By Bill Burke, Merit Solutions

Any software developer worth their salt will go to great lengths to ensure their code works consistently and without a glitch in the various platforms, operating systems, data ranges, and other conditions it portends to meet. But no matter what they say, nary a developer is omniscient, and systems do fail, sometimes subtly, sometimes with a dramatic freeze, and usually with a combination of annoying glitches in brand new releases that have yet to get the full scrutiny an entire market can bring to bear. In a word-bugs.

In a non-regulated environment, IT professionals have various methods of kicking the tires, so to speak, of the various software and hardware combinations that they implement. After installing new products and after doing a reasonable number of dry runs, the IT professional will deliver a verdict as to whether it is a go or not.But when it comes to pharmaceuticals and the like, “NOT SO FAST”, says the FDA. That bug you allow to linger in a system could very well be lethal at some point. The FDA’s 21 CFR Part 11 says, in effect, “SHOW ME THAT YOUR SYSTEMS WORK-PROVE IT!” That, my colleagues, is what software validation means, from the vantage point of 21 CFR Part 11 compliance. Or in validation lingo, it’s commonly referred to as IQ, OQ, and PQ.

First some definitions–IQ is shorthand for Installation Qualification. IQ is a series of steps that need to be taken to prove that the underlying hardware and operating systems being used by your firm is solid, and that when software is installed it is done according to complete written processes. OQ, or Operations Qualification, refers to the set of procedures that are followed to prove that the design and configuration of the business system your company selects and installs operates as it is expected to. PQ, or Production Qualification, takes proof to the next step after you have demonstrated that the software operates as it does, by proving systems work in your live working environment, following a series of processes and tests to ensure that it was all done correctly.

All three stages-IQ, OQ, and PQ-require that you design tests, do the tests, print out the results, and store these test results in an accessible location such as a 3-ring binder that can serve as a ready reference at any time. IQ/OQ/PQ are only required for those Standard Operating Procedures (SOPs) that are significant processes from an FDA standpoint. Your business system may help create efficient invoicing, for example, but how this is done is usually insignificant vis-à-vis a human life and the FDA has little to say about it. In contrast, your company is likely to have inventory control processes that are akin to those often called “pick-pack-ship”. Because it is potentially very significant if the wrong item is picked for shipping the FDA mandates that any business system touch points with this SOP be validated.

Smarter companies look at IQ/OQ/PQ as opportunities to streamline business practices. FDA regulations force you to take the time to define your processes, but it is up to you to use this as a chance to refine them as well. This means you can take a breather from the crush of hectic production schedules and think through your many business processes and make sure they truly make sense from an operational standpoint-whether they have to do with customer interaction, production processes, inventory control, etc. Granted, it may not feel like an opportunity. But to those of us that have worked with fast growing companies in both FDA-regulated firms and those outside such regulatory control, there truly are advantages to killing the patterns of what could charitably be called fly-by-the-seat-of-the-pants management methods.

Of course, the downside is that 21 CFR Part 11 requirements for validation eat up big chunks of time. The largest multinational firms might spend several man-years on validation, and even the smallest companies would probably need to devote 1 – 2 people to validation tasks for a few months. Therein lies the onerous rub that most experience with FDA-required validation processes.

Yet, if all you had to do was do it once, IQ/OQ/PQ probably wouldn’t be so bad. In the real world of a thriving business, validation is rarely a totally done deal. Imagine this scenario-You just finished validating a new business system en toto. All processes were scrutinized, touch points between your business systems and SOPs were determined, all the steps of IQ/OQ/PQ were completed by the book. Then, you realize that a high percentage of orders for a certain pharmaceutical that you manufacture are similar enough to produce in a batch and then divide into sublots later packaged separately. You figure that the decrease in labor costs alone is quite significant, maybe 50% for that pharmaceutical, because the batch production method will provide a threefold increase in throughput compared to the one-off method. It’s easy to see batch production is the way to go forward….But…”NOT SO FAST” says FDA 21 CFR Part 11. If you are changing your SOP, you need to prove that the business systems you so meticulously validated still hold. Yes, you must do IQ/OQ/PQ all over again.

This is exactly why many companies sometimes feel that compliance gets in the way of being competitive. There is no way around it. Validation per 21 CFR Part 11 builds an inherent inflexibility into your business. You just cannot decide to change SOPs overnight and then do it.

My advice is to forget about ranting about this obstacle, but instead to bite the bullet and figure out how to make periodic and repeating validation exercises as easy as possible. Consider that recalls of defective products caused by bugs in your system are no picnic either-for you and certainly not for your ultimate customer.

This is where understanding validation templates comes in. Validation templates provide predefined tests and documentation for widely used business systems such as Microsoft Great Plains, that work with how these systems flow vis-à-vis SOPs. Prewritten templates save you time that would otherwise need to be spent in creating and executing validation tests. With prewritten templates, it becomes relatively straightforward to update SOPs and perform corresponding tests when changes to business processes are warranted. With templates you get compliance and competitiveness. Frankly, it’s a no-brainer to see that using validation templates is the way to go.

Buyers beware! Not all validation or validation template purveyors are alike. Some templates are closely tuned to the underlying architecture of the business system they are used with-and some predesigned templates in the market are relatively blind to the nuances of the systems they are supposedly designed to work with. Business systems of all brands do rely on relatively sophisticated database functions that have data flow in certain directions. Template developers are either adept at these underlying systems and the touch points between processes and systems or they are not. If templates are merely cobbled together, you could end up spending as much time trying to get them to work as if you were starting from scratch, or worse yet, end up with a hopelessly buggy system.

Many dozens of companies offer validation templates, but it is pretty quick to make a first level sort of who’s who. First question is-what type system do the templates work with. Don’t stop there, however. Dig a bit deeper to make sure the consultants providing you the templates are adept at your specific business systems, including the design of the underlying database and the functional flow of the software. Better yet, make sure your source for validation templates has an active R&D program to continuously expand their template library for your specific business system. That means that when you grow and change your SOPs, they are likely to be one step ahead of you.The bottom line is that there is a bottom line. Think of how you approach FDA 21 CFR Part 11 validation as an opportunity to pull ahead of the pack and you will.Bill Burke is President of Merit Solutions (www.meritsolutions.com), that specializes in software for full FDA CFR 21 Part 11 compliance for pharmaceutical manufacturers and other Life Sciences firms using Microsoft Business Systems. Questions can be forwarded to Bill Burke at bburke@meritsolutions.com, 630 – 510 – 3238.