Reference Section
The Future of Computer Systems Validation in the Pharmaceutical
Guy Wingate is a Quality Director
with GlaxoSmithKline. He is a
recognised international expert on
the topic of computer validation
and electronic records and
signatures. He currently chairs
ISPE/GAMP that brings together
computer validation experts from
around the world and is responsible
for the GAMP Guides cited in
regulatory guidance issued by FDA
and PIC/S. Dr Wingate has written
a number of books on computer
validation, regularly speaks and
chairs conferences, and is a visiting
lecturer for MSc courses accredited
by Dublin Institute of Technology
and Manchester University.
1 DRUG MANUFACTURING & SUPPLY 2006
Industr y: Red Herrings , Old Chestnuts and Silver Bullets
Computer technology plays an ever-increasing role in
the pharmaceutical industry. It is used throughout the
whole supply chain with varying degrees of potential
impact on patient safety. Computer validation is
typically treated as a technical speciality of little interest
to those not directly involved. Indeed I have written
many detailed papers and technical books on
computer validation myself as a so-called ‘validation
expert’. Now however, I believe the time is now right
to instead examine the future direction of computer
validation from an advanced industry perspective.
The theory behind the US Food and Drug
Administration (FDA) paper outlining the future of
21st century Good Manufacturing Practice (GMP)
for the pharmaceutical industry is becoming reality.1
The issue of complementary standards such as ICH
Q82, ICH Q93, ICH Q104 and ASTM E555 has
aided this process, supported by the industry and the
EU, Japanese and US regulatory authorities. All
aspects of quality assurance (QA) are impacted,
including computer validation. There has been much
written advocating great change. Equally many
people share unease about some of the ideas being
proposed. With questions about practical
implementation being hotly debated I believe it is
timely to reflect on why and how we use computer
validation and to take a look at the real issues being
faced. This is dangerous territory and my opinions
may upset both traditionalists and modernists alike.
There is a need to generate wider awareness and
understanding of some of the main issues before us
and to reach a consensus on the future of computer
validation. I will start by reviewing three common
criticisms of current validation practice and then
outline some thoughts on the way forward.
Firstly, the concept of computer validation is outdated
and no longer relevant. It is important to realise that
computer validation was introduced for a reason, to
address operational failures of computer systems that
impacted patient safety.6 Validation is based on taking
a structured life-cycle approach to managing the
whole process. This takes in the initial planning and
specification of the project through development,
testing and release to final operation and maintenance
a report by
Guy Wingate
Quality Director, GlaxoSmithKline
of the computer system. The principle is to build in
quality rather than rely solely on testing. A high degree
of assurance is sought rather than absolute proof of
operability. It is hard to argue that this approach is
flawed, but regulatory guidance has struggled to keep
up with technological changes and consequently it is
all too easy to declare validation standards out of date
even though the principles they preach are still valid.
The main US regulatory guidance document remains
the Blue Book, first published 20 years ago.7 European
regulatory guidance is more recent but continues to
focus on custom-built developments rather than
managing today’s highly integrated configurable
systems.8 Even the most recent Good Automated
Manufacturing Practice (GAMP4) guidelines do not
appear, at first sight, to sanction the use of modern,
rapid application development techniques.9
Secondly, computer validation is inherently
inefficient and ineffective. Two commonly quoted
examples revolve around the role of the quality
assurance (QA) department and their demand for the
duplication of work by pharmaceutical companies
that has already been done by their suppliers.
Practitioners have had a rough ride for well over a
decade over the efficiency and effectiveness of
computer validation. Consequently, there has been
significant work in leaning validation and applying
Six-Sigma methodology. There is no reason why the
problem of excessive paperwork and duplication of
effort cannot be remedied. Pharmaceutical companies
do not need to retest system operability, which has
already been verified and suitably documented by
supplier testing. Indeed, many firms have now
successfully addressed these and other similar
assumptions. There are many examples of current
validation costs being only a fraction of what they
once were, when compared to overall project costs. It
was not that long ago, the end of the 1990s, when
best in class validation would mean 10% of project
cost.10 More recent experiences have claimed costs as
low as 2% for validation of complex systems that have
subsequently passed rigorous regulatory inspections.11
These improvements have been achieved by applying
the principles of lean manufacturing and Six-Sigma.12
Thirdly, computer validation techniques and
 Reference Section
terminology hinder the paradigm shift needed to
support the implementation of 21st century GMP. It is
suggested that many constraints are self-imposed by
over-zealous interpretation of regulatory expectations
(requirements or guidance). We should try and keep to
the spirit of what computer validation lifecycle is trying
to achieve. GAMP4 is compatible with modern, rapid
application development techniques and is founded on
a risk-based approach; however, this is not the
immediate impression given when reading the
guidance. Another contributory factor to whether
computer validation will support 21st century GMP
has been confusion over terminology. It is important to
remember that computer validation brings together a
fusion of disciplines from laboratory analysts, engineers,
IT professionals and QA personnel.
Whilst a common terminology has become established
over the years it is now being challenged by
technologists trying to implement Process Analytical
Technology (PAT).13 For example, the US based
standards authority ASTM who are developing a series
of PAT standards are promoting dropping the concept
of ‘validation’ for facilities, equipment and computer
systems in favour of focusing on ‘qualification’ and
‘good practice’.14 Great care is needed when placing
emphasis on these without defining exactly what level
of control is expected. PAT applications will require
high integrity if they are to be exploited and hence the
principles behind computer validation are more
necessary than ever. There will be confusion as existing
practitioners try to transfer between the established
language of validation and a new taxonomy, which
will still have some shared words, but with different
meanings. A significant and widespread re-education
programme will be needed if such new terminology is
to stick. Surely prudence would say it is better to
continue to improve the current understanding of
existing terminology used over the past 25 years to
meet the needs of 21st century GMP. Indeed new
terminology such as the finalised version of the PAT
standards might even be at odds with EU GMP Annex
11 on Validation.15 We need to be wary of voices that
offer an alternative silver bullet to validation without
fully examining the pros and cons that such a change
would invoke.
It might appear that everything in the field of
computer validation is fine and there is no need for
any change; however, this is not the case. Computer
validation does need to change but through significant
evolution not revolution. In particular it needs to take
risk management to its heart. The main focus should
be on critical computer systems that have an impact on
patient safety, i.e. those used for controlling:
• data supporting regulatory safety and efficacy
submissions;
2 DRUG MANUFACTURING & SUPPLY 2006
• quality-critical parameters in manufacturing;
• product release;
• recall; and
• adverse events or complaints.
The amount of validation through the computer
system life-cycle and amount of associated
documentary evidence should be commensurate
with risk. This concept is not new but we need to
exploit it. Regulatory authorities such as the FDA
and the UK Medicines and Healthcare products
Regulatory Agency (MHRA) have already
indicated they are comfortable with this approach.
It should also be possible to use supplier
assessments, not necessarily audits, to determine the
acceptability of supplier documentation without
the need to repeat supplier testing. Further, the role
of QA units within a pharmaceutical company can
be limited to establishing policies and procedures,
approving acceptance criteria, and approving
reports. This is only true so long as there is
sufficient confidence in the capability of whoever is
doing the remaining validation activities. The work
culture is extremely important and generally needs
more attention. As long as managers and
practitioners alike have the right quality mindset
when it comes to making decisions then patient
safety and regulatory compliance will not be
compromised. At the end of the day people make
the difference. Good people deliver not just short-
term results but results that hold up to scrutiny
long-term too.
In conclusion, whilst the concepts and principles
behind computer validation remain convincing and
relevant, it is clear that computer validation
practices need to be updated to reflect modern
computer technology and development techniques.
A risk-based approach must be evident to protect
patient safety but also allow for efficient and
effective ways of working to deliver systems that
deliver business benefits. Industry groups like
ISPE/GAMP, the Parenteral Drug Association
(PDA) and the Pharmaceutical Research and
Manufacturers of America (PhRMA) that draw
together recognised experts in this topic area have a
responsibility to lead this change.
As an industry we cannot afford to see a repeat of
the problems that electronic records and electronic
signatures caused at the end of the 1990s when
inappropriate practice diverted industry investment
from delivering real business improvement.16 ■
The views expressed in this article are personal reflections
and do not necessarily represent the views of Dr Wingate’s
employer nor any industry groups with which he is affiliated.
 The Future of Computer Systems Validation in the Pharmaceutical Industr y

References

1. FDA, Pharmaceutical cGMPs for the 21st Century – A Risk-Based Approach (2002).
2. ICH, Pharmaceutical Development, Approved ICH Consensus Guideline Q8, International Conference on Harmonisation
of Technical Requirements for Registration of Pharmaceuticals for Human Use (2005).
3. ICH, Quality Risk Management, Approved ICH Consensus Guideline Q9, International Conference on Harmonisation
of Technical Requirements for Registration of Pharmaceuticals for Human Use (2005).
4. ICH, Pharmaceutical Quality System, Draft ICH Consensus Guideline Q10, International Conference on Harmonisation
of Technical Requirements for Registration of Pharmaceuticals for Human Use (2006).
5. ASTM Technical Standards on Pharmaceutical Application of Process Analytical Technology, Technical Committee E55,
www.astm.org
6. HSE, Out of Control: Why Control Systems Go Wrong and How to Prevent Failures, U.K. Health & Safety Executive
(2003).
7. FDA, Guide to Inspection of Computerised Systems in Drug Processing, Technical Report, Reference Materials and
Training Aids for Investigators (1983).
8. Pharmaceutical Inspection Co-operation Scheme, Good Practices for Computerised Systems in Regulated GxP
Environments, Pharmaceutical Inspection Convention (2003);PI 011-1.
9. GAMP Forum, GAMP Guide for Validation of Automated Systems (known as GAMP4), published by International
Society for Pharmaceutical Engineering (2001).
10. Wyrick ML, “Assessing Progress Towards Harmonisation of Validation Governance in the Global Pharmaceutical
Industry”, Business Intelligence (2000).
11. GAMP Forum, Informal Survey of Validation Costs at Public Meeting (unpublished) (2005).
12. Wingate GAS, Computer Systems Validation: Quality Assurance, Risk Management and Regulatory Compliance for
Pharmaceutical and Healthcare Companies (2004), Interpharm/CRC.
13. FDA, Process Analytical Technologies Initiative (2002).
14. ASTM, Standard Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing
Systems and Equipment, Draft Standard E55.03.WK9864 (2006).
15. EU GMP Annex 11, Qualification and Validation, effective 2001.
16. ISPE, “Risk-Based Approach to 21 CFR, Part 11”, White Paper (December 2002), published by ISPE.

DRUG MANUFACTURING & SUPPLY 2006 3