Process Validation of QMS Software ISO 13485: 2016 Cl. 4.1.6

Ajit Basrur

Staff member
Admin
#11
If anyone is interested, we found a company that specializes in SW Validation. Their name is Ofni Systems in Raleigh, NC. Their prices are very reasonable for what we needed done for a few spreadsheet validations, at least compared to another quote we received. We just aren't staffed with resources to get these done in time for our certification audit.
Are you connected with the service provider that you mentioned?
 
Elsmar Forum Sponsor
A

Aikidoka

#12
"Next year we get an ERP. The manufacturer will validate the software! EXPENSIVE!!! But necessary."

When we were given our 13485 audit at the beginning of May 2018, our auditor told us specifically that we couldn't use the ERP manufacturer's validation as it didn't encompass our intended and specific use. The ERP validation, as he saw it, could not assess the risks to our business and customers should the system fail, therefore any validation on their part was insufficient.

Might I ask where you got the information from? I've been looking all over for more information as we have a lot of systems as well as an ERP. My manager and myself are trying to tackle it and it just seems like a mountain of work. If we can use the ERP's validation and provide documentation or something, that would be amazing.

Thank you!
 

mihzago

Trusted Information Resource
#13
To comply with Part 11 requirements, your company must implement a number of procedural controls, so a manufacturer of the ERP or any other system cannot do that for you (well... you could outsource that to them, but still these procedural controls must be specific to your company).

Further, you must determine what the business needs are (e.g. user requirements), which then you have to demonstrate that these needs are met by the system you purchase (i.e. system validation). Again, something you must do, or someone specifically contracted to do it for you.

Having access to the vendor's validation documentation goes a long way, because you don't have to repeat that testing yourself.
 
#14
On reading this thread I went back to the standard. To quote 4.1.6...
...shall document procedures for the validation of the application of computer software...
So, it is how the software is used in your company that is important. This may mean that, for example, you do not need to validate Excel but you do need to validate the formula and macros that you use.
 

yodon

Staff member
Super Moderator
#15
When we were given our 13485 audit at the beginning of May 2018, our auditor told us specifically that we couldn't use the ERP manufacturer's validation as it didn't encompass our intended and specific use.
Mihzago's and Pads38's answers are correct. I thought a concrete example might be helpful.

All ERP systems implement some level of security / access controls to limit access / operations by roles. You could set a system up where everyone has 'admin' access. This would be totally contrary to the way the manufacturer intended and would be non-compliant with Part 11. So, indeed, demonstrating that the system *as deployed* meets your user needs / intended use cannot rely on the manufacturer's validation. Where there's specific functionality that cannot be influenced by the installation / setup, you can cite the manufacturer's testing.

Leverage what you can but recognize where you can't.
 
A

akoiscurious

#16
This is really not that trivial!

We had our 13485:2016 certification audit a few weeks ago, and already implemented the software validation issue. We wrote a SOP "Validation of QMS software", which includes 3 forms: validation log, validation plan, validation report. On the log we list all software we think can have an impact on the QMS and/or product safety. As we have production/manufacturing outsourced, we have only some software packages on the log.

The log is a spreadsheet with the colums:

- ID number
- Software name/version/date
- Description (what does the software do)
- Failure mode(s) (what could go wrong)
- Validation required (yes/no)
- Rational for validation decision
- Software validation report available (yes/no)
- Software released for everyday use (yes/No)
- Decision made date /by

If validation is required, a validation plan is prepared - how to validate the software. If the validation is finished, the validation report is prepared, and the log is updated.

Currently we have only three different software packages on the log - our QMS is still paper-based, that makes it simple. We have a data logger for a storage room for products (temperature/humidity), excel spreadsheets with home-brewed algorithms, and a statistical software for number needed to treat calculations for clinical study planning.

For excel we use the FDA recommendations (I will write a work instruction for our personnel), the statistical software (G*Power) does not need validation as all algorithms are already validated by the manufacturer (take a look on the manual), and the data retrieval software of the data logger needed validation (is the retrieved logged data similar to the true environmental conditions).

Next year we get an ERP. The manufacturer will validate the software! EXPENSIVE!!! But necessary.

Hope this helps!
Hi, do you have an example of the template? was wondering, we just had an audit last week, and the auditor told us that if we decide that no validation needed somehow its hard to justify. the auditor recommend that even if its low, we still need to do some validation depends on how extensive the validation that needs to be done. they want us to show that our decision will based on risk analysis.
 

Wolf.K

Quite Involved in Discussions
#17
Hi, do you have an example of the template? was wondering, we just had an audit last week, and the auditor told us that if we decide that no validation needed somehow its hard to justify. the auditor recommend that even if its low, we still need to do some validation depends on how extensive the validation that needs to be done. they want us to show that our decision will based on risk analysis.
Which template do you mean?
 

Wolf.K

Quite Involved in Discussions
#19
Ok, I am not allowed to post our SOPs here, but I have a snippet:

1.1 Follow this procedure when there is a need to validate software within the scope of our medical device quality management system.

1.2 For each software, it is required to answer the following questions; a “yes” answer to any of the questions identifies software that is required to be validated and is within the scope of this document:

1.2.1 Could a failure or latent flaws of the software affect the safety or quality of medical devices?

1.2.2 Does the software automate or execute an activity required by regulatory requirements (in particular, the requirements for medical device quality management systems)?

1.2.2.1 Examples are:

1.2.2.1.1 Capturing of electronic signatures

1.2.2.1.2 Capturing of electronic records

1.2.2.1.3 Maintaining product traceability

1.2.2.1.4 Performing and capturing test results

1.2.2.1.5 Maintaining data logs such as

CAPA

Non-conformances

Complaints

Calibrations

Storage room environmental monitoring

1.2.3 Note: At times it can be difficult to determine whether a process and corresponding software are part of the quality system. Carefully consider the circumstances to completely understand the impact of the failure of the software on the processes and, ultimately, on the safety and efficacy of any manufactured medical device. If in doubt, the best approach is to consider the software as in scope of this procedure. If necessary, document the decision making process. Check the examples in ISO/TR 80002-2 for comparison.

1.2.4 Note: Validate against the intended purpose depending on the process sequence. A “black box” approach, like acceptance testing and functionality testing with the readily installed software, including end user involvment, is sufficient to fulfill the requirements.

1.3 The life cycle of software used for medical device quality management systems is divided into three phases:

1.4 (A) Development
...
1.5 (B) Maintenance
...
1.6 (C) Retirement...

1.7 Note: For further information consult ISO/TR 80002‑2 (2017)
 

JoshuaFroud

Involved In Discussions
#20
I cannot recommend purchasing a copy of "ISO/TR 80002-2:2017 Medical device software - Part 2: Validation of software for medical device quality systems" more. I went from wild-eyed panic to writing a fairly comprehensive SOP and set of software evaluation forms that allowed us as a business to review and assess our software.

It also has a huge amount of helpful information regarding what level of validation could/would be required, and how to apply it.
 
Thread starter Similar threads Forum Replies Date
N Sterilization Protocol Change in Validation Process and further impacts ISO 13485:2016 - Medical Device Quality Management Systems 1
R PCBA process validation Qualification and Validation (including 21 CFR Part 11) 2
S Sterilization validation after changing sterilization process provider Qualification and Validation (including 21 CFR Part 11) 3
D Questions regarding process validation ISO 13485:2016 - Medical Device Quality Management Systems 6
A Validation of Forced Aeration Process ISO 13485:2016 - Medical Device Quality Management Systems 3
T ISO 13485 - Process validation at critical suppliers ISO 13485:2016 - Medical Device Quality Management Systems 7
K Software Validation for Measurement Tools used in Process Validation ISO 13485:2016 - Medical Device Quality Management Systems 2
P Design verification driven by new equipment. How is this different than process validation? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
Stoic Are any medical device companies using the 2011 FDA process validation guidance instead of GHTF/SG3/N99-10:2004? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
G Devices from IQ, OQ or PQ process to be used for verification, validation and summative? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 5
N Design Verification & Process Validation - Statistical sample sizes Design and Development of Products and Processes 2
E Equipment Qualification - IQ/OQ per ISO 13485:2016 section 7.5.6 Process validation ISO 13485:2016 - Medical Device Quality Management Systems 7
B API Q1 5.7.1.5 Process Validation - Machining, heat treating, Manganese Phosphate and Zinc Plating Manufacturing and Related Processes 2
N Validation procedure, Major NC CAP - Equipment Validation process is not effective ISO 13485:2016 - Medical Device Quality Management Systems 5
D ISO13485:2016 7.5.6 Process Validation Responsibilities ISO 13485:2016 - Medical Device Quality Management Systems 1
Z Who is responsible for writing the validation of a new process? Manufacturing and Related Processes 7
M Requirement for manufacturing process validation in IATF 16949 IATF 16949 - Automotive Quality Systems Standard 8
E Sampling plan for orthopedic implant - Process Validation Inspection, Prints (Drawings), Testing, Sampling and Related Topics 4
Z Class 2 medical device - Process Validation - Test sterile or non-sterile units? Qualification and Validation (including 21 CFR Part 11) 4
T ISO 13485:2016 - Processes exempt from process validation ISO 13485:2016 - Medical Device Quality Management Systems 12
L Injection Moulding Process (Special Process) Validation Food Safety - ISO 22000, HACCP (21 CFR 120) 2
K Is Mold qualification / process validation always required? Manufacturing and Related Processes 7
R Process Validation on CNC Lathe and Milling machining process Design and Development of Products and Processes 1
Q Release of the first batch of a cleared product before process validation 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 4
R Process Validation sample size selection Statistical Analysis Tools, Techniques and SPC 0
P Auditing "process validation" process 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
E Cleaning Validation Process of Non-Sterile Implants and Instruments Other Medical Device Related Standards 2
W Design and Process Validation - Different? ISO 13485:2016 - Medical Device Quality Management Systems 6
A Supplier - Process Validation Manufacturing and Related Processes 3
M Medical Device Process validation, Validation of excel spreadsheets used for process Other Medical Device and Orthopedic Related Topics 4
V Tyvek packaging for Medical device process validation Qualification and Validation (including 21 CFR Part 11) 2
L Process Definition and Process Validation 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
S Can we sell units that were chosen for process validation? ISO 13485:2016 - Medical Device Quality Management Systems 6
S How do I do a Process Validation for soldering process Manufacturing and Related Processes 5
S Process validation when changing location ISO 13485:2016 - Medical Device Quality Management Systems 10
P Root Cause for a Process Validation Batch Failure 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
GoSpeedRacer Validation of Processes 7.5.6 - Do cosmetic welds need process validation? ISO 13485:2016 - Medical Device Quality Management Systems 3
A Is Aeration Process in ETO Sterilization Validation Required? Manufacturing and Related Processes 7
C Does Japan accept the Bracketing Approach for Process Validation Japan Medical Device Regulations 1
A Robotic Sanding and Painting Process Validation Manufacturing and Related Processes 5
alonFAI Gamma Irradiation Process Validation Help Other Medical Device Related Standards 2
J Where does process validation fit within design & development? Design and Development of Products and Processes 7
O Process Mapping prior to Validation and Software to use to Map Process Maps, Process Mapping and Turtle Diagrams 12
M Justification for Not Having a Validation Plan for a Critical Process ISO 13485:2016 - Medical Device Quality Management Systems 4
alonFAI PCBAs Process Validation Help (Regulations FDA) Manufacturing and Related Processes 2
M Is Validation an ongoing process? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 4
K What are the minimum requirements for Process Validation (Software)? ISO 13485:2016 - Medical Device Quality Management Systems 5
P Process Validation of inherited tooling by Contract Manufacturer ISO 13485:2016 - Medical Device Quality Management Systems 4
L GHTF/SG3/N15R8 - Process Validation and Risk Analysis ISO 13485:2016 - Medical Device Quality Management Systems 4
R TS 16949 Process Re-Validation Frequency Requirements IATF 16949 - Automotive Quality Systems Standard 3

Similar threads

Top Bottom