Validation support is provided as part of the subscription to Qualio. Each customer receives all the documentation they need in order to quickly and painlessly approve Qualio in their organization. There are three parts to validating Qualio in a GxP regulated environment.
- Risk assessment
- Supplier evaluation
- Requirements testing to demonstrate fitness for intended use and to allow acceptance of the system against user requirements.
This approach is based on GAMP® 5 guidelines, according to which Qualio is a category 3 product. The Good Automated Manufacturing Practice (GAMP) guidelines are a set of guidelines for a risk based approach to software validation for manufacturers and users of automated systems in the pharmaceutical industry. They are written by technical subcommittee of the International Society for Pharmaceutical Engineering (ISPE). These guidelines are currently in their 5th revision, hence the term GAMP® 5.
For a detailed insight into risk-based approaches to compliant GxP computerized systems you can purchase a copy of the GAMP® 5 guidelines on the ISPE website. Some relevant excerpts from the GAMP® 5 that support our approach are shown below.
Excerpts from the GAMP5 guidelines
GAMP 5 - "GAMP 5 - A Risk-Based Approach to Compliant GxP Computerized Systems".
7.1.1 Non-Configured Product (GAMP Category 3)
If the product is purchased off-the-shelf and does not require configuration to support business processes, or where the default configuration is used by the regulated company, supplier involvement with the regulated company is, typically, limited to the provision of documentation, training, support, and maintenance.The product should be developed and maintained by the supplier in accordance with good practices (see Section 7.2 of the Guide).
Note - Qualio is developed in accordance with the supplier best practices outlined in section 7.2 of this guide.
3.3 Category 3 - Non-configured products
This category includes off-the-shelf products used for business purposes. It includes both systems that cannot be configured to conform to business processes and systems that are configurable but for which only the default configuration is used. In both cases, configuration to run in the user's environment is possible and likely (e.g., for printer setup). Judgement based on risk and complexity should determine whether systems used with default configuration only are treated as a Category 3 or Category 4.
Note - As Qualio is web based there is no configuration needed to run in the user's environment.
A simplified life cycle approach may be applied to Category 3 products, as shown Section 4.2.6 of the Main Body. Supplier assessment may not be necessary. The need for, and extent of, supplier assessment should be based on risk. User requirements are necessary and should focus on key aspects of use. Functional and design specifications are not expected from the user, although there should be sufficient specification to enable testing (typically covered by the User Requirements Specifications (URS) and other relevant documentation). Verification typically consists of a single test phase.
All changes to software should be controlled, including supplier-provided patches. Standard Operating Procedures (SOPs) should be established for system use and management, and training plans implemented.
Note - Qualio is web based and installed on our servers. Therefore testing for correct installation is our responsibility and is completed in line with our internal SOPs.. We employ a rigorous testing process to ensure integrity of the system. The support portal at docs.qualio.com is continuously updated as new features are added.
Configuration management should be applied. For systems where the default configuration is used, configuration management demonstrates that the defaults are accurately selected.
220.127.116.11 Example of a Non-Configured Product
Many computerized systems comprise commercially available software products running on standard hardware components.
Software products which are used off-the-shelf (i.e., which are either not configurable for a specific business process or where the default configuration is used) are typically classified as GAMP Category 3.
In such cases, and based on satisfactory supplier and risk assessments, a simple approach consisting of one level of specification and verification is typically applicable.
Testing typically covers:
- correct installation;
- tests that demonstrate fitness for intended use and allow acceptance of the system against requirements;
- any further tests as a result of risk and supplier assessments.
Regulated companies typically perform the required specification and verification. While the system is not configured for a business process, there may be some limited configuration such as of run-time parameters or printer setup.
Supplier activities typically include supply of the product, and provision of documentation, training, and support and maintenance.
Note - As Qualio is web based, testing for correct installation is our responsibility and is completed in line with our internal SOPs. Therefore it is not the responsibility of the customer.
For a typical Category 3 system, testing of both installation and configuration are covered by requirements testing.
For a typical Category 3 system, tests are executed to demonstrate fitness for intended use and to allow acceptance of the system against user requirements. There is typically no need for further testing to demonstrate correct operation of standard functionality of the product.
Appendix D2 - Functional Specifications
For some systems, such as commercially available and low risk Category 3 systems, a simple approach consisting of one level of specification and verification typically is appropriate and a separate FS is not required. See Section 4.2.6 of the Main Body for typical examples of the level of specification required for non-configured products, configured products, and custom applications.
9.2 Typical Testing Activities for a Non-Configured Product
These are software products which are used off-the-shelf (i.e., which are either not configurable for a specific business process or where the default configuration is used) and are typically classified as GAMP Category 3.
The regulated company may decide to assess the supplier to verify the quality of the product being used depending on risk. Based on satisfactory supplier and risk assessments, a simple approach consisting of one level of specification and verification is typically applicable.
Testing should focus on:
- installation testing as described above
- requirements testing that demonstrate fitness for intended use, this may include testing the system functionality against requirements depending on risk.
- requirements testing should also include delivery and acceptance of the final documentation set from the supplier, including specifications, manuals, and drawings, if not already covered.
- any further or more rigorous tests as a result of risk and supplier assessments
- any other relevant aspects listed in Section 9.1.2 of this appendix not already covered.
Note - As Qualio is web based, testing for correct installation is our responsibility and is completed in line with our internal SOPs. Therefore it is not the responsibility of the customer
Further details on the testing of Category 3 software is provided in the GAMP Good Practice Guide: Testing of GxP Systems, Section 2.5.3 (Reference 34, Appendix G3).
Getting help with the validation process
All customers can contact us for help with validating Qualio in a GxP environment. We can provide you with template content and guidance to ensure you can quickly and easily validate Qualio.