Controlling software and Data - Control of Information maintained in computers

[Dawn]

I have been told by the auditor that if we have information maintained in computers how is it controlled? We have work instructions for backing up the computers. Do we need anything else? (Lost)

[Roger Eastin]

Are your electronic information, records or documents (level 3)? You probably need to supply some more details as to what kind of information you are talking about. If it is level 3 information, then standard control procedures must be followed per Element 4.5. However, if the information is records then it must follow your procedure for quality records. The type of media that you use, whether paper or electronic, has to follow your standard procedures. Now, if you are talking about software that is used in some sort of process (NC machines, maintaining quaity records with some sort of database, etc.), then you, as you have stated, have to provide a system for backing up this software on a regular basis.

[Marc]

Now, if you are talking about software that is used in somesort of process (NC machines, maintaining quaity records with some sort of database, etc.

How about Change History?

[Roger Eastin]

Are you referring to the Change History of the software itself or of the data that the software uses? Most times the change history of the former case is maintained by the folks who wrote the software and I suppose that access to that history may be needed, for instance, to determine if a company needs to upgrade that software. If you mean the latter case, then I agree that a change history is needed (per 4.5) by the company inputting the data.

[Marc]

Change history of the software - not the data.