GAMP: The essential tool for maintaining 21 CFR Part 11 compliance
09/01/2003
The latest version of the Good Automated Manufacturing Practices guidelines can help ensure the accuracy and integrity of your commercial-off-the-shelf automated filter test instruments
By Charlie Wakeham, Xiaohan Wei & Jerold M. Martin
Since its enforcement, starting in 1997, Title 21 of the U.S. Code of Federal Regulations (CFR) Part 11 has had a resounding impact in the biotechnology and pharmaceutical industries.
For cleanroom operators, in addition to validating all ventilation, monitoring, temperature and pressure systems, this means also ensuring compliance with 21 CFR Part 11 when data related to the manufacture of drugs and therapies is maintained electronically or submitted to the FDA electronically.
In the strictest sense, 21 CFR Part 11 is applied to any pharmaceutical manufacturing process utilizing automated controls that generate data maintained in electronic format. The aim of this regulation is to ensure the authenticity and integrity of electronic records, and to prevent the signer from readily refuting the authenticity of his signature.
null
In this article, we'll focus on small Commercial Off-The-Shelf (COTS) automated filter integrity test instruments used to test sterilizing and other process filters in cleanroom environments, and suggest how the latest version of the Good Automated Manufacturing Practices—GAMP 4, released in December 2001—can help ensure the accuracy and integrity of these systems.
The first edition of GAMP was published in March 1994 as a draft for comment by suppliers and the industry in the United Kingdom. Following the incorporation of comments, mostly from suppliers, GAMP 1 was published in March 1995. While GAMP has no regulatory authority, its guidelines provide pharmaceutical, biotechnology and healthcare companies with an effective tool to assist with FDA compliance.
Since publication of GAMP 1, three subsequent versions have been produced, the last two in collaboration with ISPE. The latest version improves on previous revisions, with greater clarification of responsibilities and necessary actions, as well as features to make the document easier to navigate and use.
Complying with 21 CFR Part 11, Electronic Records and Electronic Signatures was written by a GAMP special interest group and published jointly by ISPE and PDA in October 2001.
GAMP in the cleanroom
Applying GAMP guidelines to the validation of COTS filter test instruments provides a critical safeguard for contamination control in cleanrooms. The fact that the failure of the unit could result in the loss of a production batch or release of a non-sterile product underscores GAMP's importance. Worse yet, if a filter integrity tester returns a false pass on a non-integral product-sterilizing or virus removal filter, the subsequent contamination of the batch may not be detected even after the batch is completed and subjected to laboratory analyses. Subsequent re-processing or destruction of the batch could cost millions of dollars.
While GAMP 4 clearly defines the responsibilities of suppliers and users, some suppliers have taken the initiative to offer assistance beyond the scope of the responsibilities specified by the guidelines. For instance, a supplier may elect to produce a Validation Plan, which is defined in GAMP 4 as the document in which the end-user should "summarize the entire project, identify measures for success and clearly define criteria for final acceptance."
 Figure 1 shows that when the OQ is split into two parts, it saves time and costs while providing a high level of validation. |
null
In other words, this plan defines the design documentation and qualification testing that the product must undergo before commercial release. This allows the end user to assess the level of additional validation (e.g., Installation Qualification, Operational Qualification and Performance Qualification) that they may require before putting the instrument into service.
Likewise, a supplier may also make requirements for its own standard off-the-shelf products and new software versions available to the end user through the User Requirement Specification section, which is designated as the responsibility of the end user in GAMP 4. This added input from the supplier provides end users with a basis for developing their own versions of these documents. Naturally, suppliers need to effectively address sections designated for suppliers, including Functional Specification, Hardware Design Specification and Software Design Specification, which are made available to the end user.
Streamlining validation activities
General validation activities are comprised of Installation Qualification (IQ), Operational Qualification (OQ), Performance Qualification (PQ), and Design Qualification (DQ). For the most part, these validation activities are performed by the user; however, use of supplier documents, as they relate to IQ or OQ, can simplify the overall validation process.
For example, to streamline OQ of an off-the-shelf instrument, suppliers can test the instrument software remotely from the hardware using a Software Test Specification. Separate tests can be performed to ensure that the final hardware configuration meets the requirements of the original design specification.
This approach minimizes validation burden on end users by enabling OQ to be separated into testing at the supplier site (OQ1) and testing in the operational environment (OQ2). Prior to technical release of a new instrument or new software version, the supplier performs an extensive qualification on a standard production instrument, thus qualifying the software version when loaded into the standard hardware of each individual production instrument. This forms OQ1.
A much condensed test protocol, OQ2, can be performed on the end user's instrument upon installation. This serves to verify that the pre-qualified software is functioning correctly when integrated with the standard hardware. Availability of this IQ/OQ1/OQ2 format greatly reduces the time and cost of IQ/OQ for a newly installed instrument.
Once an automated system is validated and in operation, it is important to ensure that an automated system remains in a validated state. Suppliers must stay abreast of evolving validation requirements, and continually assess the changing market and regulatory environment with respect to its instruments.
Period releases of software or hardware upgrades can enhance the benefits provided by the instrument to the user. Such new releases must be governed by strict change control protocols. Upgrades should only be installed after assessment of the impact on the validated status by the instrument user. For each new software version, the supplier should update the design and qualification documentation of the instrument. Recommendations on whether re-qualification is required after upgrade is also useful for the end user.
Complying with 21 CFR Part 11
21 CFR Part 11 requires that a "system is validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records." From a procedural perspective, GAMP 4 addresses 21 CFR Part 11 requirements by providing guidelines for development and validation of automated systems. GAMP 4 guidelines can be purchased from ISPE (www.ispe.org).
21 CFR Part 11 states that both technological controls (supplied by the instrument) and procedural controls (supplied by the user) are required for compliance with the regulation. For example, an instrument might include technological controls that give each user a User ID and password that must be input before access to the instrument is granted. An end-user procedural control is required to ensure that operators are given the correct training before a User ID is created for them.
The joint PDA/ISPE publication, Complying with 21 CFR Part 11, Electronic Records and Electronic Signatures, lists each part of the regulation and states whether a technological or procedural control is required to meet it, and whether this is the supplier's or end user's responsibility.
Understanding the technical features and functions needed to meet 21 CFR Part 11 requirements is a large part of the compliance equation. An example of a control in a filter test instrument for compliance with 21CFR Part 11 requirements is to have no capability to modify an electronic record. Instead, the device stores a new record every time a test program is created or modified, while ensuring that an electronic signature of the user is obtained.
 The GAMP V-model for automated system development provides the steps to achieve a validated state. |
null
In a similar way, the device has been designed so that the creation or deletion of User Access Rights results in a new record in the User Access list, which also requires an electronic signature from the system administrator. The electronic signature and date and time stamp on the electronic record forms the audit trail. Creating a new record each time also ensures that previous data is not obscured—an important requirement for compliance with 21 CFR Part 11.
Suppliers who are mindful of 21 CFR Part 11 requirements are also developing COTS filter test instruments with greater data storage capacity so that more records can be retained for a longer period of time on the instrument that generated the data.
A demonstrated necessity
Applying GAMP protocols to entire cleanroom systems fosters synergy and understanding between users and suppliers, and creates a safer, cleaner development environment. Within the context of automated filter integrity testers, GAMP and its related publications help cleanroom operators address 21 CFR Part 11—one of the most pressing regulatory issues today.
CHARLIE WAKEHAM is project engineer in the Instrumentation Technology department of Pall Europe Limited, with responsibility for the design, development, manufacture, qualification, validation and support of instrumentation for the biopharmaceutical and food industries. She can be contacted at: [email protected] XIAOHAN WEI is a marketing manager for Pall Life Sciences, where he is responsible for automated instrumentation that supports critical filtration processes in the biopharmaceutical industry. He holds one U.S. Patent and has published a dozen technical papers on process equipment and manufacturing technologies. He can be contacted at: [email protected] JEROLD.M. MARTIN is global technical director with Pall Corp.'s Life Sciences Division where he is responsible for technical communications and industry
egulatory liaisons related to pharmaceutical and biopharmaceutical process filtration. He can be reached at: [email protected]
GAMP timeline
GAMP was originally established in 1991 as the Pharmaceutical Industry Computer Systems Validation Forum in the U.K. Their first draft guideline was VMAN (Validation Management), an early forerunner of the modern GAMP guidelines.
In 1996, the Supplier Forum was created to integrate suppliers into the guidance-making process. In 2000, GAMP Americas was created to allow pharmaceutical industry professionals in the U.S. to participate in the creation of GAMP guidelines and good working practices. In 2001, the GAMP forum became a technical sub-committee of ISPE.
GAMP Shared Interest Groups (SIGs) are an outgrowth of the GAMP Forum around the world. SIGs develop plans and discussion documents for presentation at GAMP meetings. The SIGs provide an opportunity to develop a common understanding of particular topics by discussing issues and practical solutions. These discussions have led to the publication of white papers, articles or complete guidelines (e.g., GAMP Forum's Complying with 21 CFR Part 11 guideline).
GAMP History
February 1994
First draft of guideline document was distributed to U.K. industry for comment.
January 1995
Second draft incorporated comments from 31 companies.
March 1995
Version 1.0 was released in electronic version only.
May 1996
Version 2.0 included revision and new content, incorporating further comments from Europe and the U.S. It also added a second volume to the guideline document.
March 1998
Version 3.0 included further revision and new content, as well as separation into User and Supplier guides.
December 2001
GAMP 4 released as a major revision containing new content in line with regulatory and technological developments. It broadened the scope of GAMP 3 to include regulated healthcare industries, and provides greater coverage of user responsibilities and detail on operational activities.