Validation and documentation activities required for a custom-made software

[leohillman]

Hello everyone,

My company is in the process of purchasing a custom-made software from an outside vendor. The softaware will be used to collect manufacturing data required by the 21 CFR in electronic form, so it falls under part 11. Reports created using this software will be approved via electronic signature.

My question is how much documentation from the software development process I need to be in compliance with the FDA? We have created URS documentation for the software and the vendor creates functional specification and on-site validation for the software (including installation qualification of the hardware and software as well as functional testing of the software. They are not creating a traceability matrix by default. Should I require a traceability matrix? It will add price so if I can justify that it is not needed I will skip it. If I need one a good traceability matrix template wouldn´t hurt.

Feedback is highly appreciated.

[Stijloor]

In Reply to Parent Post by leohillman

Hello everyone,

My company is in the process of purchasing a custom-made software from an outside vendor. The softaware will be used to collect manufacturing data required by the 21 CFR in electronic form, so it falls under part 11. Reports created using this software will be approved via electronic signature.

My question is how much documentation from the software development process I need to be in compliance with the FDA? We have created URS documentation for the software and the vendor creates functional specification and on-site validation for the software (including installation qualification of the hardware and software as well as functional testing of the software. They are not creating a traceability matrix by default. Should I require a traceability matrix? It will add price so if I can justify that it is not needed I will skip it. If I need one a good traceability matrix template wouldn´t hurt.

Feedback is highly appreciated.

Can someone help?

Thank you!

Stijloor.

[RussKing3]

The traceabilty matrix will be important for a future auditor if and when they want to establish the successful validation of how you intend to use the system. Without the Matrix, the auditor will not be see that your intended use (defined by the URS) was actually tested (the executed qualifications). If you do not mind the risk, you do not need the matrix. If this risk is unacceptable, then it is worth the purchase.