Only Commissioning Software? COTS, GAMP Category 3 Software Validation Requirements

[rina120]

Hello,
was hoping that someone could give me some advice.
i'm currently sitting in for a val manager. I'm going over the program and i see several pieces of software that have been assessed as needing commissioning and uRS's only.
These pieces of software are COTS, GAMP category 3, so while i agree they are simple, I have never had the experience of simply commissioning software. Instead, I've seen very simple IOQs, or even checklists, but they were always qualification.

Even one of the spreadsheets used (simple calculations) are listed as needing commissioning only.
Also, one more question: if the software is an indirect GMP impact, does anything need to be done aside from ensure that it is in the System register for the site?

Thanks so very much in advance!

[Stijloor]

A Quick Bump!

Can someone help?

Thank you very much!

Stijloor.

[Marc]

Another quick "Bump". My Thanks in advance to anyone who can help with this one.

[Marcelo Antunes]

I really didn't understand what you want to know.

The second question is clear - and the anser is - if the software is used inside the quality system and impacts the quality/safety o the product, it has to be validated - see for example TIR 36:2007, Validation of Software for Regulated Processes (which is being implemented as an international standard).

But what is the first question? Is it related to a medical device software (hope so because 672304 is only for medical device software, not for GMP software).

[DangerousDave]

I have a related question if someone can help.

IEC 62304 deals with software lifecycle, but is there a standard or process for validating SOUP (Software of Unknown Provenance) for a medical application. The SOUP would be the entire application, and if it helps, it would be a class 1 device.

D

[glork98]

In Reply to Parent Post by DangerousDave

I have a related question if someone can help.

IEC 62304 deals with software lifecycle, but is there a standard or process for validating SOUP (Software of Unknown Provenance) for a medical application. The SOUP would be the entire application, and if it helps, it would be a class 1 device.

D

62304 addresses use of SOUP. If your device is Class 1 then it'll be Class A in 62304. This calls for a relatively low level of software process and, specifically, verification against requirement.

I would establish the requirements and then formally test the software. Really no way around that at a product level anyways. You'll need to add the SOUP to your version control system, have discrepancy tracking, release procedures and so on.

At Class A under 62304 that you didn't write the software is almost immaterial.

[c.mitch]

In Reply to Parent Post by DangerousDave

I have a related question if someone can help.

IEC 62304 deals with software lifecycle, but is there a standard or process for validating SOUP (Software of Unknown Provenance) for a medical application. The SOUP would be the entire application, and if it helps, it would be a class 1 device.

D

Hi,
I think that using a SOUP doesn't mean that it is systematic to put it in class A. It may still be class B or C.
I agree with the process suggested oby Glork, it is coherent with what is written in the FDA's GPSV, especially the last two paragraphs of §2.3.
Using a SOUP has also impacts on risk analysis, see the guidance about Off the shelf sofware use written by the FDA.
I recommend this minimal analysis: there is surely a list of known bugs in your SOUP, you should analyse the potential hazard link to each known bug in the perspective of your intended use.

By the way, I quote FDA guidances because there is nothing equivalent in CE mark documents.

Hope it helps.

Mitch.

[meccadon2020]

In Reply to Parent Post by rina120

Hello,
was hoping that someone could give me some advice.
i'm currently sitting in for a val manager. I'm going over the program and i see several pieces of software that have been assessed as needing commissioning and uRS's only.
These pieces of software are COTS, GAMP category 3, so while i agree they are simple, I have never had the experience of simply commissioning software. Instead, I've seen very simple IOQs, or even checklists, but they were always qualification.

Even one of the spreadsheets used (simple calculations) are listed as needing commissioning only.
Also, one more question: if the software is an indirect GMP impact, does anything need to be done aside from ensure that it is in the System register for the site?

Thanks so very much in advance!

You may want to refer back to the ISPE GAMP guidances. Possibly, the one for Process Control Systems if these computerized software systems control equipment/utility components. Is there a impact/regulatory assessment documenting the indirect impact decision? Is the software documented as "regulated or unregulated"?