Listed below are some of the key challenges faced by pharma companies with the current computer systems validation (CSV) methodology:

• Enforcing a common validation protocol for different types of software systems (Standalone, mobile, cloud, database, SaaS, etc.)
• Emphasis on extensive documentation because every function in the system gets misinterpreted to be a direct or indirect risk.
• Incorrect assumption that the volume of test scripts correlates to an increase in value of validation.
• Focus on discovering software defects is overshadowed with the findings in document deviation errors.
• Lack of Risk and Compliance oversight after system deployment with the incorrect assumption that CSV is a one-time process.
• Inconsistencies in CSV lifecycle change management.

In the current era of rapid digital transformation, FDA wants to encourage the use of advanced technology for automation and leverage powerful information technology and data solutions to significantly reduce errors and increase quality and assurance in software development and testing.

As software development and testing methodologies have evolved tremendously, the FDA plans to introduce a new paradigm called ‘Computer Software Assurance’ or CSA for executing all types of software and medical device validation in the pharma industry.

What made FDA to introduce the concept of CSA? What are the key drivers?

The FDA and CDRH (Centre for Devices and Radiological Health) formulated the ‘Case for Quality’ program in 2011 following evaluation of statistical data and advice from both the FDA and industry stakeholders. The FDA’s analysis recognized prevalent manufacturing risks that impact product quality and patient health. Thus, FDA felt the need for the introduction of CSA with a prime focus on Quality by treating compliance attainment as the baseline and considering the inclusion of critical-to-quality practices that result in higher-quality outcomes.

The program’s focus on computerized systems has increased in recent statements related to the Case for Quality, and the CDRH has also indicated its plan to release guidance on the topic of computer system assurance (CSA).

Key Drivers for the introduction of CSA by FDA:

• Focus on Patient / Product Safety and Quality: Use the risk-based validation approach to computerized systems that focus on product quality and patient safety by applying critical thinking.
• Change Mindset from Volume to Value: With the combination of unscripted testing, leveraging supplier documentation, and implementing continuous assurance monitoring, reduce the overall effort spent in generating a huge volume of scripted validation documentation.
• Keep it Lean and Adaptive: Introduction of intelligent, automated processes that monitor and record manufacturing quality metrics, incorporating features and technological characteristics that can contribute to better options and higher quality that achieves their clinical purpose.

What are the principles of CSA?

As per FDA’s forthcoming guidance announcement, the new Computer Software Assurance (CSA) process is primarily focused on identifying intended use of the medical device or software system, checking its impact on patient / product safety and quality, identifying related risks, applying critical thinking and assurance needs, then finally execute testing and generate assurance documentation.

Pharma companies and device manufacturers are expected to provide a higher degree of assurance by applying critical thinking across system functions, business processes and mitigating all related risks that directly impacts patient safety, product quality, and data integrity.

The key to CSA is that recognition is given for all testing, including:

• Supplier testing during the system development lifecycle should be leveraged for system software assurance.
• Unscripted testing is testing without written test step instructions which classically relies on the tester’s experience to create test cases vigorously.
• Limited scripted testing should be used for medium to high risks, with anticipated outcomes and a sign of pass/fail.
• Robust scripted testing must be used for verification of high-risk functionality, as determined by critical thinking and risk assessment, and requires pre-approved test protocols used in CSV.

Techsol’s Perspective towards CSA

Based on our CSV experience and knowledge gathered around this new paradigm, ‘Computer Software Assurance’ should be a continuous process that provides an assurance that a software system used in a GxP function can meet the key quality attributes and applicable GxP regulations with qualitative and quantitative measures that are directly or indirectly related to patient safety and product quality.

Our understanding of CSA is depicted in the following illustration based on the key learning’s from past projects, common challenges faced by clients, and leveraging modern technology to establish lean validation.