Comments on the GAMP Good Practice Guide for Validation of Laboratory Computerized Systems, Part 2 - In the second part of this article I will discuss risk assessment methodology, the new US Pharmacop

Comments on the GAMP Good Practice Guide for Validation of Laboratory Computerized Systems, Part 2

In the second part of this article I will discuss risk assessment methodology, the new US Pharmacopeia general chapter <1058> and suggest an integrated approach to instrument qualification and computer validation.

Sep 1, 2006
By: R.D. McDowall
LCGC Europe
Volume 19, Issue 9

12 3 4

In the first part of this article¹ we discussed the GAMP Good Practice Guide (GPG) for the Validation of Laboratory Computerized Systems.² We looked at the advantages offered by the System Implementation Life Cycle (SILC) in contrast to the complexity of the system classification proposed in the GPG.

In this part I'll look at the risk assessment methodology, the new US Pharmacopeia (USP) general chapter <1058>,³ which is based upon the AAPS analytical equipment qualification white paper,⁴ and suggest a way forward to unite the qualification of equipment with the validation of the controlling laboratory computers.

Risk Assessment Methodology

Figure 1: GAMP GPG risk management process.

OK, if you managed to get this far after reading Part 1, we now have the finishing touch — the risk assessment methodology. GAMP 4⁵ uses a modified Failure Mode Effect Analysis (FMEA) risk assessment methodology as outlined in Appendix M3.³ This has also been adapted for laboratory systems in the GPG. Why this over complex methodology was selected for laboratory systems is not discussed although I suspect that it is aimed at consistency throughout the GAMP series of publications. The overall process flow for the risk assessment is shown in Figure 1: the first three steps are at the system level and the last two at the individual requirement level.

FMEA was originally developed for risk assessment for new aeroplane designs in the late 1940s and has been adapted over time to encompass new designs and processes. However, as the majority of laboratory equipment and software used in laboratories is commercially available and purchased rather than built from scratch why is this inappropriate methodology being applied?

Commercially available instruments and systems have already been tested by the vendors which can be verified by audits. Therefore, why should a risk analysis methodology that is very effective for new designs and processes be dumped or foisted on laboratories using mainly commercial systems? There are alternative and simpler risk analysis approaches that can be used for the commercial off-the-shelf and configurable COTS software applications used throughout laboratories. For example, there are also

Hazard analysis and critical control points (HACCP)
Functional risk assessment (FRA).

A detailed discussion of risk management is outside the scope of this column but I have written a recent paper on the subject that some of you may find useful as it compares the various methodologies available.⁶

Table 1: GAMP GPG for laboratory systems — system impact table

The GPG uses a Boston grid for determining system impact that is outlined in Appendix 1 of the document.² However, because there are seven classes of laboratory instrumentation and five classes of business impact this requires a 7 × 5 Boston grid. This over complicates the issue and is NOT easily manageable (Table 1). Moreover, because some systems can be classified in a number of laboratory categories there is a possibility that the impact of a system can be underestimated.¹

Testing Approach versus Intended Purpose

Throughout the GPG there appears to be an emphasis on managing regulatory risk. This is in contrast to the introductory statements in the GPG mentioned at the start of this column. From my perspective, this is wrong and emphasis should be placed on defining the intended purpose of the system and hence functions of the instrument and software that are required first and foremost. Only then will you be able to assess the risk for the system based on the intended functions of the system.

12 3 4