How to validate an add-in for cGMP environment?Hi all,
A customer in a biopharma CDMO is asking if we have any experience of validating a JMP add-in for a cGMP environment (see below). The add-in does a standard curve-fitting analysis for a given new set of data. The concern is how to protect against the end user somehow modifying the analysis.
Thanks in advance for your help.
Phil
"Have you discussed validation with other users before? I basically encrypted my addin and doing all the bits for IT to be happy with passwords and versions but when it comes to testing, we're not sure how we prove this cannot be tempered with.
Although it would be extremely difficult to modify the addin subtly to fudge the results, the user could very well delete the script in the addin and basically break it!
My script is very well protected and tracked but the addin itself is vulnerable.
We're pretty much writing just that: if the user has produced a report that matches the report in the test, then he cannot have tempered with the addin. Not sure it will fly though!
Any advice on how to defend this bit?"
Re: How to validate an add-in for cGMP environment?Thanks, Martin.
I agree.
Regards,
Phil
Re: How to validate an add-in for cGMP environment?Hi Phil,
one thing to consider for validation is always a (sub)version control system which keeps track of changes and saves the files on a seperate server . This is close to what Malcolm said, just more sophisticated for longer time use, as in regulated environments you need to create versions as well you want to improve things or create subversions of your code, this has to be tracked on one side, but more important you often have the requirement even after tens of years (e.g. in aero or space industry) to be able to get exactly the same routine you have used for a specific validatied application.
Now you definitely don't want to share the source code with the add-in to the end user, nor the path information (as editable text). There your encription should prevent that.
Unfortunately I see too often (my point of view) validation requirements but without using version control systems. Version control systems assure in addition using redundant server systems backup properties in case of any outage or system fail.
Regards,
Martin
Re: How to validate an add-in for cGMP environment?Thanks, Malcolm.
That’s a really good idea.
Regards,
Phil
Re: How to validate an add-in for cGMP environment?HI Phil,
If your customer is concerned about the risk of addin code being changed then an alternative would be to create a custom menu that accesses a jsl file on a share drive that users have read access to. That way users cannot change the source jsl file.
Malcolm
Re: How to validate an add-in for cGMP environment?Thanks, Peter.
Yes, we (JMP) absolutely don’t want to have any responsibility for the validation.
Just looking to hear how other customers have managed this requirement. I know this particular customer is very sensitive about validation of software.
Thanks for your comments.
Phil
Re: How to validate an add-in for cGMP environment?Phil:
Here's a few thoughts for you:
1. With the thought of validation in really any regulatory or internal control environment I see two aspects:
a. Compliance with a company's stated requirements (regardless of external influences such as a regulatory agency).
b. Compliance with an external parties requirements (which could be different (more or less expansive?)).
So my advice to the customer is to investigate both these scenarios first. There may be some codified guidance already in place, that sound practice or not is irrelevant wrt to the compliance issue. Then the customer will have to figure out how a JMP AddIn architecture can be made compliant...let them do the heavy lifting here. Last thing I'd want to do is become the 'keeper of the validation method' for a customer...and I'm guessing SAS doesn't want to take on this role either?
Lacking a. or b. above...then the customer has free 'reign' if you will to actually write something, anything, that at least meets the spirit of 'validation' as a generalized best practice. Kind of like designing a specification AFTER the final design for a product is in place. Give yourself some wiggle room, define the operational characteristics, and how you'll actually prove compliance.
