FDA regulation of software validation for automated processes used as part of production or the quality system for medical device manufacturers has been evolving over the last several decades. Although required by the original GMP since 1978, FDA scrutiny of software validation of automated processes has increased significantly since 1996. In that year, FDA promulgated the Quality System Regulation, 21 CFR Part 820. They also began to enforce 820.70(i), as evidenced by the increasing number of FDA 483 observations and warning letters citing industry's lack of compliance with FDA software validation requirements.
Examples of potential automated processes that require software validation include systems with software related to corrective and preventive action, production and process control, design control, and management control. Other areas of the quality system such as device tracking, clinical trials monitoring software, document control processes, and electronic recordkeeping systems also require software validation. Many automated processes may also include potential electronic records and signatures. Although they would fall under 21 CFR Part 11, the latest FDA Part 11 Scope and Application guidance defers FDA enforcement of its validation requirements for systems to the predicate regulation, 21 CFR Part 820.70(i).
Identifying the automated processes that require validation, and the level of effort to apply to software validation activities and documentation for these identified systems, are key concerns that can overwhelm the FDA-regulated manufacturer. To address FDA compliance expectations, the manufacturer needs to develop a master validation plan for software in automated processes. The plan should include a prioritized scheme based on safety and regulatory risk for validation manufacturing and quality system software. Once identified, a practical approach should be developed to address software validation for the prioritized systems to allow for attaining the appropriate level of software validation within reasonable cost and timeframe constraints. Main areas of focus in a practical approach to software validation should include documentation coverage identified as part of project planning related to those key areas identified in the Quality System Inspection Technique (QSIT) for FDA investigators. The FDA, Guide to Inspections of Quality Systems, for QSIT instructs investigators to look for a software validation plan, software requirements document, software validation protocol, software validation results, and software change controls to confirm that the software will meet user needs and its intended use along with any applicable vendor purchasing data for off-the-shelf software.
Dennis Rubenacker is co-founder and senior partner of the consulting firm of Noblitt & Rueland, which provides consulting and training services for medical device and IVD manufacturers. Rubenacker specializes in software validation, FDA electronic recordkeeping, design control, risk assessment, software development, and software quality management for the medical device industry. He has extensive experience dealing with product development, software development, software quality assurance, and software verification and validation for IVD medical device instrumentation and automated processes. His medical product line experience includes clinical chemistry analyzers, immunoassay analyzers, microbiology analyzers, glucose monitors, and OTC diagnostic devices. Rubenacker has assisted international companies ranging in size from less than $1 million in sales to Fortune 100 companies. He received his BS in electrical engineering with highest honors from the University of Illinois and is a member of the Institute for Electrical and Electronic Engineers, RAPS, OCRA, and ASQ. He can be contacted by phoning 888/892-4664 or via e-mail at firstname.lastname@example.org. For more information about Noblitt & Rueland, view its listing in the online Consultants Directory or go to the firm's Web site at www.fdaconsulting.com.