The Paradoxes of Computer System Validation
By Bob Beliveau
Life Science companies who use computer systems to support regulated activities are compelled to perform computer system validation (CSV). CSV is valuable because it insists that you evaluate system performance against requirements and ensure regulatory fitness. But CSV is not an easy process. You must list requirements, perform risk assessments, and generate and execute test scripts to demonstrate compliance.
There is a well-known inverse relationship between system adaptability and CSV difficulty. In other words, standardized, turnkey systems are easier to validate than customized systems. This is embodied in the Good Automated Manufacturing Process (GAMP) and its tiered categories; Category 1 (Infrastructure S/W) being the most standard and Category 5 (Custom/Bespoke) being the most adaptive. GAMP recommends a much higher degree of testing and validation for the higher category applications.
This leads to the first paradox. Companies often choose standardized products for their ease of validation, instead of their fitness for purpose. This compromise causes users to adapt their business practices around the product’s limitations. This, in-turn, introduces operational drag which drives up staffing costs, increases opportunity for error, and causes the emergence of “gapware” to plug the operational hole between the standard product’s functions and business needs.
Figure 1 – Operating Costs of Standardized vs. Adaptable Products
Figure 1 shows how this decision plays out over an extended time horizon. If we consider validation as part of operational cost, we see that initially, the standardized product decision is less expensive. But as time goes by, the adaptable product can pivot to meet evolving needs which is reflected in a shallower operating cost slope. The pace of change continues to increase in the life science industry, and this is depicted by an upwards bending operational curve for the standardized product. The organizational costs of working around an inflexible solution increase over time, impacting efficiency and quality.
Adaptable computer systems can pivot in response to shifting needs. But CSV tends to calcify the systems in their initial configuration due to the difficulty of re-validation and change control. This leads to paradox number two. An adaptive software system by itself is insufficient unless coupled with a responsive change management approach.
The FDA has recently issued updated Computer Software Assurance guidance (link) recognizing the burden of rigid CSV approaches and the perverse effect of continued use of outdated systems. Many companies have delayed or abandoned software-aided process improvements because of the perceived overhead of CSV, contributing to longer drug development times and increased expense. The new guidance provides an opportunity to reevaluate CSV approaches and to “rightsize” them with respect to risk. Software providers can and should incorporate this thinking and streamline CSV packages accordingly. When evaluating software for your business, it pays to consider the software’s adaptability and to understand the provider’s approach to establishing and maintaining the system’s validated state. An adaptable computer system coupled with a responsive change management practice can make computers work for your business instead of the other way around.