Begin with the End in Mind: Back to the Focus of Quality

This article will focus mainly on one or two aspects regarding how the concepts of computerized systems validation/software assurance and critical thinking could be applied in projects, with some touchpoints on:
-    The increased importance of technology/IT service providers, including cloud service providers;
-    Evolving approaches to software development, including incremental and iterative models and methods.

With evolving technology, software development has been advancing at a high speed. However, the application of new technology in the GxP area can be constrained when the validation approach has been confined to the classic but traditional V model. Consequently, the most advanced technology can sometimes be limited or can fail in benefiting the industry. One example would be where the current situation may not align with industry goals to safeguard Data Integrity, Product Quality and Patient Safety.

Therefore, the GAMP5 2nd edition emphasizes the following points:

1. The verification should be based on the understanding of the business/process, and the testing should be focused on the systems’ intended use with an augmented risk-based approach.

2. In GAMP5 2nd edition, it is encouraged that the patient-centric and risk-based approach should be adopted against a primarily compliance-driven approach, thus potentially resulting in a reduction of excessively documented test evidence such as, in some cases, a screenshot for every step. 

In addition, GAMP5 2nd edition reinforces that the supplier quality system and documentation may be leveraged; it also provides guidance on how to support iterative and incremental (Agile) methods and the application of new technologies (e.g., software tools (ALM, JIRA, Confluence, etc.), blockchain, ML/AI, etc.).

Critical Thinking is introduced here as an important concept in this edition, starting from a change in mind-set. This should be applied to all stages of the product life cycle in order to fulfil the desire of applying the new technology in an efficient manner and in compliance with regulatory requirements. Critical thinking promotes a risk-based strategy for both the Technology System and also for its requested functional requirements/associated risks to ensure efficiency in the testing approach/documentation.

As an industry player, how can this approach be applied to GxP processes?

First, following the trend of the IT service provider’s development, the focus of supplier and system selection by the regulated company should be on whether the system was developed in a quality mannerism and can meet its intended use. With the development of technology, we have more cloud-based suppliers such as IaaS: Infrastructure as a Service, PaaS: Platform as a Service, and SaaS: Software as a Service. The implementation of such systems relies on the standard and collaboration between suppliers and the regulated company, especially focusing on the vendor/supplier audit. Supplier documentation should be leveraged, along with qualification protocols/tests and GxP impact assessments to leverage the supplier’s expertise in the business process. 

The expectation is to transform the current test-centric methodology, which primarily focuses on documentation.  The vendor experience and documentation should emphasize the full understanding and evaluation of business processes, requirements, and acceptable standards. GAMP5 2nd edition and FDA’s CSA draft guidance emphasize reduced/repetitive testing and unnecessary documentation, when focusing on an augmented risk-based methodology potentially in an Agile fashion.

GAMP5 2nd edition provides suggestions for IT service providers and towards system design of GxP computerized systems. To reduce the efforts of product management and simplify the update process, the supplier should aim to develop new customer requirements to be put into the mainstream product offering for the wider user base when feasible, thus keeping the development of new or amended features within the supplier’s development life cycle rather than creating special versions for individual customers. 

Critical thinking emphasizes in one aspect that the regulated company should access or leverage the suppliers who meet the regulated company’s intended use of a particular system.  This means the quality systems and deliverables of the supplier, including the development and testing approaches, will reduce the validation efforts of the regulated company significantly. Critical thinking also emphasizes efforts where risks lie and focuses on expanded efforts towards configured and custom requirements/functions (especially in Quality Critical Functions). 

In addition, the GAMP5 2nd edition also integrates more diverse testing methodologies based on critical thinking, such as unscripted, scripted (manual or automated), risk-based, agile, emphasizing iterative and incremental testing with exception based reporting. If done in cooperation with the agile development approaches, exploratory testing, automated test tools and other methods, these can be introduced to ensure the robustness and completeness of testing. This allows the regulated companies and suppliers more options in terms of verification methods and test design. As a result, it releases the stress on the burden of scripts and test documentation and allows for the focus to be on confirming whether the system is fit for its intended use.

Accelerating the application of new technology in the GxP industry, enabling the manufacturing process and benefiting patients cannot be achieved without the joint efforts of regulated companies, suppliers, and regulators. The compliance cost and focus should be on confirming the right fit for the intended use. In this way, we can start with the end in mind; focusing on quality for the vision of the life science industry while also potentially producing better Data Integrity, Product Quality, Patient Safety and Regulatory Inspectional Success.