Help with ECR/DCR Document Change Control Software Validation

[efioamc]

Hi,

I work for a sub contract medical device company (certified to ISO13485) and subject to FDA inspections.
Some time back the company hired an external consultant to develop a database that we could use to replace out manual system of ECR/DCR ? Document change controls. E.g. the system is used to control documentation and changes to all documentation through a defined process.

It is Web-based user interface and SQL Server database with ability to generate in-house reports in MS Access.

My problem is that we initially requested the developer to provide objective evidence of the software being validated. The request is ongoing and the person involved has stated they complete ?ad-hoc? testing, nothing is recorded/documented. He has finally agreed to send us on something but basically is asking us to provide the documentation and he will fill it out.

My question is ?. Where do I begin?
This seems to have landed on my desk and there doesn?t appear to be any user requirements etc. He was basically shown the ?hard copy? version of the system/process we use and told that we wanted a system that replicated these items.

Many thanks ..

 

[JoeDM]

Re: Help with software validation

Since you have no requirements, I would start by documenting what the software actually does, essentailly reverse engineering the requirements.

If you don't have the source code, you can write manual scripts that define tests that demonstrate what the software is expected to do, and then run the tests, verifying that the software does what is expected. Documenting the test and the test results, validates the software.

If you have the source code you may be able to write unit tests that test various code segments to see if they do what is expected.

Hope it helps.

 

[efioamc]

Re: Help with software validation

We dont have the source code, thanks for your response and help though!

 

[sagai]

Re: Help with software validation

I have found useful to look into AAMI TIR36:2007.
It costs some money to purchase, but gives a wee more concise view than GAMP.

My sidenote would be that I am not pretty certain that you are subject to FDA inspection, but that was not the purpose of your post.

Cheers!

 

[efioamc]

Hi Sagai, just to clarify, although off topic as you say we are a sub contract manufacturer for our OEM. There is the possability we could be audited if they first visited our OEM and then found that the parts are manufactured with us?

 

[sagai]

What I am reading in the QSR itself is

Sec. 820.1 Scope.
(a)Applicability.
...
This regulation does not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to use appropriate provisions of this regulation as guidance. ...

So, what requirements would they use to chase you?
You do not even have to be registered at FDA ...

 

[yodon]

Re: Help with software validation

Since you have no requirements, I would start by documenting what the software actually does, essentailly reverse engineering the requirements.

If you don't have the source code, you can write manual scripts that define tests that demonstrate what the software is expected to do, and then run the tests, verifying that the software does what is expected. Documenting the test and the test results, validates the software.

If you have the source code you may be able to write unit tests that test various code segments to see if they do what is expected.

Hope it helps.

Excellent advice from JoeDM! Setting the foundation is absolutely critical in validating a product. I would add that you should also, in parallel, start a Validation Plan. That will help guide you through the validation process.