COMPUTERISED SYSTEMS
ANNEX IVSupplementary provisions
ANNEX IV COMPUTERISED SYSTEMS I. SCOPE The requirements set out in this Annex shall apply to computerised systems that are used in connection with the manufacture of veterinary medicinal products, in so far as such use falls under the scope of good manufacturing practices. The use of computer systems in manufacturing sites for purposes not connected with the pharmaceutical quality system (e.g. staff matters, commercial issues, etc.) are not concerned by the requirements in this Annex. II. GENERAL REQUIREMENTS II.1. IT infrastructure ( 1 ) used in the manufacture of veterinary medicinal products shall be qualified. Any related software application shall also be validated. The extent of the validation shall be based on risk management principles having regard to the need to ensure product quality and data integrity. II.2. The outsourcing of tasks/operations related to the installation, configuration, validation, maintenance, modification of a computerised system or any other related service or for data processing shall be made by means of a written contract that shall provide for a clear delineation of the responsibilities of each party. II.3. The suitability of the contractor (including by means of audits where appropriate) shall be assessed applying risk management principles. II.4. Documentation supplied with commercial off-the-shelf products shall be reviewed by the manufacturer to check that user requirements are fulfilled. II.5. Suppliers of software specifically developed/adapted for use within the manufacturing process shall be qualified. Where necessary and upon the request of inspectors, the manufacturer of veterinary medicinal products shall be able to produce information from the quality system of the suppliers or developers of such specific software. The contractual agreements between the software suppliers and the manufacturer of veterinary medicinal products shall contain adequate provisions to this effect. III. DEVELOPMENT PHASE III.1. The manufacturer shall take all reasonable steps to ensure that the system is suitable to ensure the quality of the product, the consistency of the manufacturing process and compliance with the goals of the pharmaceutical quality system. III.2. User requirements specifications shall describe the required functions of the computerised system and shall be based on risk assessment principles. User requirement specifications shall be traceable throughout the life-cycle of the computerised system. III.3. The standards, protocols, acceptance criteria, procedures and records shall be justified on the basis of a risk assessment. III.4. The validation documentation and reports shall cover the relevant steps of the entire life cycle. The validation documentation shall include change control records (if applicable) and reports on any deviations observed during the validation process. III.5. A process shall be in place for the validation of bespoke or customised computerised systems which ensures the formal assessment and reporting of the quality and performance parameters for all the life-cycle stages of the system. III.6. The suitability of the testing procedures and test scenarios shall be demonstrated. System (process) parameter limits, data limits and error handling shall be duly considered. When automated testing tools are used, an assessment of their adequacy, including of the environment where the test is conducted, shall be required. III.7. When data are transferred to another data format or system, it shall be verified that the migration process has not altered the data (in value or meaning). IV. OPERATIONAL PHASE IV.1. An up-to-date listing of all the relevant systems and their functionality (inventory) shall be kept. In the case of critical systems, the system description shall detail the physical and logical arrangements, data flows and interfaces with other systems or processes, any hardware and software pre-requisites and security measures. IV.2. Computerised systems exchanging data electronically with other systems shall include appropriate built-in checks for the correct and secure entry and processing of data. IV.3. For critical data entered manually, an additional check on the accuracy of the data shall be performed. This check may be done by a second operator or by validated electronic means. The criticality and the potential consequences of erroneous or incorrectly entered data shall be addressed under risk management principles. IV.4. Data shall be secured by both physical and electronic means against damage. The readability and accuracy of stored data shall be ensured, as well as the accessibility thereof throughout the retention period. IV.5. Regular back-ups of all relevant data shall be done. Integrity and accuracy of backup data and the ability to restore the data shall be checked during validation and be periodically monitored. IV.6. It shall be ensured that electronically stored data can be printed. For records supporting the batch release it shall be possible to generate printouts indicating if any of the data has been changed since the original entry. IV.7. Based on a risk assessment, it may be appropriate to build into the system the creation of a record of all changes that are relevant to demonstrate compliance with good manufacturing practice and deletions (a system generated "audit trail"). In case of change or deletion of relevant data, the reason shall be documented. Audit trails shall be available and convertible to a generally intelligible form and regularly reviewed. IV.8. Changes to a computerised system, including system configurations, shall only be made in a controlled manner in accordance with a defined procedure. IV.9. Computerised systems shall be periodically evaluated to confirm that they remain in a valid state and in compliance with the requirements set out in this Annex. Such evaluations shall include, where appropriate, the current range of functionality, deviation records, incidents, problems, upgrade history, performance, reliability, security and validation status reports. IV.10. Physical or logical controls shall be in place to restrict the access to computerised systems and the data storage area to authorised persons only. Suitable methods of preventing unauthorised entry to the system, commensurate to the criticality of the computerised system, shall be implemented. IV.11. The generation, change or cancellation of access authorisations shall be recorded. IV.12. The identity of operators creating, changing, confirming or deleting data shall be recorded, including the date and time where the operations occur. IV.13. All incidents, not only system failures and data errors, shall be reported and assessed. The root cause of a critical incident shall be identified and shall form the basis for the implementation of corrective and preventive actions as appropriate. IV.14. Electronic records may be signed electronically. Electronic signatures shall be permanently linked to their respective record and shall include the time and date when they were generated. IV.15. When a computerised system is used for recording certification, the system shall be designed/controlled to ensure that only the Qualified Person can certify the batches. IV.16. The continuity of operations performed by computerised systems supporting critical processes, shall be ensured in the event of a system breakdown (e.g. by means of a manual or another alternative system). The time required to bring the alternative arrangements into use shall be commensurate to the risks. The implemented arrangements shall be documented and tested. IV.17. Data may be archived. This data shall be checked for accessibility, readability and integrity. If relevant changes are to be made to the system (e.g. computer equipment or programs), then the ability to retrieve the data shall be ensured and tested. ( 1 ) For the purposes of this Annex, ‘IT infrastructure’ means the hardware and software that is necessary for the system to function (e.g. networking software and operation systems).