Change Control for Software System that Controls Aspects of GMP

K

Kymmie

#1
Good morning everyone,

We are in the middle of validating a new software program that will handle many aspects of our business. The software is NOT a device. It is a cloud based ERP w/CRM with inventory control management. It is customizable/configurable. My question is this... as we move forward (once the system is validated/up and running) what is the best method for me to track changes to the system? I have been advised that I can use my Engineering Change Order to do this, but I felt it was worth running this by the great minds here first to get some input. Thanks for your help!

~Kymmie
 
Elsmar Forum Sponsor

yodon

Leader
Super Moderator
#2
I (personally) would need to know more before weighing in.

Is your company developing and deploying the system or are you purchasing a system?

Who is doing the customizations / configurations?

Is the system deployed on your server and the data in the cloud or is the entire system deployed in the cloud (e.g., Software as a Service)?

What kind of change tracking are you looking to do? Changes to the system -v- changes to the customizations / configurations? Who will implement the changes?

Those answers would give me a clearer picture of the system and allow a better response.
 
K

Kymmie

#3
yodon, Thanks for the response! My answers are below.

Is your company developing and deploying the system or are you purchasing a system? We have purchased the system.

Who is doing the customizations / configurations? Our IT is doing the customizations. However, so far she is not writing script. She is using vendor-provided tools to write workflows, scripting, and "enabling" different features (an on/off ability). There are also apps that are made for this program that we may be "adding on" to the system. She states that she might write script in the future but very possibly not - the system is made to be easily configured.

Is the system deployed on your server and the data in the cloud or is the entire system deployed in the cloud (e.g., Software as a Service)? Entire system is deployed on the cloud.

What kind of change tracking are you looking to do? Changes to the system -v- changes to the customizations / configurations? Who will implement the changes? I believe that we should track ALL changes that might in any way affect they parts of the system that affect GMP (inventory management, training records, point-of-use for current document revs, etc.) These should all be just changes to customizations/configurations or implementation to new ones. IT is responsible for doing these, I am responsible for tracking them.

Those answers would give me a clearer picture of the system and allow a better response.
Thanks again for your help - I very much appreciate it.

As another note, (not sure how much difference it makes) we do not expect any of these changes to be drastic once the system is "turned on". It will be tweaking of the system to make it more efficient once we get used to it and have ideas that could make it more user-friendly (i.e. one "customization" we have done is to add a place in each item file to attach MSDS sheets and 510ks for reference).

We are an initial importer and repackager/relabeler of medical devices class II.

~Kymmie
 

yodon

Leader
Super Moderator
#4
yodon, Thanks for the response! My answers are below.

Is your company developing and deploying the system or are you purchasing a system? We have purchased the system.

Who is doing the customizations / configurations? Our IT is doing the customizations. However, so far she is not writing script. She is using vendor-provided tools to write workflows, scripting, and "enabling" different features (an on/off ability). There are also apps that are made for this program that we may be "adding on" to the system. She states that she might write script in the future but very possibly not - the system is made to be easily configured.

Is the system deployed on your server and the data in the cloud or is the entire system deployed in the cloud (e.g., Software as a Service)? Entire system is deployed on the cloud.

What kind of change tracking are you looking to do? Changes to the system -v- changes to the customizations / configurations? Who will implement the changes? I believe that we should track ALL changes that might in any way affect they parts of the system that affect GMP (inventory management, training records, point-of-use for current document revs, etc.) These should all be just changes to customizations/configurations or implementation to new ones. IT is responsible for doing these, I am responsible for tracking them.

Those answers would give me a clearer picture of the system and allow a better response.
Thanks again for your help - I very much appreciate it.

As another note, (not sure how much difference it makes) we do not expect any of these changes to be drastic once the system is "turned on". It will be tweaking of the system to make it more efficient once we get used to it and have ideas that could make it more user-friendly (i.e. one "customization" we have done is to add a place in each item file to attach MSDS sheets and 510ks for reference).

We are an initial importer and repackager/relabeler of medical devices class II.

~Kymmie
Ok, so you have many things going on here. There is the 'base' software (and probably things like integrated database packages) that you are purchasing (and can change outside of your control), there are the servers where the system is running / data is stored (which can change outside of your control), and there are the customizations / configurations which can change (but are in your control). All these factor into maintaining the system in a validated state.

The short answer to your question is that whatever system to track changes to the customizations that works for you is best for you. If you're comfortable with the ECO system, then it's a perfectly acceptable solution.

I would recommend taking a more abstract view of "system changes" rather than focusing on scripts. All those changes you mention (either facilitated through tools, etc.) really ought to be captured in some kind of 'requirements' and/or 'design' description(s). That will facilitate change tracking for those (non-scripted) changes / customizations.

The reason I asked all the questions is that there are a lot of potential changes that may occur that you can't track but are still potentially impacting the system. You should have a periodic review (you define the period) to assess current system status and determine if any subsequent re-validation is required to address changes made outside of your control.
 
K

Kymmie

#5
yodon,

I really appreciate your answer, and I'm happy to say that I understand what you're saying :D

I think that is a great way to approach the issue. We are going to have a mtg. this week to discuss change control and write an SOP for how we are going to go about it. An initial consultation with IT seems like she is on board with your idea as well.

Thanks a ton!
~Kymmie

:thanks:
 
Thread starter Similar threads Forum Replies Date
N ISO 13485 7.3.9 Change control in medical device software ISO 13485:2016 - Medical Device Quality Management Systems 6
R Software change control process and defect tracking ISO 13485:2016 - Medical Device Quality Management Systems 1
R SaMD - Software as a Medical Device - Software change control form ISO 13485:2016 - Medical Device Quality Management Systems 3
C Change Control Forms Post Software Validation Medical Information Technology, Medical Software and Health Informatics 2
E Help with ECR/DCR Document Change Control Software Validation Qualification and Validation (including 21 CFR Part 11) 6
L Engineering Change Control Software Systems - Recommendations? Document Control Systems, Procedures, Forms and Templates 2
K Software Device "Urgent" Releases? Software Change Control Process IEC 62304 - Medical Device Software Life Cycle Processes 9
J Software change control - How should I be controlling software changes? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
A Enterprise change management control system software - Medical Devices Quality Assurance and Compliance Software Tools and Solutions 0
G Change Control for Test Samples Inspection, Prints (Drawings), Testing, Sampling and Related Topics 3
Z Change color or shape of individual data point in control chart Using Minitab Software 6
N Change Control for processes & products Manufacturing and Related Processes 7
Quality Specialist Change Control Numbering system Document Control Systems, Procedures, Forms and Templates 7
M Change control on Tracking Sheet ISO 13485:2016 - Medical Device Quality Management Systems 11
H Control of Change i.e. process and WI IATF 16949 - Automotive Quality Systems Standard 9
D Engineering Change order vs. Change Control ISO 13485:2016 - Medical Device Quality Management Systems 3
D GAMP CAT 5 Change Control Qualification and Validation (including 21 CFR Part 11) 9
J Need Change Control Yes/No Decision Tree Template ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
E Change in control plan - Do I have to do sampling? IATF 16949 - Automotive Quality Systems Standard 1
A UDI and Design Controls - Labeling change via the Design Control process 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
D Change Control - Product Name Change and its associated labeling EU Medical Device Regulations 7
U Change Management vs Change Control? Design and Development of Products and Processes 4
Y Informational Change control process - Major vs Minor change - Active class III medical devices ISO 13485:2016 - Medical Device Quality Management Systems 13
T Change control and configuration management - When to create a new model/part number? Other Medical Device and Orthopedic Related Topics 0
JoshuaFroud Change Control - Minimum Requirements and Unhappy Staff ISO 13485:2016 - Medical Device Quality Management Systems 16
N Change Control - Compliance with FDA 21 CFR Part 820 Document Control Systems, Procedures, Forms and Templates 3
A Can change control can be closed if the CAPA is still open? Nonconformance and Corrective Action 3
S DHF File Change Control Requirements 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
C Medical Device Website Change Control ISO 13485:2016 - Medical Device Quality Management Systems 3
Y Change Control - General Processes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
S Change Control Form vs. Document Change Notification ISO 13485:2016 - Medical Device Quality Management Systems 3
B IATF 16949 Clause 8.5.6.1.1 (Temporary Process Control Change) IATF 16949 - Automotive Quality Systems Standard 25
R Does anyone have any experience on change control? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
E Challenges in document control, revisional control, and change control Document Control Systems, Procedures, Forms and Templates 8
E Control Plan Contents - Part Number / Latest Change Level FMEA and Control Plans 2
M Document Change Control for a Very Small Business Document Control Systems, Procedures, Forms and Templates 12
S How to connect NCMR, Deviations and Change Control ? Nonconformance and Corrective Action 2
V Can Regulatory Head Initiate/Trigger the Change Control for Quality Procedures US Food and Drug Administration (FDA) 9
T Change Control Requirements when changing Suppliers IATF 16949 - Automotive Quality Systems Standard 4
drgnrider How to control documents that most likely won't change ever ? Document Control Systems, Procedures, Forms and Templates 5
T Paper Quality Manual Change Control Methods Quality Management System (QMS) Manuals 5
A Company Name Change & Control of Documents Document Control Systems, Procedures, Forms and Templates 9
L Use of checksum(s) to control product change(s) Misc. Quality Assurance and Business Systems Related Topics 1
T Searching for books which have content of 7.1.4. Change Control topics Book, Video, Blog and Web Site Reviews and Recommendations 2
C Change Control in a SCRUM World Misc. Quality Assurance and Business Systems Related Topics 3
J Change in our SharePoint Document Control Process - Is this ok? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
S Is it possible to have a General Change Control SOP and Form? Document Control Systems, Procedures, Forms and Templates 6
H Blood Banking (CFR 21 PART 606) Change Control Requirements US Food and Drug Administration (FDA) 8
J ECO (Engineering Change Order) Control for Unreleased Products Document Control Systems, Procedures, Forms and Templates 3
A Change Ratio [Guideline in Control Limit Update] Statistical Analysis Tools, Techniques and SPC 3

Similar threads

Top Bottom