Plan (VP)
computer system. In our case, platform (e.g. VP [R4] is a document describing the
Proficy iFix) on the SCADA system will be computer system validation method and
modified and configured by an integrator principles for validating a computer sys-
(supplier), according to our business needs tem. The basis for producing VPs are URS
and the URS. [R1] and HLRA [R2]. We also consider
the Supplier Evaluation Report [R3]. VP
In HLRA, we also determine if the com- describes, on the aggregate level, which
puter system is 21 CFR Part 11 relevant or activities are planned and should be con-
not (we ask ourselves whether the system ducted for successfull system validation,
will store electronic records or use elec- which internal SOP and general procedures
tronic signatures). In our case, the com- should be updated, which trainings should
puter system will store process data that be conducted and who needs to be trained,
are classified as GxP relevant, therefore the which documents will be created during the
system falls under 21 CFR Part 11 regula- validation process, who will draw them up,
tory requirements. Electronic signatures who will review them and who will approve
will not be used. In addition, in HLRA, we the validation documentation.
determine information security (ISEC) im-
pact, health, safety and environment (HSE) 5.3.2. Specifying sub-process
impact and impact on personal data. On the When the new computer system basis is
basis of the HLRA [R2] result, we decide defined and HLRA and VP are developed,
which computer system validation activities we begin to develop the computer sys-
are needed to properly validate the system. tem functionality and specifications, based
[K4] Conduct Supplier Assessment on the approved URS. The sub-process
Since in our case URS [R1] is sent to diagram – Specifying (Figure 3) shows de-
several integrators/suppliers of supervi- tails of the key steps for conducting these
sory computer systems, it is necessary to activities.
carry out an assessment of suppliers before

10
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

Figure 3. Sub-process diagram – Specifying

A more detailed description of the is developed by an external supplier, which

specific steps within the sub-process creates the design documents and sends us
Specifying is presented below. the documents for review and approval.

[K6] Create Design Documents In design documents, the suppliers de-

URS [R1] is the basis for creating scribe how they see and understand the
the Functional Specification (FS), the computer system, according to the given
Software Design Specification (SDS) and URS, while it is desirable to indicate the
the Hardware Design Specification (HDS). references to the URS ID, as shown in
The documentation is created by the com- Table 2. Only in such a way, it can be en-
puter system supplier, or, alternatively, pro- sured that the supplier will create a com-
duced by the company, when the computer puter system in accordance with the URS.
system is internally developed. In our case, Table 2 presents an example of system
the monitoring/controlling system SCADA functionalities described in FS.

11
Journal of Contemporary Management Issues

Table 2. FS example – System functionalities in FS document

FS ID Function Description URS reference
FS-xx-01 … URS-x-01
... ... ...
Screen display of the control system contains all the standard elements,
displays and interfaces for the review and control of the production URS-F-49
FS-EP-01
process with the entire technological procedure, showing all the necessary URS-F-50
parameters, including the time code and identification of the logged-in user.
The display of the captured data in the form of a graph (histography) is part
FS-HI-01 of the iFix application, which, in addition to other functionalities, enables URS-F-51
real-time data display of all defined parameters.
... ... ...
FS-xx-n … URS-x-n

When reviewing the FS, we note all documentation to embrace all URSs, or
disparities with the given URS and the the user may limit its requirements for the
whole process is formalized into Design computer system and create new URS.
Qualification (DQ). If no discrepancies are
detected during the inspection, this should It is important to emphasize that, in the
nevertheless be documented and formalized in pharmaceutical industry, the functionality
the DQ. of a computer system can only restricted,
if it does not have any impact on regulato-
[K7] Conduct Design Qualification ry requirements. However, we cannot limit
(DQ) the requirements, imposed indirectly by the
In our SCADA system case, at this regulatory authorities, in any way, since, in
point we receive the design documenta- this case, we validate a computer system
tion from the supplier for review and ap- that does not comply with the prescribed
proval (FS, SDS and HDS [R5]). Since regulations from the start.
it is in our interest to obtain such a com-
puter system, as defined in the URS [R1], [K8] Conduct (Functional) Risk
at this stage, we need to review of whether Assessment (FRA)
the design documentation provided by the After confirming FS, SDS and HDS
supplier actually covers all of our URS [R5] and considering this documenta-
requirements. This is important, as the tion together with URS [R1], we produce
supplier will build the computer system the FRA [R7], in which we evaluate each
exactly as it has been defined in FS, SDS of the URSs, according to GxP computer
and HDS. After completing the compari- system individual functionality criticality.
son between the URS and the FS, SDS and We evaluate the possible risks we could
HDS, appointed responsible persons ap- encounter, in the event of a failure or non-
prove the record that was created, when performance of each functionality, assess
review of the documents was conducted. the frequency at which these events can
It is formally called the design qualifica- occur, the criticality of these events, in
tion - DQ [R6]. In the event that deviations terms of impact on product quality, patient
from the URS have been detected in the safety, safety at work, etc. and we evalu-
DQ, the supplier must update the design ate the possibility of detecting an improper

12
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

operation or error. Based on the results of as intended is high, the appropriate

each computer system functionality criti- Installation Qualification (IQ), Operational
cality assessments, we decide what kind of Qualification (OQ) and Performance
testing will be selected for each function- Qualification (PQ) testing of the computer
ality. The tests can be simple or complex, system are performed at the verification
and each decision needs to be explained phase.
and commented on, in relation to each
functionality, i.e. we need to explain why An example of risk analysis is shown in
we have chosen a certain type of testing. Table 3, where GxP criticality of the system
functionalities is evaluated (YES/NO), the
Therefore, the evaluation and descrip- impact of errors/deviations, the possibil-
tion of risks are implemented for the ity of an error/deviation, and the possibil-
events where the computer system would ity of not detecting an error/deviation are
not function in accordance with, in our determined (H - high impact/possibility; M
case, the functionalities specified in FS. - mean impact/possibility; L - low impact/
Where the risk of the system not operating possibility).
Table 3. FRA example

Possibility of non-detection
Possibility of occurrence of
Impact/consequences of
Functionality GxP

Risk scenario/details of potential error

error/deviation

Way of testing
or deviation
of err. /dev.
criticality

err. /dev.

Remark
FS ID

Un-sufficient production process OQ

FS-EP-01 YES H L L /
management; inadequate product test
No process data for review; no
possibility of process data review;
regulatory inconsistency; GMP OQ
FS-HI-01 YES H L L /
deviation investigation is not possible test
in full scale; product cannot be
released on the market.

13
Journal of Contemporary Management Issues

5.3.3. Development/Building sub-process

Figure 4 shows the inputs required for
the construction of a computer system, as
well as the result that follows - a developed
computer system and the related technical
and user documentation.

Figure 4. Sub-process diagram – Development/Building

A more detailed description of the that complies with the URS, and in our
specific steps within the sub-process of case, the supplier is also obliged to produce
Development/building is presented below. technical and user documentation [R9]. All
users are required to study them closely be-
[K9] System/application development fore using the computer system.
and documentation
At this stage, we start with the com-
5.3.4. Verification sub-process
puter system construction (in our case – the
SCADA system). In development, the basic As a part of the verification, we verify
principles, defined in the VP [R4], must be that the computer system works in accord-
taken into account, while the main docu- ance with the users’ expectations. As shown
mentation for development are FS, SDS and in Figure 5, this is checked by IQ, OQ and
HDS [R5]. The result is a computer system PQ tests.

14
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

Figure 5. Sub-process diagram - Verification

More detailed description of spe- [K10] Test Planning (according to VP

cific steps, within the sub-process of [R4])
Verification, is presented below.
When a computer system is developed
(a SCADA system, in this case), it must
pass robust testing to prove that it works
faultlessly and in accordance with the

15
Journal of Contemporary Management Issues

specifications. Validating a computer sys- production) processes during operation in its

tem scope and methodology is prescribed specified production environment in accord-
by the VP, and the Test plan [R10] fur- ance with the pre-approved specifications
ther describes which IQ, OQ and PQ tests (International Society for Pharmaceutical
are required. When we have a developed Engineering - ISPE, 2008, p. 284,
and approved tests plan, we write the IQ International Society for Pharmaceutical
[R10.1], OQ [R10.2] and PQ [R10.3] test Engineering - ISPE, 2014b). The results of
specifications, where we define what we completed test specifications, obtained after
test, how to perform the test, and what is the tests, are called test reports. This gives
the expected result. three sets of IQ test reports [R11.1], OQ test
reports [R11.2], and PQ test reports [R11.3].
[K11] Testing In cases where an error occurred in the
We test the system, in accordance with course of testing and the testing was not suc-
the test plan [R10] on pre-approved test cessful or was only partially successful, this
specifications IQ [R10.1], OQ [R10.2] and is documented as a test deviation. Both devi-
PQ [R10.3], which are based on the results ations as well as the relevant test reports are
from the FRA. Installation of a computer summarized in the Test and Deviation Report
system is tested with: an IQ test, which is a [R11] document.
documented verification that the computer
system is installed in accordance with the If we look at the continuation of our
pre-approved specifications (International case, it is clear from Table 4 that both func-
Society for Pharmaceutical Engineering, tionalities of a computer system need to be
ISPE, 2008, p. 209, International Society for tested with the OQ test. The test specifica-
Pharmaceutical Engineering - ISPE, 2014); tion itself must be approved before the test-
OQ test, which is a documented verification ing starts, as the test steps after the approval
of pre-approved specifications that computer of the test specification are carried out on
system performs as intended throughout all a copy of the approved test specification.
anticipated operating ranges (International The expected result, appropriateness, date,
Society for Pharmaceutical Engineering, and signature are recorded manually in the
ISPE, 2008, p. 334, International Society fields provided for that purpose during the
for Pharmaceutical Engineering - ISPE, test implementation. In Table 4 we present
2014a) and PQ test, which is a documented an example of the OQ test specification,
verification that the system is capable of with the manually entered text being greyed
operating and/or controlling (in our case out in the table.

16
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

Table 4. OQ test example

Test name: OQ-1_screen test Prerequisite: Approved FS and FRA
Actual
result,
Ref. As Date and
Step Ref. URS Test description Expected result reference
FS expected signature
to the
attachment
Run and login
The screen
into application
shows the entire
iFix. Verify if on
production
the control screen 30.04.2014
process,
URS-F-49 FS- whole production Result as
1 including YES
URS-F-50 EP-01 process is shown, expected. Janez
process values,
together with Novak
date and time,
process values,
and logged-in
time and date and
users.
logged-in user.

Test name: OQ-2_parameters and history test Prerequisite: Approved FS and FRA
Open „history“ in System is
Result as
iFix. Verify that capturing 30.04.2014
expected.
FS- the control system defined process
1 URS-F-51 YES
HI-01 records all process data real-time Janez
Attachment
parameters in the in the history Novak
1
graph in real time. graph.
Open »history« in Graph shows
Result as
iFix and verify that time values 30.04.2014
expected.
FS- the graph shows on X axis and
2 URS-F-51 YES
HI-01 time on X axis and parameter Janez
Attachment
parameters on Y values on Y Novak
1
axis. axis.

[K12] Deviation management SDS and HDS [R5]. We have also exam-
If the test report [R11] indicates that the ined the possible deviations, by comparing
computer system deviations are recorded, FS, SDS, HDS and URS and documented
we have to eliminate them. The method of them in the DQ [R6]. It is, also, necessary
removing the deviations depends on the er- to provide traceability, where it is evident,
ror type. In these cases, it may also be nec- in a transparent manner, whether all URS
essary to correct the design of the computer have been considered in the design docu-
system itself. The deviation is successfully ments (this is already checked in DQ) and
resolved when repeated tests are success- which tests (IQ, OQ, PQ) were used to
fully completed without deviations. test these requirements. To start the crea-
tion of TM [R12], there is no need to wait
[K13] Create Traceability Matrix for the computer system verification, as we
(TM) can start to build it earlier (during the de-
What we demanded from the computer sign qualification - DQ). This ensures the
system supplier is defined in the URS [R1] first part of the traceability between URS
and what we actually obtained is in FS, and FS, SDS and HDS. The second part is

17
Journal of Contemporary Management Issues

provided by IQ, OQ and PQ tests, where we documented and, retrospectively, we must

connect the design documentation with test perform testing.
reports. As already mentioned, each user’s
request is marked with a unique identifier Once the tests are completed, we can
(ID), so that we can guarantee the traceabil- build the whole TM, to verify and ensure
ity of document designs and tests. If we find that all the required URS functionalities
out that we have failed to test one of the were duly considered by the supplier and
computer system functionality, this must be tested, in accordance with the FRA results.
TM for our example is shown in Table 5.
Table 5. TM example
URS FS SDS HDS IQ OQ PQ Comment
URS-F-49 FS-EP-01 / / / OQ-1_screen test – step 1 / Complies
URS-F-50 FS-EP-01 / / / OQ-1_screen test – step 1 / Complies
OQ-2_parameters and history test –
URS-F-51 FS-HI-01 / / / / Complies
steps 1, 2

5.3.5. Report sub-process

Figure 6 shows last activities needed be-
fore the release of the computer system into
production and operational use.

Figure 6. Sub-process diagram – Report

A more detailed description of the spe- [K14] Conduct User Training
cific steps within the sub-process Report is Before the system goes into produc-
presented below. tion and operational use, it is necessary to
ensure that all (prospective) users of the
computer system are trained, by using the
Technical and User documentation [R9]. It

18
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

is also necessary to train users on instruc- of regulatory requirements, combined with

tions or company procedures that describe the knowledge and understanding the actual
the process and workflow, controlled by the operation of computer systems. Finally, for
computer system. The training of users is a successful computer system validation,
documented in the Training report [R13]. we also need to understand the actual work
processes. The presented established QMS
[K15] Create Validation Report (VR) for the computer system validation is the
When all the activities envisaged in the result of the case of a specific legal require-
VP [R4] are properly completed, this is ments interpretation, related to a pharma-
listed in VR [R14]. A validated VR means ceutical company.
that the computer system (in our case - the
SCADA system) is successfully validated
and can be routinely operated without any
restrictions. The last approval date on VR In accordance with the second research
means the computer system validation date question on how to perform the computer
(CSV date). system validation, considering the pharma-
ceutical industry regulatory requirements,
we studied the basic validation process ele-
ments of a computer-aided system. To this
6. DISCUSSION end, we used the action research method in
The paper addresses two research ques- conjunction with the case study to test the
tions. The first one is related to the standard usefulness of a general V-model and de-
operating procedures included in a specific termine sub-processes for all stages of the
pharmaceutical company QMS for comput- computer system validation process, con-
er systems validation. sidering the regulatory requirements. The
paper defines the validation process for a
In accordance with this question, the computer system and presents and explains
paper identified standard operating pro- it on a practical example in the pharma-
cedures, representing the elements of the ceutical industry. The study confirms that
quality system for the validation of com- the V-model is an appropriate basis for the
puter systems in conformance with the re- validation of computer systems in the phar-
quirements of the European and US legisla- maceutical industry and that the established
tion, governing the pharmaceutical industry. QMS, consisting of the general and specific
Today, one of the major challenges in de- standard operating procedures, represents
signing a QMS in the field of computer an appropriate framework for the imple-
systems are either wrong, or simplified in- mentation of computer system validation.
terpretations of regulatory requirements. The experience from this highly regulated
Errors in content or non-conformance with industry, however, can be appropriately
regulatory requirements often occur, be- used in other, less regulated industries, to
cause of lack of understanding of computer provide the basic purpose of validation,
usage and computer system definitions, where ensuring data integrity is a key re-
and/or lack of understanding how computer quirement for operation of the computer
systems work. Although the regulatory re- systems.
quirements are basically general, the key
to defining and designing a proper QMS The paper contributes to understanding
is understanding and correct interpretation of interpretation of regulatory requirements
in the computer system validation field in

19
Journal of Contemporary Management Issues

the pharmaceutical industry. We do not vali- another context, e.g. less regulated indus-
date computer systems to successfully un- tries, should also be investigated.
dergo inspections, but rather to fully ensure
the data integrity, to minimize quality risks
of a computer system or IT applications and
7. CONCLUSION
to improve the overall product quality. It is
important for the pharmaceutical industry This paper identifies elements of com-
that all suppliers and integrators of comput- puter systems validation QMS and process,
er-aided systems, working with pharmaceu- for a specific case of a pharmaceutical or-
tical companies at the GxP level, be aware ganization. In the pharmaceutical industry,
that the set of regulations, consequently, ap- the computer system should be validated
plies to them, as well. They must be able to in accordance with the regulatory require-
demonstrate compliance with the regulatory ments. Based on the European and US le-
requirements and, in addition, the regula- gal requirements, we defined general and
tions and internal standards of the pharma- specific standard operating procedures,
ceutical company, with which they cooper- which represent QMS elements for com-
ate. Pharmaceutical companies are obliged puter system validation in a pharmaceutical
to carry out audits of the suppliers and in- organization. The use of the QMS, which
tegrators with whom they cooperate, and meets the strict pharmaceutical industry
these assessments are becoming increasing- legal requirements, is not limited to it, but
ly rigorous in the computer systems field. its elements are also applicable to other in-
dustries. The presented QMS can provide
The presented structure of the QMS has guidelines for all companies that need to
been designed for a specific pharmaceutical develop an appropriate framework for com-
company, operating in a highly regulated puter systems validation and implementa-
environment. The quality system elements tion of effective management of computer
shown also represent merely a framework system validation processes.
for operational computer system valida-
tion. Therefore, future work should be fo- With the production computer system
cused on testing the appropriateness of the validation process example in the pharma-
presented QMS structure within other phar- ceutical industry, we assure a more pro-
maceutical companies. Similar limitation found understanding of computer system
is related to the use of a single case study validation implementation in practice, with
for identification of process validation ele- the emphasis on meeting pharmaceutical in-
ments. Using a single case study enables the dustry regulatory requirements. As a basic
exploration of a particular field, problem, or premise, we use the V-model methodology
situation in depth and in relation to a spe- to approach the validation. Planning, speci-
cific context, in our case, as determined by fication, development/building, verification
the regulatory framework. In order to verify and reporting, as the key five activities of
the presented validation process, it is neces- the project/validation of a computer system,
sary to add additional case studies, within are presented, by using process diagrams,
the same context, i.e. the pharmaceutical based on a practical validation example of
industry. In addition, the appropriateness a SCADA manufacturing computer-aided
of presented QMS structure and valida- system.
tion process, or respectively, the need for
their adaptation and/or simplification, in

20
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

References 8. European Compliance Academy (2011c).

The GAMP5 Approach to Computer
1. Eisenhardt, K.M. (1989). Building
Systems Validation. ECA Education
Theories from Case Study Research.
Course – Computer Validation The
The Academy of Management Review,
GAMP5 Approach. Vienna, Austria:
14 (4), 532-550.
Concept Heidelberg GmbH.
2. European Commission. (2011a).
9. Gill, A.Q, Chew, E. (2019).
EudraLex – Volume 4 Good
Configuration information system ar-
Manufacturing Practice Medicinal
chitecture: Insights from applied ac-
Products for Human and Veterinary Use,
tion design research. Information &
Chapter 4: Documentation, available at:
Management, 56 (4), 507-525.
http://ec.europa.eu/health/files/eudralex/
vol-4/chapter4_01-2011_en.pdf (ac- 10. Huber, L. (2012). Computer System
cessed 25 February 2017). Validation – Tutorial, available at:
http://www.labcompliance.com/tutori-
3. European Commission. (2011b).
al/csv/ (accessed 18 January 2014).
EudraLex – Volume 4 Good
Manufacturing Practice Medicinal 11. International Society for
Products for Human and Veterinary Use, Pharmaceutical Engineering - ISPE.
Annex 11: Computer Systems, available (2008). GAMP 5: A Risk-based
at: http://ec.europa.eu/health/files/eu- Approach to Compliant Gxp Computer
dralex/vol-4/annex11_01-2011_en.pdf Systems. Tampa, Florida: International
(accessed 25 February 2017). Society for Pharmaceutical
Engineering.
4. European Commission. (2013a).
EudraLex – Volume 4 Good manu- 12. International Society for Pharmaceutical
facturing practice (GMP) Guidelines, Engineering - ISPE. (2014a). ISPE
available at: http://ec.europa.eu/health/ Glossary of Pharmaceutical and
documents/eudralex/vol-4/ (accessed Biotechnology Terminology, available
25 February 2017). at: http://www.ispe.org/glossary?term=
Installation+Qualification+%28IQ%29
5. European Commission (2013b). EU
(accessed 26 April 2014).
Legislation – Eudralex, available at:
http://ec.europa.eu/health/documents/ 13. International Society for Pharmaceutical
eudralex/index_en.htm (accessed 25 Engineering - ISPE. (2014b). ISPE
February 2017). Glossary of Pharmaceutical and
Biotechnology Terminology, available
6. European Compliance Academy
at: http://www.ispe.org/glossary?term=
(2011a). Introduction & Welcome. ECA
Operational+Qualification+%28OQ%29
Education Course – Computer Validation
(accessed 26 April 2014).
The GAMP5 Approach. Vienna, Austria:
Concept Heidelberg GmbH. 14. Koshy, E., Koshy, V. and Waterman, H.
(2011), Action research in Healthcare,
7. European Compliance Academy (2011b).
1st ed., Sage Publications Ltd., London.
Laws, Regulations and Guidelines for
Computer and Control Systems. ECA 15. Lopez, O. (2012). For Life Science
Education Course – Computer Validation Professionals, Annex 11 and 21 CFR
The GAMP5 Approach. Vienna, Austria: Part 11: Comparisons for International
Concept Heidelberg GmbH. Compliance, available at: http://
www.mastercontrol.com/newsletter/

21
Journal of Contemporary Management Issues

annex-11-21-cfr-part-11-comparison. 24. Singh A., Singour, P., Singh, P. (2018).

html (accessed 25 February 2017). Computer system validation in the per-
16. McDowall, R. D. (2010). Understanding spective of the pharmaceutical indus-
and interpreting the GAMP5 life cy- try. Journal of Drug Delivery and
cle models for software. Spectroscopy, Therapeutics, 8 (6), 359-365.
25(4), 22–31. 25. Tedstone, B. (2012). Computer
17. MetricStream (2014). Systems Systems Validation. Computer Systems
Validation for 21CFR Part 11 Validation and Quality Assurance
Compliance, available at: http://www. blog, available at: http://computersys-
metricstream.com/insights/sys_valida- temsvalidation.blogspot.com/2012/11/
tion.htm (accessed 25 February 2017). GAMP-Software-Category.html (ac-
cessed 27 April 2014).
18. PIC/S (2007). Pharmaceutical Inspection
Co-Operation Scheme Guidance – Good 26. U.S. Food and Drug Administration
Practices For Computerised Systems In - FDA (2002). General Principles
Regulated Gxp Environments, available of SoftwareValidation; Final
at: http://www.picscheme.org/pdf/27_pi- Guidance for Industry and FDA
011-3-recommendation-on-computer- Staff. U.S. Department Of Health
ised-systems.pdf (accessed 23 December and Human Services Food and Drug
2013). Administration, available at:
19. Ranbaxy Laboratories Limited (2014). 27. h t t p : / / w w w. f d a . g o v / d o w n l o a d s /
Data Integrity, available at: http://www. MedicalDevices/Device Regulationand
slideshare.net/skvemula/presentation- Guidance/GuidanceDocuments/
on-data-integrity-in-pharmaceutical-in- ucm085371.pdf (accessed 25 February
dustry# (accessed 21 May 2014). 2017).
20. Sallubier, T., Rusjan, B. (2017). 28. U.S. Food and Drug Administration
Oblikovanje sistema kakovosti za vali- - FDA (2003). Guidance for Industry
dacijo računalniških sistemov – primer Part 11, Electronic Records; Electronic
farmacevtske industrije, Revija za uni- signatures – Scope and Application.
verzalno odličnost, 6 (3), 274-291. U.S. Department of Health and Human
Services, available at: http://www.fda.
21. Sai, D.C., Bhavyasri, K., Rambabu,
gov/downloads/RegulatoryInformation/
D. (2019). Role of Computer System
Guidances/ucm125125.pdf (accessed
Validation to Safeguard Data Integrity
25 February 2017).
in Pharmaceutical Industry-A
Review, International Journal of 29. U.S. Food and Drug Administration –
Pharmaceutical Science Invention, 8 FDA (2004). Pharmaceutical cGMP‘s
(1), 35-41. for The 21St Century, A Risk Based
Approach, Final Report. U.S. Department
22. Saunders, M., Lewis, P. and Thornhill,
Of Health and Human Services Food
A. (2009), Research Methods for
and Drug Administration, availa-
Business Student, 5th ed., Pearson
ble at: http://www.fda.gov/downloads/
Education Limited, Harlow.
Drugs/DevelopmentApprovalProcess/
23. Siggelkow, N. (2007). Persuasion with Manufacturing/QuestionsandAnswerson
case studies, Academy of Management CurrentGoodManufacturingPracticesc
Journal, 50 (1), 20-24. GMPforDrugs/UCM176374.pdf (accessed
25 February 2017).

22
 Management, Vol. 25, 2020, No. 2, pp. 1-23
B. Rusjan: COMPUTER SYSTEM VALIDATION: EXAMPLE OF QUALITY MANAGEMENT ...

30. U.S. Food and Drug Administration - 32. U.S. Food and Drug Administration –
FDA (2006). Guidance for Industry, FDA (2013b). CFR – Code of Federal
Quality Systems Approach to Regulations Title 21, Volume 4 – Part
Pharmaceutical CGMP Regulations, 11 Electronic Records; Electronic
available at: http://www.fda.gov/ Signatures, available at: http://www.
downloads/Drugs/.../Guidances/ accessdata.fda.gov/scripts/cdrh/cfdocs/
UCM070337.pdf (accessed 25 cfcfr/cfrsearch.cfm?cfrpart=11 (ac-
February 2017). cessed 26 December 2013).
31. U.S. Food and Drug Administration - 33. Velkovrh Remec, B. (2007). Validation
FDA (2013a). CFR – Code of Federal in pharmaceutical industry, avail-
Regulations Title 21, Volume 4 – Part able at: http://www.scribd.com/
211 Current Good Manufacturing doc/23022819/VALIDACIJE (accessed
Practice for Finished Pharmaceuticals, 25 February 2017).
available at: http://www.accessdata. 34. Yin, R.K. (2009), Case study research:
fda.gov/scripts/cdrh/cfdocs/cfcfr/cfr- Design and methods, 4th ed., Sage,
search.cfm?cfrpart=211 (accessed 26 Thousand Oaks.
December 2013).

VALIDACIJA RAČUNALNOG SUSTAVA: PRIMJER

UPRAVLJANJA DIZAJNA SUSTAVA UPRAVLJANJA
KVALITETOM I PROCESNE IMPLEMENTACIJE

Sažetak
Cilj ovog rada je prezentacija sustava upravljanja kvalitetom (Quality Management System - QMS)
za validaciju računalnih sustava te prikaz validacijskog procesa na praktičnom slučaju farmaceutske
tvrtke. Na temelju europskih i američkih pravnih zahtjeva, definiramo QMS za validaciju elemenata
računalnog sustava. Primjer procesa validacije, zasnovan na korištenju općeg V-modela, pruža detalj-
no razumijevanje praktične implementacije validacije u praksi. Validacija računalnog sustava u kon-
kretnoj organizaciji može se temeljiti na općim i specifičnim standardnim operativnim procedurama,
koje formiraju QMS. Validacijske aktivnosti planiranja, specificiranja, razvoja/izgradnje, verificiranja
i izvještavanja se prezentiraju korištenjem procesnih dijagrama, zasnovanih na praktičnom primjeru
validacije računalnog sustava za upravljanje proizvodnjom Supervisory Control and Data Acquisition
(SCADA). Empirijski dio rada koristi dvije istraživačke strategije: studiju slučaja i akcijsko istraživa-
nje. Predstavljeni procesa validacije, kao i primjer računalnog sustava za upravljanje kvalitetom mogu
pružiti smjernice za sva poduzeća, kojima su računalni sustavi značajni. Iako se prezentirani QMS i
proces validacije računalnog sustava zasnivaju na primjeru konkretnog farmaceutskog poduzeća i nje-
govih pravnih zahtjeva, iskustva iz visoko regulirane industrije se mogu na odgovarajući način koristiti
i u manje reguliranim industrijama. Za verifikaciju predloženog modela, potrebno ih je dalje testirati,
kako u farmaceutskim, tako i u drugim, manje reguliranim industrijama.

Ključne riječi: sustav za upravljanje kvalitetom, računalni sustavi, validacija, V-model, farmace-
utska industrija

23