How to validate an add-in for cGMP environment?

Phil_Kay

Hi all,

A customer in a biopharma CDMO is asking if we have any experience of validating a JMP add-in for a cGMP environment (see below). The add-in does a standard curve-fitting analysis for a given new set of data. The concern is how to protect against the end user somehow modifying the analysis.

Thanks in advance for your help.

Phil

"Have you discussed validation with other users before? I basically encrypted my addin and doing all the bits for IT to be happy with passwords and versions but when it comes to testing, we're not sure how we prove this cannot be tempered with.

Although it would be extremely difficult to modify the addin subtly to fudge the results, the user could very well delete the script in the addin and basically break it!

My script is very well protected and tracked but the addin itself is vulnerable.

We're pretty much writing just that: if the user has produced a report that matches the report in the test, then he cannot have tempered with the addin. Not sure it will fly though!

  Any advice on how to defend this bit?"

Peter_Bartell

Phil:

Here's a few thoughts for you:

1. With the thought of validation in really any regulatory or internal control environment I see two aspects:

    a. Compliance with a company's stated requirements (regardless of external influences such as a regulatory agency).

    b. Compliance with an external parties requirements (which could be different (more or less expansive?)).

So my advice to the customer is to investigate both these scenarios first. There may be some codified guidance already in place, that sound practice or not is irrelevant wrt to the compliance issue. Then the customer will have to figure out how a JMP AddIn architecture can be made compliant...let them do the heavy lifting here. Last thing I'd want to do is become the 'keeper of the validation method' for a customer...and I'm guessing SAS doesn't want to take on this role either?

Lacking a. or b. above...then the customer has free 'reign' if you will to actually write something, anything, that at least meets the spirit of 'validation' as a generalized best practice. Kind of like designing a specification AFTER the final design for a product is in place. Give yourself some wiggle room, define the operational characteristics, and how you'll actually prove compliance.