Medical Validation and ERP Updates – A Case for Automation
All medical device manufacturers who use software in the production of medical devices (including manufacturing ERP systems) must validate the use of the software. The validation process should take place during the initial implementation and after each major software update.
There’s good reason for these validation mandates. The Food and Drug Administration’s (FDA) analysis of 3,140 medical device recalls conducted between 1992 and 1998 revealed that 242 of them (7.7 percent) were attributable to software failures. Of those software related recalls, 192 (or 79 percent) were caused by software defects that were introduced when changes were made to the software after its initial production and distribution. Software validation and other related good software engineering practices are a principal means of avoiding such defects and resultant recalls.
Medical device validation is a global issue with directives from the U.S. FDA, ISO 9000:2000, European Union’s GMP, the World Health Organization and the GAMP Forum. The various definitions of validation all state the same thing: Validation in the context of Good Manufacturing Practice (GMP) is the documented evidence that a thing does what it is expected to do. In our discussion, the “thing” is the enterprise software.
ERP Software Validation
One common misunderstanding is that the customer’s responsibility for compliance can be met by the software vendor “validating” its software. Software vendors cannot sell you “compliant software” or “FDA validated software” because it is not the software itself that is validated, it’s the way the software is used that needs to be validated.
The reasoning behind this is that off-the-shelf software can be used many different ways depending on the customer’s enterprise and standard operating procedures (SOPs) that have been developed to meet individual requirements. Ultimately, it is the responsibility of the user of the system to ensure that the system itself, and how it is implemented and used, is appropriate. But the ERP software vendor has responsibilities too: Commercial off-the-shelf software must have the built-in features that allow it to be validated by the end user as there are many traceability and other software functionalities that are mandated by the governing bodies.
Validating a system such as EnterpriseIQ can be a daunting task. EnterpriseIQ is an Enterprise Execution System (EES) that includes all aspects of ERP and MES solutions. It permeates every aspect of the enterprise. Many of your SOPs are centered around the software. A large part of the validation effort includes developing manual scripts around the SOPs. The scripts are then used as a template to verify that when data is entered and processed, the result is as expected. These scripts are an important tool in revalidating your use of the software after a major update.
Unfortunately, even with detailed scripts, manually revalidating each SOP/module can be very time consuming and numbing work. This fact alone seems to be the reason that many medical device manufacturers would rather put off updating as long as possible even at the cost of greater efficiencies to be had with the latest and greatest software development. After all, your business never stops changing and therefore your enterprise system must keep pace with new development. What’s a person to do? Perhaps you can introduce automation to the revalidation process.
There are many test automation tools on the market that can be used to create the module testing scripts. Once created, automated tests can be run over and over again at no additional cost and they are much faster than manual tests. Automated software testing can play back prerecorded and predefined actions, compare the results to the expected behavior and report the success or failure of these tests by generating detailed test logs of all the actions performed during the automated test runs. The logs give you an analysis of the test results and will identify any errors as well as providing proof of validation to the regulatory agencies.
Regulatory agencies such as the U.S. FDA have long established validation as a core requirement of quality assurance for medical device manufacturers. Still, many companies fail to develop an adequate validation program, which can prove costly if discovered by an inspector. Over the last several years, inadequate validation has been one of the most common sources of U.S. FDA 483 warning letters [Click here for more information about the FDA’s general principles of software validation]. Rather than putting off new software updates, consider automation to ease the validation process.