How Do FDA's CSA Guidance and GAMP 5 Align?

In regulated industries like the life sciences, validation and assurance of computerized systems and software are paramount. This post delves into the intersection of ISPE's GAMP 5 (Good Automated Manufacturing Practice) Guideline and the FDA's Computer Software Assurance (CSA) Guidance, exploring how they align and enhance software validation and assurance processes.

Pharmaceutical, biotechnology, and medical device companies rely heavily on complex computerized systems to conduct critical operations ranging from research and development to manufacturing and distribution. Patient safety and product quality are often at stake, and any lapse in the performance of these systems could have grave consequences.

Regulatory bodies such as the Food and Drug Administration (FDA) and organizations like the International Society for Pharmaceutical Engineering (ISPE) recognize these risks and offer guidance on how to ensure the quality, reliability, and compliance of these systems.

A Brief Introduction to CSA

The FDA's Computer Software Assurance framework is a risk-based approach to ensure the software is suitable for its intended use and reduces the likelihood of failures, weaknesses, or deviations. This approach emphasizes critical thinking to match testing methodologies, rigor, and documentation with the level of risk, allowing for more efficient testing processes. The FDA Computer Software Assurance for Production and Quality System Software draft guidance document was published in September 2022.

Key Principles and Categories of GAMP 5

GAMP 5 provides a comprehensive framework for ensuring the compliance and reliability of GxP (Good Practice) computerized systems. Its main goal is to ensure that products comply with regulations and function effectively throughout their development and maintenance. This is achieved using a risk-based approach that considers potential risks at every stage of the product's lifecycle. Identifying and addressing risks early on improves the product and helps meet regulatory requirements.

GAMP 5 encompasses four software categories designed to categorize computerized systems based on complexity. Each GAMP 5 category has specific principles and guidance tailored to ensure regulatory standards.

• Category 1: Infrastructure
• Category 2: Firmware (has been removed from GAMP and is no longer relevant)
• Category 3: Non-configurable
• Category 4: Configurable (i.e., COTS)
• Category 5: Custom

ISPE released a new edition of the GAMP 5 guide in July 2022 (ISPE GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition), but the categories have not changed.

How Do CSA and GAMP 5 Align?

GAMP 5 2E and CSA share common objectives and principles, emphasizing risk management, a lifecycle perspective, and regulatory compliance. The CSA guidance for bio-pharma and medical device industries complements GAMP 5 validation guidelines, providing additional insights into software assurance activities. Let's examine each shared objective in greater detail.

• Shared Goals: Both GAMP 5 and CSA aim to ensure the quality and data integrity of computerized systems. The primary goal remains the well-being of patients.

• Risk-Based Approach: GAMP 5 and CSA stress the importance of applying a risk-based approach and critical thinking when defining how to address risk, such as what you must do if the risk is high versus medium or low. The objective is not to eradicate all risks but to effectively manage them in a balanced and appropriate manner.

• Lifecycle Perspective: Both guidelines emphasize a lifecycle perspective, advocating for continuous validation and assurance activities from system development to retirement, ensuring the reliability and integrity of computerized systems.

• Regulatory Compliance: GAMP 5 and CSA assist organizations in meeting regulatory requirements, such as FDA regulations and international standards, fostering compliance and adherence to industry best practices.

• Balanced Approach: Both GAMP 5 and the FDA computer software assurance guidance promote a balanced approach to computer system validation and assurance. Striking the right balance is crucial, as overly cautious approaches may result in unnecessary paperwork and redundant testing "just to be sure." Over-validation taxes resources and costs the life sciences industry millions of dollars.

• Automation and Technology: Both CSA and GAMP 5 stress working smarter, not harder. This means adopting modern digital tools. Vendors now offer purpose-built software applications that streamline validation efforts and fully align with the latest industry guidance.

• Test Focused vs. Document Focused: GAMP 5 2E and CSA prioritize testing over documentation. This approach allows for greater flexibility in testing methods, focusing on quality rather than quantity. Both guidelines empower validation engineers to think creatively and conduct thorough testing, leading to higher quality outcomes while reducing the need for excessive documentation.

Meeting the Requirements of CSA and GAMP 5

The ValGenesis Validation Lifecycle Management System (VLMS) is a modern solution that’s risk-based and data-driven. It meets the functional requirements needed to help life sciences companies comply with GAMP 5 E2. It also supports the testing strategies championed by CSA.

Powered by new Designer Manager technology, the system “right-sizes” validation efforts and offers the benefits of Agile software development, critical thinking, and smart validation. It provides a truly paperless, error-reducing system for addressing requirements scope creep, and other issues characteristic of cutting-edge manufacturing processes.

How Digital Validation Software Supports CSA

The ValGenesis VLMS simplifies virtually every aspect of the validation process: identify intended use, determine the risk-based approach, determine and implement assurance methods and activities, and create the appropriate record. Here are some examples:

• Identify intended use: The VLMS accelerates critical thinking using the system assessment functionality to identify the intended use.

• Determine a risk-based approach: The solution supports Agile methodology and allows users to perform risk assessments at the requirement level to determine the proper level of testing required. Users can define their own business rules, and the system will automatically identify the amount of testing required to adequately test the requirement based on the assessed risk. ValGenesis VLMS supports any testing methodology, including unscripted testing. A system that does not support unscripted testing is not CSA-ready.

• Determine and implement assurance methods and activities: VLMS accelerates assurance methods and activities using patented requirements traceability matrices (RTMs), frameworks, and test functions. The system directs specific test categories to assigned test developers to create test scripts using user-defined test forms. This adherence to consistent script development fulfills ALCOA+ data integrity standards.

• Create the appropriate record: The VLMS accelerates appropriate records with electronic test case execution and deviation management to create and maintain validated states and records. A dynamically generated change impact summary facilitates change management with required review and re-execution notifications. This ensures validation testing only focuses on the aspects of the system that have changed, saving time and resources.

How Digital Validation Software Supports GAMP 5

ValGenesis VLMS can help any regulated company meet the foundational system requirements needed to align with ISPE GAMP 5 E2 standards out of the box. These requirements include:

• Assess the categories of software and hardware
• Support the lifecycle approach from design to risk-based validation
• Support critical thinking for computerized systems
• Manage changes efficiently with documented impact assessments
• Support risk-based decision-making during test planning, operation, change control, and retirement
• Embrace the Agile methodology for system development and efficient release management
• Support validation of high-risk requirements
• Leverage automated testing
• Support periodic review
• Capable of meeting unscripted testing requirements out-of-the-box

In conclusion, the alignment of ISPE's GAMP 5 Guideline and the FDA's Computer Software Assurance (CSA) Guidance in the life sciences industry highlights the shared goals of ensuring the quality, reliability, and compliance of computerized systems.

By embracing a risk-based approach, emphasizing a lifecycle perspective, and promoting regulatory compliance, companies can navigate the complexities of software validation and assurance more effectively. As technology continues to evolve, leveraging tools like the ValGenesis VLMS can further enhance validation practices.

Interested in learning more about this topic? Watch the webinars 6Ts to CSA Adoption and VLMS is the Best Technical Solution to Implement CSA Guidance presented by Emmanuel Cansino, ValGenesis' Senior Director Industry Solutions.