See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/328747578

Towards Computer System Validation: An overview and Evaluation of Existing

Procedures

Article  in  Journal of Innovation Management in Small and Medium Enterprises · November 2018

DOI: 10.5171/2018.512744

CITATIONS READS
2 2,577

2 authors:

Marius Schönberger Tatjana Vasiljeva

Hochschule Kaiserslautern RISEBA University of Applied Sciences
53 PUBLICATIONS   107 CITATIONS    39 PUBLICATIONS   95 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Computer System Validation in the Medical Device Industry View project

PHYSICIANS' PERFORMANCE IN DUAL PRACTICE View project

All content following this page was uploaded by Marius Schönberger on 05 November 2018.

The user has requested enhancement of the downloaded file.

IBIMA Publishing
Journal of Innovation Management in Small & Medium Enterprises
https://ibimapublishing.com/articles/JIMSME/2018/512744/
Vol. 2018 (2018), Article ID 512744, 15 pages, ISSN: 2166-076X
DOI: 10.5171/2018.512744

Research Article

Towards Computer System Validation:

An overview and Evaluation of
Existing Procedures

Marius Schönberger and Tatjana Vasiljeva

RISEBA University of Business, Arts and Technology, Riga, Latvia

[email protected]

Received date: 16 February 2018; Accepted date: 9 June 2018; Published date: 2 November 2018

Academic Editor: Larisa Mihoreanu

Copyright © 2018. Marius Schönberger and Tatjana Vasiljeva. Distributed under Creative Commons
CC-BY 4.0

Abstract

The medical device industry in Europe is one of the sectors actively regulated by directives.
Medical device manufacturers face the challenge of implementing the statutory regulations. In
the context of current trends regarding the digitalization of enterprises, among other things, a
focus is on the computer system validation (CSV). The present research shows why the CSV in
the medical device industry is necessary, which different validation approaches exist, and which
tasks and activities are to be carried out within the CSV. One focus of this research is the critical
consideration of the problems associated with CSV for small and medium-sized enterprises
(SMEs). As a result of this research, it can be stated that the identified literature sources are
very homogeneous, and the validation approaches do not show any significant differences.

Keywords: Computer system validation, Business processes, Medical device industry, SME.

business processes. Software has thus be-

Introduction come a significant economic factor and occu-
pies an important position not only in busi-
Software products are increasingly becoming ness, science and technology, but also in the
the central component of complex electronic healthcare sector (Schönberger, 2014).
devices that control or support technical or Thereupon, electronic and computer-based

______________

Cite this Article as: Marius Schönberger and Tatjana Vasiljeva (2018), “Towards Computer System Validation:
An overview and evaluation of Existing procedures”, Journal of Innovation Management in Small and Medium
Enterprise, Vol. 2018 (2018), Article ID 512744, DOI: 10.5171/2018.512744
Journal of Innovation Management in Small and Medium Enterprise 2

____________________________________________________________________________________

devices are also being widely deployed in approach are not specified. This leads to the
clinical environment, which was enabled by, challenge, that all medical device manufac-
for example, shrinking technologies, portabil- turers shall determine what needs to be vali-
ity, or increasing interconnectedness dated and how much validation is enough to
(Alemzadeh et al., 2013). Therefore, software ensure that regulatory requirements are met
plays an important role in the critical func- (Hrgarek, 2008).
tions of medical devices. However, from 2002
to 2010, medical devices based on software This key problem forms the basis for the
resulted in over 537 recalls affecting more present research and, thus, the question
than 1.5 million devices. During this period, arises, whether standardised procedures for
11.3% of all recalls were due to software the implementation of the CSV exist for the
failures (Fu, 2011). As Appendix 1 shows, a medical device industry. Although there are
total of 195 recalls for medical devices, re- various guidelines, e.g. the Gamp 5 Guide, ISO
sulting from software errors, were reported 26262-8 Section 11 or IEEE Std. 829, they
to the US Food and Drug Administration cannot always reflect the existing diversity of
(FDA) only in 2017 (FDA, 2018). It is appar- industries, size differences, or special re-
ent that medical devices are often subject to a quirements of, in particular, small and me-
high number of errors with potentially catas- dium-sized medical device manufacturers. In
trophic effects on the patients (Alemzadeh et addition, the implementation of these direc-
al., 2013). According to AAMI (2016), medical tives in SMEs is often hampered by limited
errors are involved in more than 250,000 resources, such as the lack of existing staff
deaths each year in the US and account for capacities or insufficient funding (Nguyen,
nearly one in ten deaths. Finally, the recall of 2009; Razak et al., 2009; Buschfeld et al.,
medical devices poses a problem that affects 2011). With regard to the aforementioned
the entire healthcare sector (Foe Owono, key problem, the following research ques-
2015; Maisel et al., 2001). tions are to be answered within the scope of
this research:
Against this background, it seems that with
the current technological possibilities of the 1. Which SME-specific approaches to
software development, a considerable in- CSV in the medical device industry
crease in the complexity of the devices and are dealt with in the scientific litera-
thus major challenges for the reliability, pa- ture, and what differences or simi-
tient safety and security emerge (Faris, 2006; larities do these approaches have?
Fu, 2011; Alemzadeh et al., 2013). Therefore, 2. What concrete recommendations for
the computer system validation (CSV) is a action can be derived from the given
major means of avoiding such defects and CSV procedures in the medical de-
resultant recalls (Bhusnure et al., 2015) and, vice industry for SMEs?
according to the FDA, a requirement of the 3. What are the implications for future
quality system for medical device manufac- research in the area of CSV?
tures (FDA, 2002). The analysis of different
literature on the topic of CSV shows that the This research is structured as follows: First,
implementation of CSV is not only necessary the necessary terminological basics are ex-
due to legal regulations, but also from eco- plained in section two. In section three, the
nomic, social and technological aspects (e.g. underlying research methodology is de-
Vogel, 2011; Thirumalai and Sinha, 2011; scribed. In section four, SME-specific ap-
Faris, 2006; Fu, 2011). However, the regula- proaches to CSV will be collected and ana-
tions only determine that a CSV has to be lysed based on a literature review. In this
carried out and which system or software context, the results are compared and evalu-
type is to be taken into account in the com- ated with regard to the research questions.
pany (e.g. FDA, 2002; ISO, 2016), the exact Finally, the contribution concludes with a
scope of the validation as well as a structured

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
3 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

summary of findings and an outlook on fur- medical technology (Klein, 2016). The medi-
ther research activities in section five. cal devices market in Europe is one of the
sectors actively regulated by directives (Foe
Basic Terminology Owono, 2015). As sometimes the lives of
patients depend on the proper functioning of
SMEs in Europe medical devices, new devices have to un-
dergo a stringent regulatory process before
they are ready to enter the market (Klein,
SMEs play an important role in Europe’s 2016). Two prominent regulatory bodies are
society and economy: The vast majority responsible for defining, updating and verify-
(99.8%) of all enterprises in the European ing compliance with these regulations for
Union are SMEs, 93% of these are micro en- medical devices in Europe: The European
terprises with fewer than ten employees. Medical Device Directive (93/42/EEC) regu-
SMEs employ more than half of the European lates which medical devices can be sold in the
workforce (66.8%) and are estimated to be European market, while the FDA uses the 21
responsible for 57.4% of the value added CFR 820 Quality Systems Regulation to pre-
(Muller et al., 2016). In view of the fact that scribe medical device manufacturers and
there is no single definition for SMEs nor any how to establish and maintain a quality as-
clear demarcation of SMEs and large enter- surance system (Francum, 2014). Although
prises (Schönberger and Kleinert, 2016), for the FDA is primarily responsible for the US
this research the definition according to the market, many European medical device
proposal by the European Commission is manufacturers are following FDA regula-
used (European Commission, 2003). Accord- tions, even if they do not sell their medical
ing to this recommendation, an enterprise devices in the US.
that has fewer than ten employees and an
annual turnover or annual total balance sheet
not exceeding two million euros is defined as Computer system validation in the medical
a micro enterprise. Small enterprises are device industry
companies that have fewer than 50 employ-
ees and an annual turnover or annual total The term validation is used in the corre-
balance sheet not exceeding ten million eu- sponding software-related literature in very
ros. Companies are referred to as medium- different meanings and must first be clearly
sized enterprises if they employ fewer than defined and delimited. Sommerville (2011)
250 employees and have an annual turnover describes the term validation as follows: “[…]
not exceeding 50 million euro or an annual validation is intended to show that a system
total balance sheet not exceeding 43 million both conforms to its specification and that it
euro (European Commission, 2003). meets the expectations of the system cus-
tomer”. The DIN ISO 9000:2015 norm defines
Medical device industry in Europe validation as a “confirmation, through the
provision of objective evidence, that the re-
quirements for a specific intended use or
The medical technology sector is one of the application have been fulfilled” (ISO, 2015).
most innovative industries in Europe (Klein, In this context, CSV is a requirement of the
2016). According to the research of MedTech quality system regulation. “Validation re-
(2015), around 7.5% of the total expenditure quirements apply to software used as com-
in health care is spent on medical technology ponents in medical devices, to software that
in 2015. Furthermore, 95% of the 25,000 is itself a medical device, and to software
medical technology companies in Europe are used in production of the device or in imple-
SMEs employing more than 575,000 people mentation of the device manufacturer's qual-
(MedTech, 2015). With approx. 30% of the ity system” (FDA, 2002). According to the
worldwide expenditure on medical devices, DIN norm mentioned before, any software
Europe holds one of the biggest markets for used to automate any part of the medical

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
Journal of Innovation Management in Small and Medium Enterprise 4

____________________________________________________________________________________

device production process must be validated Literature Research

for its intended use. This requirement applies
to any software used to automate, for exam- For the implementation of a systematic lit-
ple, device design, manufacturing or com- erature review, the search area was nar-
plaint design, as well as to any computer rowed down according to the following crite-
system used to create, modify and maintain ria:
electronic records or electronic signatures
(FDA, 2002).
• Content limitation: The literature
considered should refer as compre-
Research Methodology hensive as possible to various ap-
proaches to CSV in the medical de-
As described at the outset of this research, vice industry. For a better compara-
major challenges exist in the medical device bility of the approaches, the term
industry regarding the search for appropri- “SME” is used universally without
ate CSV approaches. To investigate this com- any specific industry reference
plex problem, a literature review is used to within the medical device industry.
determine existing approaches for SMEs in Furthermore, the software and com-
the medical device industry. However, the puter systems described in the lit-
heterogeneity of the companies established erature should be business informa-
in the medical device industry (Schönberger tion systems, e.g. enterprise resource
and Čirjevskis, 2017) makes it more difficult planning systems or software devel-
to represent branch-specific procedures and opment environments, and not soft-
approaches to CSV. Thus, the survey of a ware systems used in medical de-
complete and up-to-date overview of the vices, as these are not the focus of
literature is hardly realizable. Therefore, the the CSV.
aim of this research is to identify central • Linguistic limitation: According to
literature on the problem of the CSV, thus, the research background, European
the results of the literature review listed (see SMEs from the medical device indus-
Table 1) in this chapter do not claim to be try are the focus of the literature re-
exhaustive. Rather, a general orientation of view. Therefore, for a better compa-
the literature is to be presented. The struc- rability, only English literature is
ture of the literature review, which is based considered for this study. Due to sig-
on the methods of Schönberger et al. (2014) nificant differences between the
and Mikelsone and Liela (2015), is described definition of SMEs in the US and the
below. European Commission's proposal
(SBA, 2017), literature sources are
Problem formulation excluded, which refer to the defini-
tion of SMEs in the US, as this makes
The literature review will provide an over- it difficult to compare the English lit-
view of the content-thematic orientation of erature.
the literature. The objectives of the review • Limitation of the type of publication:
are to identify relevant literature on CSV in In order to reach the best possible
SMEs in order to compare and analyse vali- and appropriate results through the
dation approaches. Furthermore, this analy- literature review, research papers,
sis is intended to show whether recommen- conference papers, proceedings,
dations for the implementation of validation monographs, books as well as disser-
approaches exist and, if available, whether tations and habilitation treatise are
they counteract the challenges already de- examined and evaluated.
scribed for the implementation of validation
projects.

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
5 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

As the focus on SMEs implies the discovery of databases were searched for literature re-
only a few sources, there is no limitation search: Google Scholar, Elsevier, Scopus, Ebsco
regarding the time of the publication. A time Academic Search, Sciencedirect, Springer Link
limitation could thus possibly prevent the and Sage Journals. In a second step, a com-
identification of older relevant sources of prehensive keyword search was carried out
literature. Nevertheless, a consideration of in order to achieve better results for the lit-
current literature is being aspired. erature review. Therefore, the following
keywords were used: Software, Computer,
Literature Analysis Validation, Software Validation, Computer
Validation, Medical Device, Medical Device
Various criteria are used for the comparison Industry, SME, Business Information System,
and the analysis of the collected literature. Validation Process, Software Validation Proc-
On the one hand, the literature has to be ess, Computer Validation Process, Validation
addressed to SMEs or has to be oriented to- Approach, Software Validation Approach and
wards SMEs, on the other hand, the literature Computer Validation Approach. Finally, for
must show a systematic approach to CSV and the collection of other relevant literature, the
recommendations for action for SMEs. A bibliographies of the already determined
selection and definition of formal and didac- results were analysed.
tic comparison criteria, for example the year
of appearance, page numbers, learning objec- In the second phase of the literature review,
tives or best practices, will not be under- eleven relevant literature sources were iden-
taken. tified after the excluding of duplicates by
using the aforementioned keywords. These
Research findings results were structured according to author,
title, publication type, year and focused sec-
tor (see Table 1). Following this, the identi-
Results of the Literature Research fied literature was examined and selected for
its relevance with regard to the research
At the beginning of the study, a total of 1,231 topic and the previously defined limitation
sources of literature were identified in which criteria. For this purpose, the abstracts, in-
the term “computer system validation” was dexes and introductions of the publications
mentioned (see Appendix 2). However, this were analysed. Below, the contents of the
search has not yet been restricted to the identified literature sources, shown in Table
medical device industry, SMEs or standard- 1, are briefly explained and summarised
ised procedures. The following literature

Table 1: Results of the literature review using all keywords

Author(s) Title Type Year Focused sector

Computer software validation in 201
Bendale et al. Journal Pharmaceuticals
pharmaceuticals 1
Computer validation and ethical
Bhusnure et 201
security measures for pharmaceuti- Journal Pharmaceuticals
al. 5
cal data processing
GAMP 5: A quality risk management
Charan and 201 Medical Device
approach to computer system vali- Journal
Vishal Gupta 6 Industry
dation

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
Journal of Innovation Management in Small and Medium Enterprise 6

____________________________________________________________________________________

Good Laboratory practice (GLP) –

200
Esch et al. Guidelines for the Validation of Journal Laboratories
7
Computerised Systems
EU guidelines for good manufactur-
European 201 Medical Device
ing practice for medicinal products EU Guideline
Commission 5 Industry
for human and veterinary use
General principles of software vali-
200 Medical Device
FDA dation; Final guidance for industry US Guideline
2 Industry
and FDA staff
A management approach to soft- 200 Medical Device
Hrgarek Proceeding
ware validation requirements 8 Industry
Qualification and validation of soft-
200
Huber ware and computer systems in labo- Monography Laboratories
5
ratories
Welcome to the brave new world of 201
McDowall Journal Pharmaceuticals
CSV? 6
Tracy and A validation approach for laboratory 200
Journal Laboratories
Nash information management systems 2
201 Medical Device
von Culin New approach to system validation Journal
1 Industry
Computer system validation: A re- 201
Yogesh et al. Journal Pharmaceuticals
view 5

pean Commission, 2015; FDA, 2002;

The contents of the identified literature refer Yogesh et al., 2015; Huber, 2005),
to • approaches for CSV of laboratory in-
formation systems (Tracy and Nash,
• risk management approaches to CSV 2002; Esch et al., 2007), and
(Charan and Vishal Gupta, 2016; von • ethical security measures in the con-
Culin, 2011; Hrgarek, 2008; Tracy text of CSV (Bhusnure et al., 2015).
and Nash, 2002; European Commis-
sion, 2015; FDA, 2002), The identified approaches to CSV were most
• the use of the GAMP 5 standard for frequently published in journals and focused
CSV (Tracy and Nash, 2002; Hrgarek, on the medical device industry, pharmaceuti-
2008; European Commission, 2015; cals and laboratories sectors. The results of
Charan and Vishal Gupta, 2016), the identified research contributions have
• new approaches to CSV (Tracy and some similarities: The majority of the au-
Nash, 2002; Hrgarek, 2008; thors describe a risk-based approach to CSV
McDowall, 2016), or indicate that risks are to be identified and
• comparison of various approaches assessed during the CSV (Charan and Vishal
or methods to CSV (Tracy and Nash, Gupta, 2016; von Culin, 2011; Hrgarek, 2008;
2002; McDowall, 2016), Tracy and Nash, 2002, Esch et al., 2007).
• general guidelines to CSV (Bendale Some authors see the GAMP 5 standard as a
et al., 2011; Esch et al., 2007; Euro- suitable approach to CSV that can be applied
in companies without major adaptation
(Tracy and Nash, 2002; Hrgarek, 2008; Cha-

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
7 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

ran and Vishal Gupta, 2016). Others refer to steps compared to the general approach as
general CSV approaches given by the Euro- well as to the other procedures. The com-
pean Commission (2015) or the FDA (2002), parison shows that the validation approaches
for example Bendale et al. (2011) or Yogesh have a common basic pattern, although the
et al. (2015). individual procedures vary in the number of
phases, the description of the phases and the
In order to allow a comparison of the differ- temporal sequence. As can be seen, there are
ent approaches to CSV, the literature sources differences as well as similarities regarding
listed in Table 1 were analysed more pre- the beginning and the end of each validation
cisely. To ensure better comparability of process. While the EU Guideline provides for
procedures and as this research focuses on the preparation of a validation master plan
the European sector, the approach of the within the planning phase of the CSV (Euro-
European Commission (2015) has been cho- pean Commission, 2015), this task is defined
sen as a general approach that complies with as an independent process step by Bhusnure
the GAMP 5 standard. Therefore, the ap- et al. (2015), Yogesh et al. (2015), and Tracy
proach of the FDA (2002) will not be consid- and Nash (2002). Moreover, the approaches
ered further. Based on the analysis of the of Bhusnure et al. (2015), Hrgarek (2008),
literature sources, it has been shown that the and Esch et al. (2007) go beyond the conven-
authors Bendale et al. (2011), Huber (2005), tional validation and describe further phases
McDowall (2016), and von Culin (2011) do for error correction, system retirement or
not show any specific approaches or proce- vendor audits. Furthermore, the approaches
dures, but rather describe the principles of of Bhusnure et al. (2015), Tracy and Nash
CSV. The approach of Charan and Vishal (2002) and Esch et al. (2007) end with the
Gupta (2016) was also excluded because they phase of the revalidation which complies
used the GAMP 5 standard and, thus, it corre- with the EU Guideline. In this context, the
sponds to the general approach. Finally, the revalidation or re-qualification is defined as
approaches of the authors Bhusnure et al. the performance of a controlled manner to
(2015), Esch et al. (2007), Hrgarek (2008), maintain the validated status after any
Tracy and Nash (2002) and Yogesh et al. change of the computer system during its
(2015) were selected for the comparison. operational use (European Commission,
Although Bhusnure et al. (2015), Esch et al. 2015; Esch et al., 2007). Within the approach
(2007), and Tracy and Nash (2002) do not of Esch et al. (2007), the re-qualification is
focus on the medical devices industry, the divided into the two steps system in progress
described approaches can be applied to com- and change control. The approach of Yogesh
panies in the named industry. et al. (2015) ends with the phase of the per-
formance qualification, which is justified by
In a first step, the CSV procedures are exam- the fact that at the end of this phase, the
ined superficially, and the individual phases software has been checked for its intended
of the procedures are analysed and com- purpose and, thus, the validation process has
pared to the phases of the general approach. ended. Finally, it is conspicuous that the ap-
The results of the analysis and the compari- proach of Hrgarek (2008) establishes the
son of the procedures are shown in Figure 1. installation qualification as a validation-
The grey fields represent missing process inducing phase and has no preceding phases.

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
Journal of Innovation Management in Small and Medium Enterprise 8

____________________________________________________________________________________

Figure 1:: Comparison of approaches to computer system validation.

qualification phase are the documentation of

For a more detailed comparison of the pr pro- the hardware and software required for vali- val
cedures, the tasks and activities, which are dation as well as the development of a design
required for carrying out the CSV, are cocon- qualification document. t. Although the phase
sidered in addition to the listing of the ssu- of the factory and site acceptance testing is
perordinate phases and the chronological proposed by the EU Guideline, the therefore
sequence (see Figure 1). For this purpose, the required tasks are only defined by Tracy and
tasks occurring within the individual valid
valida- Nash (2002), Esch et al. (2007), and Hrgarek
tion approaches were analysed in more detail (2008). This can be explained by the fact that
and assigned to the phases of the general the testt of the equipment and the documen-
docume
validation approach (see Figure 2). tation of this test is more frequently required
in laboratories. In this context, Huber (2005)
In this context, a total of 43 tasks and activ
activi- also recommends the implementation of
ties were identified. Through the assignment, these tasks (see Table 2). Within the installa-
install
commonalities within the procedures could tion qualification phase, the documentation
be determined. In the planning phase
phase, each of instructions for verifying the installation of
procedure requires the description of the hardware and software is mainly provided.
equipment, systems and processes to be Within the installation qualification phase,
validated, as well as the consideration of the documentation of instructions for verify-
verif
standard operation procedures. Although the ing the installation of hardware and software
definition of a master validation plan is only is mainly provided. Furthermore, ore, the testing
provided by Bhusnure et al. (2015) and Yo- of the operational and performance functions
gesh et al. (2015) (see Figure 1), this task is as well as the documentation of these tests
also required within the planning phase by are essential tasks of the operational and
all authors. In the phase of specifying the performance qualification phases. During the
user requirements, the development of test re-qualification
qualification phase, the implementation of
procedures as well as the provision of info
infor- change managementt tasks as well as meas- mea
mation on the computer syst system, project ures for ongoing validation are recom- reco
documentations and task responsibilities are mended by Tracy and Nash (2002), Esch et
required. Necessary tasks within the design al. (2007), and Bhusnure et al. (2015). In the

______________

Marius Schönberger and Tatjana Vasi

Vasiljeva (2018),
), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
512744
9 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

follow-up
up phase, the documentation of Fai Fail- similarities. Within all validation approaches,
approaches
ure Mode and Effects Analysis (FMEA) is the documentation of the user requirements
defined by Bhusnure et al.. (2015) and Hrg
Hrga- specification
tion as well as the design, installa-
install
rek (2008) as the final validation task. As the tion, operational and performance qualifica-
qualific
follow-up
up phase of the CSV is not provided by tion is required.
each of the approaches, there are only a few

Figure 2: Overview of the phase

phase-related
related task and activities for computer system validation.

______________

Marius Schönberger and Tatjana Vasiljeva (2018),

), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.5127
512744
Journal of Innovation Management in Small and Medium Enterprise 10

____________________________________________________________________________________

shown that the tasks and activities of the

Criticism of the procedures for computer identified procedures can be attributed to
system validation in the medical device each phase of the general approach. Thus, the
industry and SMEs identified and evaluated validation ap-
proaches do not provide any clear delimita-
The following weaknesses of existing valida- tion criteria against general approaches. As a
tion approaches can be identified from the result, European SMEs also face the problem
results of the comparison that provide an of establishing the requirements and tasks of
explanation for the existing challenges in CSV the EU Guideline for CSV in their own indi-
in SMEs as well as answers to the formulated vidual corporate structures.
research questions.
3. No description of recommendations for
1. No references to SMEs action

As described before, approaches to CSV in As initially described, the introduction of an

SMEs should be identified by means of litera- approach to CSV is a difficult and time-
ture analysis. However, in none of the identi- intensive task for SMEs because, compared to
fied literature sources, references are given larger enterprises, there is often a lack of
to the adoption or the use of validation ap- specific knowledge, time and the necessary
proaches in SMEs. Thus, it seems that al- staff. For the implementation of an approach
though SMEs form the backbone of the Euro- to CSV, clear instructions are needed for
pean economy, they remain widely unob- SMEs. However, the authors described and
served (Schönberger and Kleinert, 2016; explained the individual steps within the
Schubert et al., 2007). Therefore, it is surpris- validation process as well as the activities
ing that this clientele is hardly the focus of and tasks for the implementation of the vali-
current research projects and that only a few dation, but clear and specific recommenda-
research papers, regarding the use and im- tions for action are missing. Although Esch et
plementation of approaches to CSV, can be al. (2007) clearly summarise necessary rec-
identified (see Table 1), despite the fact that ommendations for responsibilities, activities,
research focusing on computer systems in and documents in the context of the CSV,
SMEs, mainly business information systems, however, it is not always apparent in which
has been recommended by the research validation phase the recommended activities
community for several years (e.g. Schönber- and documents have to be carried out or
ger und Kleinert, 2016; Eckl et al., 2010; De- developed respectively. Moreover, neither
vos et al., 2014). Due to the fact that the ap- tasks nor activities specifically addressed to
proaches cannot be delimited by the proce- SMEs could be identified. Thus, the already
dures in large companies, SMEs continue to discussed heterogeneity of the medical de-
face the challenge of selecting and applying a vice industry can be verified (see chapter
suitable process for CSV. 2.2), which makes the standardisation of a
procedure for CSV more difficult and, there-
fore, it is also not always possible to provide
2. No differences to general approach general recommendations for SMEs.

The comparison of the approaches to CSV Limitation and outlook

and the tasks identified in this context have
shown that there are no major differences to
the general approach suggested by the Euro- This research has tried to close the research
pean Commission (2015). Although some gap initially mentioned by using a qualitative
procedures differ in the structure from the study. Based on a literature analysis, proce-
general approach, a detailed analysis has dures for CSV were identified and the neces-

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
11 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

sary tasks and activities were analysed. In References

summary, the literature collected on the sub-
ject area is very homogeneous. In particular, 1. AAMI (2016) ‘Medical errors involved
the identified literature sources reveal a clear in nearly 1 in 10 U.S. deaths, study says,’
shortcoming with regard to the delimitation Association for the Advancement of
to general validation approaches. Based on Medical Instrumentation, 10 May 2016.
the results and problem areas of CSV in SMEs [Online], [Retrieved February 15, 2018],
achieved and discussed in this research, the http://www.aami.org/newsviews/new
need for an SME-specific approach to CSV is sdetail.aspx?ItemNumber=3612.
demonstrated. Furthermore, it should be 2. Alemzadeh, H., Ravishankar, K. I., Kal-
noted that the aspects examined in this re- barczyk, Z. and Raman, J. (2013) ‘Analy-
search on the investigation of approaches to sis of Safety-Critical Computer Failures
CSV in SMEs has not yet been addressed in in Medical Devices,’ IEEE Security and
other research papers. Privacy Magazine, 11(4), 14-26.
3. Bendale, A., Patel, N., Damahe, D. P.,
This research has several minor limitations. Narkhede, S. B., Jadhav, A. G. and Vid-
As the research focus was European SMEs in yasagar, G. (2011) ‘Computer software
the medical technology industry, literature validation in pharmaceuticals,’ Asian
was used to analyse and evaluate CSV ap- Journal of Pharmaceutical Sciences and
proaches that could refer to or be transferred Clinical Research, 1(2), 27-39.
to this industry (see Figure 1). By consider- 4. Bhusnure, O. G., Kendre, S. P., Kaudewar,
ing all approaches to the CSV collected during D. R., Bankar, I. N., Gholve, S. B. and Gi-
the literature review, recommendations for ram, P. S. (2015) ‘Computer validation
action could possibly be identified. However, and ethical security measures for
it must be checked here whether these rec- pharmaceutical data processing,’ World
ommendations for action can be transferred Journal of Pharmaceutical Research,
to the medical device industry. Furthermore, 5(1), 1092-1134.
the results obtained from this research 5. Buschfeld, D., Dilger, B., Hess, L., Schmid,
would gain further in quality through a wider K. and Voss, E. (2011) ‘Identification of
literature analysis with regard to the expan- future skills needs in micro and craft (-
sion of the search area. type) enterprises up to 2020,’ Final re-
port, January 2011, Cologne, Hamburg,
Finally, and to answer the third research Vienna.
question, this work provides several connect- 6. Charan, H. Y. and Vishal Gupta, N.
ing factors for further research work. The (2016) ‘Gamp 5: A quality risk man-
elaboration of SME-specific recommenda- agement approach to computer system
tions for CSV could be an approach to further validation,’ International Journal of
research. Furthermore, this work could serve Pharmaceutical Sciences Review and Re-
as the basis for the development of an SME- search, 36(1), 195-198.
specific validation approach, which may be 7. Devos, J., van Landeghem, H. and
preferred to the European Commission's Deschoolmeester, D. (2014) ‘Informa-
proposal. Further research will also result tion Systems for Small and Medium-
from the introduction of the new Medical Sized Enterprises. State of Art of IS Re-
Device Regulation, which replaces the exist- search in SMEs,’ Heidelberg et al.:
ing directives 90/385/EEC and 93/42/EEC Springer.
directive in Europe (European Union, 2017). 8. Eckl, V., Trettin, L., Engel, D., Rothgang,
As changes to the regulations may have an M. and Espig, T. (2010) ‘E-Business in
impact on the processes of CSV, a re- micro and small Enterprises: A chance
verification of the validation approaches and for growth or a sheet anchor for sur-
thus further research becomes necessary. vival?,’ Baltic Management Review, 5(1),
27-46.

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
Journal of Innovation Management in Small and Medium Enterprise 12

____________________________________________________________________________________

9. Esch, P. M., Donze, G., Eschbach, B., Has- [Retrieved February 15, 2018]
sler, S., Hutter, L., Saxer, H. P., Timm, U. http://www.gxp-cc.com/news/fda-
and Zühlke, R. (2007) ‘Good Laboratory european-regulations-for-life-
Practice (GLP) – Guidelines for the vali- sciences/2014/03/10/the-european-
dation of computerised systems,’ The medical-device-directive-as-it-
Quality Assurance Journal, 11(3-4), 208- compares-to-21-cfr-820/.
220. 18. Fu, K. (2011) ‘Trustworthy medical
10. European Commission (2003) ‘Commis- device software,’ Public Health Effec-
sion recommendation of 6 May 2003 tiveness of the FDA 510(k) Clearance
concerning the definition of micro, Process: Measuring Postmarket Per-
small and medium-sized enterprises,’ formance and Other Select Topics: Work-
2003/361/EC, Brussels. shop Report, Washington, D.C., July
11. European Commission (2015) ‘EU 2011. IOM (Institute of Medicine), Na-
Guidelines for Good Manufacturing tional Academies Press, 97-118.
Practice for Medical Products for Hu- 19. Hrgarek, N. (2008) ‘A management
man and Veterinary Use, Annex 15: approach to software validation re-
Qualification and Validation,’ Brussels, quirements,’ Central European Confer-
30 March 2015. ence on Information & Intelligent Sys-
12. European Union (2017) ‘Regulation tems (CECIIS) 2008. Varaždin, Croatia,
(EU) 2017/745 of the European Parlia- September 24-26, 219-226.
ment and of the Council on medical de- 20. Huber, L. (2005) ‘Qualification and vali-
vices, amending Directive 2001/83/EC, dation of software and computer sys-
Regulation (EC) No 178/2002 and tems in laboratories. Part 3. Installation
Regulation (EC) No 1223/2009 and re- and operational qualification,’ In: De
pealing Council Directives 90/385/EEC Bièvre, P. and Günzler, H. (eds.) ‘Valida-
and 93/42/EEC,’ Brussels, 5 April 2017. tion in Chemical Measurement,’ Berlin,
13. Faris, T. H. (2006) ‘Safe and Sound Heidelberg: Springer, 140-144.
Software. Creating and Efficient and Ef- 21. ISO (2015) ‘Quality management sys-
fective Quality System for Software tems – Fundamentals and vocabulary,’
Medical Device Organizations,’ Milwau- International Organization for Stan-
kee: ASQ Quality Press. dardization, ISO 9000:2015(en), 2015.
14. FDA (2002) ‘General Principles of Soft- [Online], [Retrieved February 15, 2018]
ware Validation. Final Guidance for In- https://www.iso.org/obp/ui/#iso:std:4
dustry and FDA Staff,’ January 11, 2002. 5481:en.
[Online], [Retrieved February 15, 2018] 22. ISO (2016) ‘Medical devices – Quality
http://www.fda.gov/downloads/ Medi- management systems – Requirements
calDe- for regulatory purposes,’ International
vices/DeviceRegulationandGuidance/G Organization for Standardization, ISO
uidanceDocuments/ucm085371.pdf. 13485:2016(en), 2016. [Online], [Re-
15. FDA (2018) ‘Medical Device Recalls. trieved February 15, 2018]
FDA database of medical device recalls’ https://www.iso.org/obp/ui/#iso:std:i
[Online], [Retrieved February 15, 2018] so:13485:ed-3:v1:en.
http://www.accessdata.fda.gov/scripts 23. Klein, T. (2016) ‘The medtech revolu-
/cdrh/cfdocs/cfRES/res.cfm. tion: The European medical technology
16. Foe Owono, G. (2015) ‘Impact of EU industry,’ In: Martorell, J. M., Barberà, A.,
medical device directive on medical de- Farré, A., Bertalan, M., Norah, G., Biosca,
vice software,’ Dissertation, Minneapo- I., Estrada, G., Klein, T. and Shahin, T.
lis: Walden University. (eds.) ‘Catalonia life sciences and
17. Francum, J. (2014) ‘The European healthcare outlook,’ April 2016, 80-91.
Medical Device Directive as it compares 24. Maisel, W. H., Sweeney, M. O., Steven-
to 21 CFR 820,’ 10 May 2014. [Online], son, W. G., Ellison, K. E. and Epstein, L.

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
13 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

M. (2001) ‘Recalls and safety alerts in- Aichele, C. and Schönberger, M. (eds.)
volving pacemakers and implantable ‘App4U. Mehrwerte durch Apps im B2B
cardioverter-defibrillator generators,’ und B2C,‘ Wiesbaden: Springer, 87-132.
The Journal of the American Medical As- 33. Schö nberger, M. and Cƽ irjevskis, A.
sociation, 286(7), 793-799. (2017) ‘Successful IT/IS projects in
25. McDowall, R. D. (2016) ‘Welcome to the healthcare: Evaluation of critical suc-
Brave New World of CSV?,’ Advances in cess factors,’ Journal of e-health Man-
Pharmaceutical Analysis, LCGC Europe, agement. Vol. 2017.
29(2), 93-96. 34. Schönberger, M. and Kleinert, T. (2016)
26. MedTech (2015) ‘The European Medical ‘Results of a qualitative survey about
Technology Industry In Figures’ the application of business information
[Online], [Retrieved February 15, 2018] systems in German craft enterprises –
http://www.medtecheurope.org/sites/ first findings of an ongoing research
default/files/resource_items/files/ project,’ Proceedings of the European
MEDTECH_FactFigures_ONLINE3.pdf. Conference on Information Systems
27. Mikelsone, E. and Liela, E. (2015) ‘Lit- (ECIS) 2016, June 12-15, Istanbul, Tur-
erature review of idea management: key.
Focuses and gabs,’ Journal of Business 35. Schönberger, M., Kleinert, T., Dumont,
Management, 2015, No. 9, 107-121. T., Fettke, P. and Loos, P. (2014)
28. Muller, P., Devnani, S., Julius, J., ‘Softwareauswahl in kleinen und
Gagliardi, D. and Marzocchi, C. (2016) mittelständischen Unternehmen.
‘Annual Report on European SMEs Gegenüberstellung und Bewertung von
2015/2016. SME recovery continues. Vorgehensmodellen zur Auswahl
Final report,’ November 2016. [Online], betrieblicher Anwendungssoftware,’
[Retrieved February 15, 2018] Proceedings of the Multikonferenz
http://ec.europa.eu/DocsRoom/docum Wirtschaftsinformatik (MKWI) 2014,
ents/20264/attachments/1/ transla- 26-28 February, Paderborn, Germany,
tions/en/renditions/native. 1979-1991.
29. Nguyen, T. H. (2009) ‘Information tech- 36. Schubert, P., Fisher, J. and Leimstoll, U.
nology adoption in SMEs: an integrated (2007) ‘ICT and innovation in small
framework,’ International Journal of En- companies,‘ Proceedings of the Euro-
trepreneurial Behavior & Research, pean Conference on Information Sys-
15(2), 162-186. tems (ECIS) 2007, St. Gallen, Switzer-
30. Razak, I. H. A., Kamaruddin, S., Azid, I. A. land, June 7-9, 1226-1239.
and Almanar, I. P. (2009) ‘ISO 37. Sommerville, I. (2011) ‘Software Engi-
13485:2003: Implementation reference neering,’ 9th edition, Boston: Pearson
model from the Malaysian SMEs medi- Education.
cal device industry,’ The TQM Journal, 38. Thirumalai, S. and Sinha, K. K. (2011)
21(1), 6-19. ‘Product recalls in the medical device
31. SBA (2017) ‘Table of Small Business industry: an empirical exploration of
Size Standards. U.S. Small Business Ad- the sources and financial consequences,’
ministration,’ updated 01 October 2017. Management Science, 57(2), 376-392.
[Online], [Retrieved February 15, 2018] 39. Tracy, D. S. and Nash, R. A. (2002) ‘A
https://www.sba.gov/ contract- Validation Approach for Laboratory In-
ing/getting-started-contractor/make- formation Management Systems,’ Jour-
sure-you-meet-sba-size- nal of Validation Technology, 9(1), 6-14.
standards/table-small-business-size- 40. Vogel, D. A. (2011) ‘Medical Device
standards. Software. Verification, Validation, and
32. Schönberger, M. (2014) ‘Der Compliance,’ Boston, London: Artech
professionelle Einstieg in die House.
erfolgreiche App-Entwicklung,‘ In:

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
Journal of Innovation Management in Small and Medium Enterprise 14

____________________________________________________________________________________

41. Von Culin, R. (2011) ‘New Approach to ‘Computer system validation: a review,’
System Validation,’ Applied Clinical Tri- World Journal of Pharmaceutical Re-
als, 20(2), 32-37. search, 4(9), 444-454.
42. Yogesh, P., Kamlesh, M., Mohini, B.,
Phad, R., Ismail, S. and Shivam, L. (2015)

Appendix

Software Design 154

Software In The Use Environment 12

Software Design Change 11

Software Design (Manufacturing Process) 8

Software Manufacturing/Software Deployment 7

Software Change Control 3

0 25 50 75 100 125 150 175

Appendix 1: Total medical device recalls resulting from software errors in 2017. Own elabo-
ration using the FDA Medical Device Recall Database. Recall date from 01/01/2017 to
31/12/2017 (FDA, 2018).

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744
 15 Journal of Innovation Management in Small and Medium Enterprise

____________________________________________________________________________________

Google Scholar 598

Elsevier 192

Scopus 166

Ebsco Academic Search 105

Sciencedirect 90

Springer Link 54

Sage Journals 26

0 100 200 300 400 500 600 700

Appendix 2: Total number of literature sources that have been identified in various litera-
ture databases with regard to the term "computer system validation". Own elaboration us-
ing the databases Google Scholar, Elsevier, Scopus, Ebsco Academic Search, Sciencedirect,
Springer Link and Sage Journals. Databases accessed 11 February 2018

______________

Marius Schönberger and Tatjana Vasiljeva (2018), Journal of Innovation Management in Small and Medium
Enterprise, DOI: 10.5171/2018.512744

View publication stats