Accredited Calibration Sevice Provider using computerized system to issue calibration certificate

[mariak]

Hi all,
I have a following question: We are a accredited calibration service provider (17025 certified), we use internally developed software to produce calibration certificates for our customers.

As calibration records are GxP records for our customers, calibration certificates are GxP records, so our internal system hosting the data used to produce the certificate must be validated.

1. Is Calibration certificate a raw data? Or data used to produce the certificate is raw data which needs to be retained? What is expected from us by the regulated customers in regard to record retention?

2. As this is not COTS software does it fall under GAMP cat. 5 software and require the expanded validation effort? My concern is that as this is an internal SW, we have the opportunity and also need to be able to deploy new versions like patches and bug fixes asap. After major releases we had times where we installed new SW patches weekly, or sometimes even twice a week. We must ensure that SW Validation and mainly IQ will not slow this down or increase effort/costs.

Many thanks for sharing your thoughts on this topic.

 

[Gus]

Not knowing what GxP or COTS or GAMP means i would say two things

You HAVE TO retain the certificates as Technical records (7.8.1.2) and while the standard only states you should keep them for a period consistent with its contractual obligations, confidentiality commitment etc; it does help when it comes to validating your system to keep (at least your validation raw data) for a larger period of time.

i don't really know how your system works but i can imagine the following is possible.

do an initial validation of your software results for Calibration certificate "X", then run the same process on pen and paper or any other method that suits the validation requirement

next time you perform a software update there´s 2 things that can help you out
1) a change log. where it is clearly stated that the upgrade is not impacting the results (for example security update...)
2) recall "Cal cert X" raw data on your updated system and process or print out the result sheet again, verify uncertainties, errors etc. and file it somewhere, keep that record, it shouldn't be too much of a hassle,

 

[Alex Kennedy]

I write only in regard to persons working within FDA 21 CFR Part 11 requirements.

Sounds very much as though you are in a precarious state. You admit that you understand that the calibration certificates are "critical data", yet you are holding them in a “state” from which they can be readily accessed and subjected to inadvertent manipulation or even deliberate falsification.

cGMP legislation mandates that all critical data must be protected from such abuse.