SMB Validation

As an equipment supplier, what Quality Planning do we need?

Most Equipment Manufacturers are ill prepared to deal with the requirements of the Pharmaceutical, Medical Device and Biotech industry and risk not being seriously considered by the PMDB manufacturers when they seek production and packaging machinery. Many Equipment Manufacturers also lack a proper understanding of the regulations as they apply to their PMDB customers.

As stated previously, this document is intended to provide the equipment manufacturer with guidelines in developing appropriate Quality Plans and in acquiring basic regulatory knowledge to satisfy the requirements of the PMDB Manufacturers.

A Quality Plan is essentially a document plan that delineates in detail the methods, tools and resources that will be employed by a given equipment manufacturer in order to ensure that the products supplied will meet the PMDB manufacturers’ regulatory requirements. This plan requires the input of the customer and is a dynamic document in as much that it is always being added to and amended during the project life.

The list of documentation below is suggested for consideration in developing a Quality Plan. It is not intended to be fully exhaustive nor should it be taken as a minimum requirement. It is not listed in any specific order and should be adapted to what fits the individual Equipment Manufacturer the best.

Equipment manufacturers should only commit themselves to the items they feel comfortable in developing and supporting for the long term. Any other item may become a burden that causes the Quality Plan not to be maintained.

Quality Plan Statement:
Every pharmaceutical manufacturer is legally bound by their regulatory bodies to provide evidence that any system/equipment that they use complies to current Good Manufacturing Practices (cGMP’s). The Equipment Manufacturer, is not directly bound by these requirements, but, because the cGMP’s require that computer systems be documented from inception to decommissioning (life cycle methodology, Manufacturers must be involved so as the customer is able to meet their obligations. Therefore, the Equipment manufacturer’s potential customers are making Computer System Validation (CSV) a requirement of the equipment that they purchase. This in turn, effectively makes the Manufacturer subject to the FDA’s regulations, if not legally, then commercially.

System Life Cycle Methodology is basically the process of documenting and testing all the various aspects of a computer based control system/process, from its inception through its design, build and installation, and all the way to its eventual decommissioning.

Every equipment suppliers customer is fully aware that as the equipment they use becomes more and more sophisticated and the computer based element of the system becomes more complex, they will be less likely to be able to validate them without a significant amount of support from the developer of the system.

System Life Cycle Methodology is a major focus of the FDA’s activities and so the pharmaceutical manufacturers include this as a requirement or expectation of equipment suppliers. Most have, or are in the process of setting up their own internal procedures for auditing their suppliers.

The Equipment Manufacturer should provide a statement demonstrating its commitment to quality and to assist in meeting the regulatory requirements of the PMDB Manufacturers. An example of such a statement is (Substitute your Company name for Equipment Manufacturer):

“Equipment Manufacturer Xxx is dedicated to the design and manufacturing of equipment of the highest standard. Xxx’s goal through the development and implementation of this Quality Plan is to satisfy customers’ requirements in terms of compliance with FDA regulations in general, more specifically to assist the PMDB Manufacturers in meeting the FDA’s Current Good Manufacturing Practices (cGMP).

Equipment Manufacturer Xxx is committed to actively promoting all activities with respect to Quality and cGMP Compliance. It will ensure that all adequate resources (material, equipment, personnel, etc.) are made available in sufficient quantity and in a timely fashion to perform all the necessary tasks relating to this Quality Plan and to support cGMP Compliance for its customers. The Equipment Manufacturer is also devoted to helping and encouraging all personnel connected with its activities project in understanding the quality concepts as well as maintaining compliance in the future.

This document may not be final and may evolve with the life of the various projects undertaken. Specific requirements may change for individual projects as the design is finalized. Reasons for changes and new issues of this Quality Plan will be documented in the Publication Record/Revision History section of this document.”

From a Computer Software Validation point of view, all of the deliverable information required by the customer is worth less than the paper it’s written on if there are no adequate systems behind them. The systems/procedures are intended to provide evidence that control systems produced by Equipment Manufacturer Xxx are developed in a controlled manner; this means documenting Xxx’s methods in a formal and consistent manner. So consideration should be given to develop written procedures for the following:

Machine Mechanical Assembly Control Policy/Procedure:
The purpose of this document is to define the company’s understanding of the machine mechanical assembly quality control and its approach to implementing these procedures. The exclusive use of metric fasteners is an example of a procedure that can be put in place under this heading.

Electrical Department Control Policy/Procedures:
The purpose of this document is to define the company’s understanding of Electrical assembly quality and testing and its approach to implementing these procedures.

For instance, the use of identifiers at each end of wires, and color coding of wiring for specific uses, are two examples of procedures that can be put in place under this heading.

PLC Program Development and Control Policy/Procedures:
The purpose of this document is to define the company’s understanding of Software Quality, control and Storage requirements and its approach towards implementing these procedures. This policy has a bias toward the company’s activities related to programmable logic controllers (PLCs). Additionally this document will define the methods employed to record and control the software included in the company’s products.

Xxx’s programming standards are as described in the equipment suppliers PLC programming Guide. The purpose of these guidelines is to establish preferred methods for programming PLCs used in Xxx’s packaging machines. Peer Review is an example of a procedure that would fall under this heading.

The Program Development and Control Policy/Procedures provides an overview of “Software Quality, Control and Storage” for PLC equipment and addresses issues or sub-sections such as:

Documented Software and Control system Hardware testing/ Results:
This is a document or series of documents that is used to test and record the results of the testing of each version of software and hardware or combination. It may include bench top testing, where the system is tested prior to installation usually using a test jig. It normally includes installation tests and results for each system produced. It can be either a standalone document or be included in the electrical engineering department policy and procedures).

Documentation Storage provisions:
This is a formally presented document that describes the storage of all documentation relating to a specific project. It must include a stated retention period (10 years is the normal standard).

Software Storage provisions/Software security/access:
Another formally presented document that describes the storage of all software relating to a specific project. This may be a standalone document or included as a separate section of the Documentation Storage procedure. It must also include a stated retention period) (10 years is the normal standard).

Software Change Control procedures:
This is a formally presented document that describes the Change Control methods employed, it should define in easy to understand terms, the methods for managing the alteration or modification of software. A change control procedure provides an audit trail. The procedure should cater both for planned changes and for unplanned (emergency) changes that may have taken place due to malfunction or failure of components.

All changes must be reviewed, approved, tested and documented. Changes to a system can happen at almost any time during the systems life. If a fault report or a request for modification is received concerning the operation of its software it should be recorded in a Software Fault Report Register and the electrical department supervisor should investigate and take appropriate actions.

As a new issue of software arises, through development, whether it be for correction made or added features. Each change should be classified as a release.

Included with the Software Change Control Procedure, or presented as a separate document should be a Configuration Control Procedure. Configuration control is a formal document that outlines and records any changes of hardware, software or documentation that describes an end use function. It is used to trace the relationship between a particular version of a control system and the configuration (options, special design requests etc.…). Additionally it is used to maintain this correlation as the system evolves.

The difference between Change Control and Configuration Control is basically:
Change Control answers the question: “What are the differences between one release of software to another?”

Configuration Control answers the question: “What configuration of options and special design requests has been fitted to a particular system at a specific time”?

Software/Hardware Performance/Design Review procedures:
Used in conjunction with the Software Fault Register, all modifications and enhancements to the system should be reviewed and tested with the view to assessing the impact to the software as a whole prior to any change. This should be presented as a formally recorded procedure that outlines the reason for the modifications. Additionally, this document may provide a listing of version compatibility.

Virus Control Policy/Procedures:
Viral infection may cause the loss of productivity at the Equipment Manufacturer , but another concern is the possibility of transmitting viruses to customers and damaging their information systems. This document is designed to provide an overview of how the Equipment Manufacturer will protect itself and its customers from viral infection caused by The Equipment Manufacturer’s internal system or an outside source. Again, this is a formally presented document that describes the methods employed by the Equipment Manufacturer to detect and eliminate any virus that may present a risk to the software content of any control system produced. It should document the procedure for checking for infection, define, the tools used to check and record any instance of infection along with the actions taken to eliminate the problem and prevent reoccurrence.

This document provides some general virus information and identifies the areas of concern to the Equipment Manufacturer regarding virus contamination.

These are:

Equipment Manufacturer Xxx, as a leading manufacturer of pharmaceutical equipment, has committed itself to providing support to its customers. The aim is to provide the highest levels of service support and therefore assisting them in validating the parts of their processes incorporating its machinery. This support takes the form of discussing their requirements subsequent to order and supporting them throughout the product’s lifetime.

Some machine manuals and support documentation are included as a standard part of the equipment purchase since these form part of its design, quality and manufacturing philosophy. Additional support for customer’s individual validation requirements is available as a service which will be chargeable.

The content of support service, both chargeable and non-chargeable, is constantly developing over time in line with the increase in sophistication of new designs and regulatory requirements. The Equipment Manufacturer Xxx use the U.S. Food and Drug Administration guidelines and requirements as a basis for our ongoing development policies.

Disclaimer - Consideration should also be given to a disclaimer to cover equipment already in the field. This disclaimer could take the form of:

“New and future product designs are all being developed using these guidelines as a basis of our activities; however due to the long history of some of our products, “across the board” retrospective documentation of existing systems is neither practical nor economical. Particular customer requirements for retrospective validation will be considered and addressed accordingly, but in a much more constrained manner than for new systems.”

Special Design Request Control Policy/Procedures:
The purpose of this document is to define the company’s understanding of special design quality control, whether mechanical or electrical, and its approach towards implementing its procedures. Additionally this document will define the methods employed to record and control the special design quality standards required in the company’s products. Special Design Requests cover any specific request by a customer that will require Equipment Manufacturer Xxx to review its standard machine design and to create a “one-of” type of machine.

Purchasing Policy/Procedures:
The purpose of this document is to define the daily operations of the Xxx Packaging Solutions Purchasing system. This document will define the total procurement process and will cover the following topics:

  1. Raw Material Purchases
  2. Special Purchases
  3. Expedition of Goods
  4. Shop/office Purchases

Training and Development Policy:
The purpose of this document is to define the Equipment Manufacturer’s policy as regards employee training and development. According to Section 211.25 (Personnel Qualifications) of the Current Good Manufacturing Practices (cGMP’s), appropriate training must be provided to personnel involved with computer systems used in a pharmaceutical manufacturing environment. A formal record of the qualifications of the system developers must be maintained, this information should include education, training (both internal and external) and experience. Note: there are no “required” standards for training, experience or educational achievement.

Project Coordination and Project Documentation Policy/Procedures:
Full specification of both equipment and accompanying documentation will be undertaken with the customer subsequent to the acceptance of an order where the customer has requested validation assistance. This will be used as the guide to deliverables throughout the production, delivery and commissioning and Qualification of the system. The scope of the documentation will be sufficient to allow operation, testing and maintenance of a system by suitably qualified engineers without the original design team. The “change” management and issue control of documentation will be carried out as laid down in the company quality procedures.

Internal Audit procedure:
This is internal review of the methods mentioned above, it should be performed on a periodic basis, to, in effect, self police the Equipment Manufacturer’s methods. This procedure should be documented so as to be able to track repeat problems, provide documentary evidence for the customer to prove that, this is, in fact being performed.

The audit reports and summaries must be periodically reviewed by the Equipment Manufacturer’s Senior Management. If corrective actions have not been completed satisfactorily, then management shall resolve the problem.

This procedure should also be undertaken for bought out items and the Equipment Manufacturer should ensure that suppliers follow approved procedures and supply appropriate documentation). (This would not normally be required for fully developed hardware such PLC’s, but cards that are designed and built especially for the Equipment Manufacturer would be subject to this procedure.