Many companies looking for compliance solutions for life sciences systems are leaning heavily toward Computer Software Assurance (CSA). However, there are several things to keep in mind before implementing them into your systems. 

When getting started with CSA, companies should first determine the intended use of the software. This term is discussed in the Code of Federal Regulations, Part 820, which addresses quality system regulation. 21 CFR 820.70(i) for automated processes states that:

“When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.”

As per the FDA guidance, validation is required for any software “that is used as part of production or the quality system.” It may seem obvious that any software that directly manages or controls the manufacturing process would be considered part of the production system. However, software that might not be a direct part of the process but supports production or the quality system (QS), could also require validation based on the guidance. Let’s take a closer look at direct and support systems. 

Related Article: Difference Between FDA CSA and CSV

Computer Software Assurance Direct Use in Production and Quality System

Systems that qualify as direct usage are those that would have a direct impact on product quality, patient safety, and integrity of the quality system. These types of systems carry a higher risk to patient safety and product quality as they are used for manufacturing, inspection, testing, the collection and processing of production and quality system data, and the ability to maintain a quality record. 

Examples include:

  • Manufacturing Execution System (MES) that control the production workflow
  • Machine Vision Systems that inspect for completeness of packaging, defects, flaws, or other irregularities
  • Data Collection and Analysis Systems that gather data from the manufacturing process and provide reports and tools for analysis. These systems are part of the quality system and have a direct relationship with product quality and patient safety.
  • Quality Management Systems handle aspects of the quality system such as controlled documents, supplier management, and quality events like CAPAs, investigations, and deviations.

Computer Software Assurance Supports Production and Quality Systems

Support systems automate testing activities for production software or monitor software systems. These types of systems might automate regression testing of the production system to ensure continuous functionality or to provide alerts if the software is not working properly. While these systems do have an impact on production and quality systems, the FDA recognizes that they present a much lower risk to patient safety and product quality.

In cases where the intended use of the software is general business purposes such as accounting, networking, or word-processing applications, these systems would be considered to have no impact on the production or quality system and, therefore, no validation is required under 21 CFR 820.70(i).

Analyzing Compliance Solutions for Life Sciences Systems

One last key point to note is that when analyzing a system for its role in production or the quality system, the system can be broken down into features, functions, and operations. FDA recognizes that software can be quite complex and that not all software functions relate to production or quality. Enterprise Resource Planning (ERP) software, for example, might have some operations that interact with the manufacturing software (order creation and closure), but the majority of the software only handles financial data. These features can be identified and classified as discussed above to lead to the risk-based approach to CSA. 

Whatever the final determination is for the system’s intended use, it is recommended that companies document their decision-making process in their Standard Operating Procedures.

Considering changing your systems? Contact Dayspring Technology at consulting@dayspringtechnology.com or visit here to learn more.