Qualio is a SaaS (Software as a Service) application, and is considered a category 4, configurable system according to GAMP 5, A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition. Qualio falls into GAMP Category 4 due to the levels of configuration built into the Events, Design Controls and Suppliers functionality. This means, validation of the system is a partnership between Qualio and the customer.
This article will cover:
Qualio Validation Approach and Rationale
Qualio is committed to ensuring compliance to the most current approach to software validation, broadly recognized in the Life Sciences industry. Recognizing that validation is more than just testing, we generate and execute the test elements that demonstrate the system is meeting the requirements set for it to function as an electronic quality systems management tool as a standard, integrated part of our product development process.
Our customers partner with us in compliance, as they are responsible for the system configuration, content access and management, and the elements of compliance on their side (such as E-sig policies, managing Qualio as a supplier, and ensuring their setup meets their business process needs.)
The latest revisions to the GAMP guidances support the leveraging of a vendor's software development life cycle (SDLC) approach to satisfy the requirements and needs of the validation process. The repeating by humans of testing performed by automated tools does not add value to the overall qualification of the system.
In general, Qualio owns the “system”; we perform documented testing through the feature release process. The customer owns their data and the configuration of their instance of the system and will need a process to evaluate the updates’ impact to their business processes and configuration. The need for significant "retesting" can and should be mitigated through critical thinking and appropriate risk management. Regulators are encouraging this approach to “non-critical” systems such as a QMS, where “non-critical” means no direct impact to patient safety or product quality.
Why Validation is Changing
A new chapter of computerized system assurance, driven by critical thinking and agile, risk-based digital quality, is opening to replace the bloated, burdensome and paper-heavy legacy of computerized system validation. What’s driving the shift?
In a nutshell, the FDA wants life science businesses to invest in computerized systems that digitize, automate and accelerate quality and manufacturing processes. These systems, after all, slice the risk of human error. They free up manual admin time for continuous improvement and quality assurance work. And they contribute to faster, safer delivery of life-saving products to patients.
Computerized system assurance focuses on:
Critical thinking and risk-based adoption of computerized tools
Jettisoning of unnecessary legacy validation documents, like IQs, OQs, and PQs
Eliminating the fear of regulatory inflexibility as a blocker to the adoption of new technology
A return to the original ‘spirit’ of GAMP:
Proving your computerized system is fit for intended use
Ensuring your computerized system meets the basic baseline of compliance
Managing any residual risk to patients and to the quality of the final medicinal product
To that end, Qualio Validation Support aligns with these modern best practices to guide customers through initial eQMS onboarding and ongoing product validation. With the FDA’s and other regulatory agencies’ “Least Burdensome Approach”, we provide our customers with a collection of PDFs, Excel files, and mp4 video evidence of our automated testing.
We asked Sion Wyn, FDA advisor and editor of GAMP 5, to get under the hood of our eQMS validation approach to provide honest feedback. See what he said in the short video below.
The following additional resources are available to learn more about this shift to computerized system assurance.
What to expect from Qualio Validation Support
Qualio utilizes our own Design Control feature to document traceability of user needs (requirements), risks and testing of those needs. Then, the integrated review and approval process within Design Controls produces a collection of reports including a Requirements Trace Matrix (RTM). The RTM is included in the Qualio Validation Support Pack provided to customers.
Additionally, Design Controls auto-generates a Test Plan PDF, Requirement Specification PDF (User Needs), Software Design Specification PDF (User Stories), a Requirements Trace Matrix excel file, and a Change History PDF, which are all included in the Qualio Validation Support Pack to support customer validation efforts. These documents are described in detail, along with recommendations on how and when to use each document, in the Executing Qualio Validation article.
And lastly, video evidence of automated testing like the example below is provided to customers in the Qualio Validation Support Pack demonstrating the execution of the Test Plan without human intervention. On the left, you can see the test script being executed. And on the right, you can see the app view of Qualio where the test is being performed.
The Qualio Validation Support Pack is provided to customers to download and use at their discretion IF Qualio’s documented requirements align with their business use case and requirements.
By taking this “auto-validation” approach, customers accept that the application is functioning as intended and that Qualio completed system testing. Validation documentation is then added to the customer’s instance of Qualio as a “Validation Record”.
What does the customer still need to do?
Qualify Qualio as a supplier of SaaS services
We maintain certification of both ISO 9001 and 27001 to demonstrate our commitment to our customers and to a robust, optimized quality management system. We are happy to host a remote audit of our QMS for new customers, and annually thereafter if required.Validation planning
Plan and define your approach to overall computer software assurance activities. This should include defining responsibilities for both Qualio and your organization. We list some suggestions and resources in our Executing Qualio Validation article.Evaluate business processes and risk assessment
Review Qualio’s Validation Plan sections describing the Business Processes and Risk Assessment. Evaluate for consistency with your intended use of Qualio.
Document the configuration of your “instance” of Qualio (only necessary if implementing Suppliers or Design Controls)
Use the Configuration template found here to get started on documenting the configuration of Suppliers and/or Design Controls in your instance of Qualio. This becomes the baseline for change management for your instance going forward and will become an Effective Document in Qualio once reviewed and approved.Validation Summary Report (VSR)
Summarize the entire validation effort and your system’s suitability for use.
Next Step
If you would like to adopt Qualio’s Validation methodology, click the button below for detailed instructions on executing Qualio Validation.
If you are considering the impact of the shift to CSA and looking for guidance, we’ve prepared an article to assist customers with creating a CSA Transition Plan.