nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Responding to requests regarding the compliance of JMP

benfrancis

Every so often I get a request to provide evidence of compliance or validation of the JMP as a software. This week we received a list of these from a procurement office of a customer; GMP, ISO numbers and even GDPR.

Previously, I responded to a GMP request with:

The quality statement can be found at jmp.com/qualitystatement.

For compliance, the use of the software in the environment is required to be validated. We have a dedicated team that may be able to provide a more in depth guidance for you to perform this process within <insert company name>, details to contact them are at the bottom of the quality statement.

I wanted to check with SAS Quality and Compliance team that this was reasonable response to other types of validation requests. Lynneth Lohse confirmed that this was the case. She also kindly directed me to all the ISO certificates that SAS has, to show we as a company complies with regulation.

I hope this helps anyone who is in this situation too. Has there been any different situations, approaches or responses in other sales teams this this type of request?

Comments

Bill_Worley

Hi Ben,

Thank you for info above. We had a request to "validate" JMP several months ago and @Byron_JMP explained why it is not necessary to validate JMP as software platform according to 21CFR Part 11. Hopefully this will be helpful to folks as well.

Maybe this will be helpful JMP and compliance with 21 CFR Part 11

Validate JMP scripts, but don’t try to validate JMP.

JMP shouldn’t be used to construct a validated database, but it can, and often is, used to analyze data from a validated database.

JMP exists outside the closed system described in 21CFR Part11.

It’s a really good idea to actually read 21CFR Part 11. If your customer is going off the rails with some issue with a pseudo-quality-regulatory crazy smell to it, you won’t know if you haven’t read the reg.

Issues like, traceability – doesn’t matter because JMP isn’t the changing, modifying or deleting records in the validated database.

Does JMP have an audit log? – nope, see answer above. JSL can perform reproducible action sets. And the JSL can be validated to preform correctly. Encrypt and password protect a validated script.

Must have a log-on and password – doesn’t’ matter because jmp is an application on the desktop of an operating system that uses some sort of authentication to start and open JMP.

Can the user modify JMP – nope, JMP is a compiled program, and we have a validation tool to verify it is a valid installation

Best,

Bill

Jeff_Perkinson

We really need to be careful about providing any advice on what customers in regulated environments need to do, or not do.

We have provided tools that can be used for Installation Qualification and Operational Qualification, and we have the information in the Quality Statement.

We need to rely on that language as it has been cleared by legal.

Please, do not give any advice beyond that.

benfrancis

Thanks @Bill_Worley and @Jeff_Perkinson, can now have a sense of confidence in dealing with these requests.

Reassuring that @Byron_JMP's logic is where I got to with a customer who was asking similar questions recently.

Byron_JMP

The points above help an IT person understand what kind of software JMP is. I can say JMP is a desktop application over and over, and over but the IT person can still misunderstand what it is, especially if they ask if it can be installed on a server. These clarifying points about how JMP is used makes it easy to check boxes on a validation risk assessment form.

All of the other boxes in the validation risk assessment forms get checked from the quality statement, numerical accuracy verification, and install validation tool.