At the Qualsys Quality in Life Science event, Liam Pollard, Service Implementation Manager, explained why he prefers the GAMP 5 approach to computerised system validation to the traditional IQ / OQ / PQ approach, the benefits of GAMP 5 and some tips to help you on your journey when implementing EQMS.
Below is a transcript from Liam's presentation.
I'm going to go through a brief history of me and my role at Qualsys, some of the lessons learned and how we help our customers to validate EQMS.
About me
I joined Qualsys four years ago. Prior to that, I implemented software systems in the NHS for about ten years.
Part of my role at Qualsys involves helping our customers to implement EQMS using our best practice configuration strategy and train them on using the system. I'm also the validation lead for the business which means I work very closely with every customer who has validation requirements.
Whilst I've been in this role, I've implemented validated quality management systems for over 40 businesses.
|
|
History of Qualsys
Qualsys was founded in 1995. Our first validated customers was twelve years later. When we were developing our strategy around how we were going to provide validation services, we decided Qualsys wasn't going to be one of those suppliers who expects customers to know exactly what was needed and create all their own documentation. We wanted to make sure the process is easy and manageable for you. So Qualsys provides a suite of templates, training and guidance.
By 2015, we had validated 40 businesses using IQ OQ PQ / GAMP 4. We transitioned to GAMP 5 in 2017.
Image: Audience survey response to Which approach did you take to validating a computerised system?
You can see from this live poll that most of the audience have used either the traditional GAMP 4 approach with IQ, OQ, PQ, or have used GAMP 5.
You can still use a GAMP 5 approach with IQ / OQ/ PQ. Qualsys has moved away from the traditional IQ / OQ / PQ approach but some quality professionals do still prefer it. In this case, we adapt our terminology / processes for our customers.
Around seventy percent of our customers opted for the GAMP 5 approach rather than IQ / OQ / PQ.
I find our customers fall into two categories:
1) Some have been doing computerised system validation for twenty years. They haven't had an NCR yet so want to continue with what they are comfortable with.
2) Some customers who we work with are not familiar at all with GAMP 5 or GAMP 4 or computerised system validation. They want our complete guidance, approach and support throughout.
When we started the journey to make the transition to GAMP 5, one thing I noticed was that the IQ OQ PQ terminology was understood and applied very differently. It was difficult for us to provide a standard template because people's interpretation of IQ OQ PQ was very different. With GAMP 5, there is a lot less ambiguity as the terminology is clearer.
What are the differences between GAMP 4 and GAMP 5?
In GAMP 4, we have our user requirements specification, functional specification and the configuration specification. Then we have the system build. Then we have the steps which verify system acceptance.
- The Installation Qualification verifies the configuration specification
- The Operational Qualification verifies the functional specification
- The Product Qualification verifies the user requirements specification
However, there is overlap between each of these.
When we look at the GAMP 5 structure. From a structure and methodology perspective, it's very similar.
GAMP 5 puts a greater emphasis on a risk based approach. A lot of people want to include record integrity in that approach. I personally don't like that approach because I believe it takes away the focus from patient safety and product quality.
The GAMP 5 terminology also aligns better with recent guidance.
I find when people used the more traditional GAMP 4 approach, they had a tendency to overdo it. They over-validated - spending too long on it and over-testing the system.
How Qualsys test the system
Our focus has been on making the process as simple and straightforward as possible for our customers. We want you to leverage our documentation and templates so there is no duplication of effort.
We have three levels of testing.
1) Regression testing: This involves full system testing to ensure that any change to the software has not adversely affected existing functionality. This would happen on a periodic basis.
2) Version testing: We have 2-week sprints. Changes to each version of the software are fully tested and any potentially affected functionality is then also tested. We offer flexible upgrade processes so our customers don't have to upgrade every time there is a new version of the software.
3) Build testing: Each installation is tested, ensuring standard functions are still working as intended. We make sure records can be added and everything works as we would expect.
At this stage, Qualsys have done all of this testing for our customers, so there is no need for any of our customers to do any of this themselves unless you want to.
Image: Audience poll on their top validation challenges
One of the most common validation challenges is duplication of effort. As a supplier, we help with this by providing you with template documentation. By using supplier documentation, it can help with a lot of the other challenges - such as time, assessing risks, and getting started.
One of the challenges we find is people buy a quality management system and they don't have any experience or training on how to validate it. They are already balancing a lot of other responsibilities - so they don't have much time. We take a lot of the onus off you by providing a managed service.
The GAMP 5 approach makes the requirements a lot clearer. For example, we provide documentation showing what tests have been completed at each stage. We cover:
- Configuration testing: We can help you test how the system has been set up.
- Functional testing
- Regression testing: We always advise in your URS to make it very clear what is critical to quality and what is a risk to patient safety.
The benefits of following a GAMP 5 approach:
- It's pragmatic - I find it's straightforward and common sense.
- Eliminate duplication of effort
- Saves significant time by leveraging supplier documentation. There are still sometimes vastly different interpretations in what GAMP 5 is requiring from customer-to-customer, but as with being audited, it's about being open and transparent. It's often about context and requirements.
- A widely accepted, industry-leading approach
- Increase business and operational confidence. We have many customers, such as Sodexo, AstraZeneca and GSK who have validated EQMS using our template documentation and guidance so it provides that level of reassurance it's adequate.
- Focuses the business on what really matters - prevent over-validating.
Our approach to computerised system validation
It all starts with having good foundations. Qualsys starts by understanding your business, what and why processes are in place (such as your quality gates), your regulatory requirements and your internal company quality requirements. We need this strong foundation of knowledge and context in order to build your requirements into your management system.
After we have the specifications, we can verify it, then accept and release.
Testing: how Qualsys helps
URS template
A lot of customers know they need an electronic quality management system but they don't know exactly what functionality they need or what is available. Qualsys are able to provide this URS template. We recommend adapting this template to make it accurate and complete for your own business. We also recommend putting the criticality of this functionality into the URS. This means if there are any deviations we can assess whether we can carry on or whether that counts as a fail and we can't roll out the system with that deviation.
Test planning
We project manage the test planning process. Qualsys starts with an introduction to validation, our approach and our documentation. Then we work with you to make it work.
Test case development
Qualsys then provides template test protocols based upon the URS. A lot of these test protocols we can select from our library, but some may need to be unique to your own requirements.
Test case development
Qualsys can then help you to build the environment and the configuration in the system.
Test execution
At this point, our customers have had a lot of product training so we tend to find customers want to carry out the tests by themselves. But we can also sit with customers or remotely with a screen watching and helping you through this process.
Test cycle closure.
Qualsys provides templates for validation reports and deviation logs. As you are the regulated company, you must sign off on all of the documentation - it must match your requirements and environments.
The validation plan and risk assessment is also all included in the process.
Typical timelines for implementation
We have implemented and validated EQMS for a customer in four working days. But in general, a lot of our customers like to work to the following timescales:
Week one: Qualsys will give you the validation master plan, risk assessment documents and our processes.
Week two: We look through the specification requirements. We start to join up the configuration specification. Some of our customers have a URS that is a bit broader so we need to make some amendments and will advise where that is necessary.
Week three: This is where we train licensed users on how to use the system. It's really important that they understand the functionality and how the configuration works.
Week four: After you've become familiar with the tool, EQMS is then configured. We can either do that for you or some customers prefer to do it themselves.
Week five: Verification stage. This verifies the system has been set up in line with the configuration specification and the requirements specification. We look at the requirements and check everything is set up properly. Some of this is already covered by the functional specification, we can assume a lot of the core functions already work as intended as it has already been tested.
Week six: Acceptance and release is the last step. This is where we approve all of the documentation and complete reports.
It can be even easier than this. We can complete this in a week if you need. Sometimes it can take a bit longer if standard operating procedures or your requirements change throughout the process.
Checklist to complete before starting an EQMS project:
1) Complete the GAMP 5 7.1 Supplier Good Practice audit
Some of the key requirements before starting your journey with EQMS is to do the GAMP 5 7.1 Supplier Good Practice Audit. If you aren't sure how to audit us, we can even give you guidance on this because we've been through it so many times.
2) Go with your gut feeling
You should also ensure you have a good relationship and trust the supplier. That should be implicit anyway. We have several other customers who have left their former supplier because they don't have a good relationship of trust.
3) Good understanding of your requirements
You want to ensure your supplier has a good understanding of your requirements. This is the foundation of good validation.
4) Traditional terminology will still work
If you use the traditional terminology of IQ / OQ / PQ, please don't worry - GAMP 5 will still work.
Recommended further reading:
1. GAMP 5 - a risk based approach to Compliant GxP Computerised systems
2. Good Practice Guide: Testing of GxP systems
What you should do now:
Access Sion Wyn interviews and GxP guidance in in our GxP Toolkit
Share your thoughts on this article