1. IVT s 11th Annual Conference on
IVT’s
Change Control
Know the Global Regulations for
Change Control
Ch C t l
Joseph Zec
Sr. Manager & Corporate Software Steward
Corporate Software Quality Assurance
Boston Scientific Corp
January 28, 2013
1

2. Agenda
10% of what we do is invent things. The
other 90% is spent changing them.
p g g
Why regulate change control?
The regulator s view
regulator’s
Warning Letter survey
Factors to consider in developing a change
control process
2

3. Why regulate change
y egu ate c a ge
control?
“The FDA’s analysis of 3140 medical device
recalls conducted between 1992 and 1998
reveals that 242 of them are attributable to
software failures. Of those software related
recalls,
recalls 192 (or 79%) were caused by software
defects that were introduced when changes
were made to the software after its initial
production and distribution.”
– General Principles of Software Validation
3

4. The Regulator’s Perspective
“Appropriate controls shall be exercised
over computer or related systems to
p y
assure that changes in master production
and control records or other records are
instituted only by authorized personnel.”
– 21 CFR Part 211 68(b)
211.68(b)
4

5. The Regulator’s Perspective
“When computers or automated data
p
processing systems are used as part of
g y p
production or the quality system, the
manufacturer shall validate computer
p
software for its intended use according to
an established protocol. All software
p
changes shall be validated before approval
and issuance.”
– 21 CFR Part 820.70(i)
820.70(i
5

6. The Regulator’s Perspective
“Each manufacturer shall establish and
maintain procedures for the identification,
p ,
documentation, validation or where
appropriate verification, review, and
pp p , ,
approval of design changes before their
implementation.”
p
– 21 CFR Part 820.30(i)
820.30(i
6

7. The Regulator’s Perspective
“Unlike hardware, software is not a physical
entity and does not wear out. In fact, software
may improve with age, as latent defects are
discovered and removed. However, as software
is constantly updated and changed, such
changed
improvements are sometimes countered by new
defects introduced into the software during the
change.”
– General Principles of Software Validation
7

8. The Regulator’s Perspective
“Seemingly insignificant changes in software
code can create unexpected and very significant
problems elsewhere in the software program.
The software development process should be
sufficiently well planned, controlled, and
planned controlled
documented to detect and correct unexpected
results from software changes.”
changes.
– General Principles of Software Validation
8

9. The Regulator’s Perspective
“When any change (even a small change) is
made to the software, the validation status of
the software needs to be re-established.
re-
Whenever software is changed, a validation
analysis should be conducted not just for
validation of the individual change, but also to
determine the extent and impact of that change
on the entire software system.”
– General Principles of Software Validation
9

10. The Regulator’s Perspective
“Any changes to a computerised system
including system configurations should only be
made in a controlled manner in accordance with
a defined procedure.”
– European Commission GMP Annex 11
10

11. The Regulator’s Perspective
“Data gathered during [Stage 3] might suggest ways to
improve and/or optimize the process by altering some
aspect of the process or product such as the operating
product,
conditions (ranges and set-points), process controls,
set-
component, or in-process material characteristics. A
in-
description of the planned change, a well-justified
well-
rationale for the change, an implementation plan, and
q
quality unit approval before implementation must be
y pp p
documented (§ 211.100). Depending on how the
(§
proposed change might affect product quality, additional
process design and process qualification activities could
be warranted.” – General Principles of Process Validation 11

12. Warning Letter Survey
Your firm has not established appropriate
controls over computer or related systems to
assure that changes in master production and
control records or other records are instituted
only by authorized personnel. Your firm also
personnel
fails to maintain a backup file of data entered
into the computer or related system [21 CFR §
211.68(b)].
– cGMP; Automatic, mechanical, and electronic equipment
– 23 Feb 2012 UAE pharmaceutical company
12

13. Warning Letter Survey
Changes to a product, production process,
quality controls, equipment or facilities were not
reported to FDA through a supplement, CBE-30
report to FDA or an annual report [21 C.F.R. §
601.12].
601 12]
– Biologics Licensing; Changes to an approved
application
– 15 Dec 2011 German pharmaceutical company
13

14. Warning Letter Survey
Failure to establish and maintain adequate procedures for validating
device design as required in 21 CFR 820.30(g). For example, there
were four revisions of the [redacted] shelf life environmental design
[ ] g
verification protocol. The first revision was never used, the second
revision was used at the start of the validation and the third revision
was used at the completion of the real time aging of the units and
the verification/validation of the tests. The final revision requires
h f / ld f h h f l
that the real life units be tested at x and y months. The testing that
was done was done at v and w months, instead of x and y
months.
months The testing report was reviewed and accepted by a design
cross functional group which included the project manager,
regulatory affairs, quality assurance and research and development.
– QSR; Design Controls; Design Validation
– 2 Jul 2010 US medical device company 14

15. Warning Letter Survey
Failure to establish and follow procedures for the
identification, documentation, and validation or
verification of design changes prior to the
implementation of the changes as required by 21
CFR § 820 30(i)
820.30(i).
– QSR; Design Controls; Design Changes
– 12 Aug 2009 US medical device company
g p y
15

16. Warning Letter Survey
Failure to perform design control activities and
establish Design History Files for the reusable
sharps containers, as required by 21 CFR
820.30(a) through (j). Specifically, your firm has
made several changes to the design of the
reusable sharps containers and these changes
have not been documented, and verification
and/or validation of these changes have not
been performed.
– QSR; Design Controls
16
– 30 Jan 2008 US medical device company

17. Warning Letter Survey
“You should have conducted a risk
analysis when you significantly
changed the design of the device and
added new indications for use
use”
“Device Malfunctions Lead to Surgery, Warning Letter”
The GMP Letter Dec 2008
Letter,
17

18. Warning Letter Survey
“Failure to establish and maintain written
procedures for changes to a specification,
method, process, or procedure…”
procedure…”
(warning letter dated Feb 21, 2003)
FDA Denver District Office
18

19. Warning Letter Survey
“Failure to assure that specification changes shall
be subject to controls as stringent as those
applied to the original device…”
device…”
(warning letter dated Apr 7, 1995)
Journal of Validation Technology
19

20. Developing a C a ge Co t o
e e op g Change Control
Process
Typical Change Control process:
Change Initiation
Proposal
Review
Change Planning & Assessment
Change Development
Change
g Verification
Change Release 20

21. Factors to Consider
Remember the “Control” in Change
Control
Analysis
Review and Approvals
Documentation produced by the process
Process should recognize that some
changes are riskier than others
Consider process training requirements
21

22. Questions
?
Thank
Th k you!
!
22