Right-Sized Risk-Based Deployment of a Cots Chromatography Data System

Abstract

As technology advances, computer software has taken a large position in the modern laboratory. The exponential growth of data produced in biopharmaceutical laboratories today has forced the need for moving from capturing data on paper or storing it in spreadsheets and small, non-robust databases to the need for having an automated and secure data management platform. In the November edition of the 2003 Scientific Computing & Instrumentation LIMS Guide, M. Elliott (2003) pointed out that traditionally laboratories have looked to Laboratory Information Management Systems (LIMS) to assist in managing the ever increasing information workload. In the not so distant past, these LIMS and other systems were custom systems that largely delivered every user requirement, specific to each company’s internal processes. However, new regulations and reporting requirements have stretched this model and the reality of longterm maintenance costs have brought about the integration of systems within laboratories, not only to collect data but also manage these systems in a way that insures long-term preservation and knowledge retention. This integration is not without its challenges, especially when it occurs in a heavily regulated industry such as pharmaceuticals. While there are certainly technical challenges associated with this integration, this strict regulatory environment particularly requires expensive, tedious validation of most software. Into the software validation mine field has entered the risk-based verbiage recently espoused by the United States Food and Drug Administration (FDA). This verbiage might either be the bane or panacea for an industry that is trying hard to focus on making the next block-buster drug, not on developing internal software. So, how does a large pharmaceutical company meet tightening FDA guidelines and accomplish their true drug discovery goal? The solution might be in another type of integration- namely integrating laboratory processes, risk-based software validation, and a Commercial-off-the-shelf (COTS) system. The resulting blend will nearly certainly hold more initial deployment pain for the laboratory, as the COTS system cannot be modified to completely fit the current laboratory processes. Often, however, the validation and compliance benefits might greatly outweigh the initial costs. The thesis project consisted of developing a right-sized, risk-based validation package for a COTS chromatography data system (CDS) and the subsequent deployment of the validated software. Validation included first developing a detailed risk assessment to guide right-sizing the validation effort, taking current regulatory guidance on riskbased software validation into account. This is the approach of a large pharmaceutical company that is seeking to minimize direct involvement in software development, while minimizing the significant risks that come from software, whether developed internally or by an outside vendor. This project explored the various ways risk-based validation and COTS software vendor management can reduce validation, deployment and maintenance costs, especially those associated with the testing and on-going maintenance of a COTS package.