Qualification of AzureDevOps in Gxp

#1
Dear colleagues,

We have the possibility to use Azure DevOps as a tool to develop software in compliance with the Agile methodology.
The tools is a cloud based, Software as a service (SaAS) fully developed by Microsoft.
It provides services to:
1. store the code
2. setting up automated tests (pipelines) that are triggered whenever the code is changed
3. some more stuff which we do not use

While developing a GxP IT system, our developers used the tool because is just so easy to maintain the code there.

Now that we have to validate the system, we are asking ourselves how should we approach the validation of the tool.
Should the tool be validated? How much?

Of course we know that since it is a GxP system the code container must comply with regulations ans roles and responsibilities must be documented as well as all the rest of the Gamp 5 deliverables.
On the other side, it's a OutOfTheBox system that it should be fully tested by Microsoft.

What is your take on this?
 
Elsmar Forum Sponsor

yodon

Staff member
Super Moderator
#2
...it should be fully tested by Microsoft.
That's a good one! ;-)

In general, for IDEs, I don't support doing too much in the way of qualification. When we host, I will typically do a small installation qualification like thing to ensure that it's installed on equipment which the vendor supports. It's probably a good idea also to look at their known issues list and ensure (document why) you're not going to be affected. I've never been on the operational or functional qualification bandwagon since you'll never test all potential code combinations and you're already going to be doing testing of your code.

I don't know the extent of what all AsureDevOps provides. You indicate it stores the code so access control (security) should probably be considered (and I typically roll that into my IQ work - showing I have the proper security controls established and operational). If other functions like tracking code changes (configuration management), you may want to do some things there to give yourself assurance that it meets your needs (and regulatory requirements). If you're using the automated test results as part of, say integration testing (per 62304), you may want to do something for ensuring records are properly safeguarded and maintained. Most qualification / validation work needs to start with requirements (your intended use) so it's probably a worthwhile exercise to establish them.

As with any software to support the processes, you'll want to make (and document) your decisions based on risk. (I think the fact that you'll test your code to give assurance of correct operations is a major risk mitigation!) I always recommend starting with a Validation Master Plan to give you that foundation for risk consideration.

Being in the cloud, you always have the issue of the provider changing the system without your knowledge. That poses a big issue in the device space as anything you do for qualification could be obsolete the next day. You'll want to have a plan to periodically review the version in use and determine if anything (probably looking at the issues resolved and any new known issues at a minimum) warrants further action.
 

mihzago

Trusted Information Resource
#3
First, software validation is not limited to testing, on the flip side, testing may not always be required for validation.
Many people think of validation in terms of testing (re-testing) all software functions and features. As you noted, Microsoft has presumably already performed the tests, and it's been used by potentially large number of customers. For some, that may be sufficient evidence to reduce or even eliminate testing.
What you should instead focus on, is to define your requirements (aka user needs) and check whether the software meets them.
Determine and analyze the scope, complexity, intended use, and analyze the risks to determine the impact of failures or if the software does not meet your requirements. Document this analysis. Evaluate the vendor and see if you can get your hands on any of their verification or validation documentation; some companies provide certificates or summary of testing or in some cases more detailed documentation.
Do you need to write and execute protocols to test whether the tool saves your code, properly checks out the code, or performs other standard functions? - I wouldn't.
Are you implementing any custom configurations or want to test any critical functions in your environment? - I would probably document in some detail what testing or other activity was performed to verify this. Do you need to capture every screenshot or record every value? - probably not.

To summarize, validation is a set of activities that provide level of confidence that the tool you want to use will meet your requirements. The amount of activities will depend on the intended use, the risk, complexity and other factors you identify, as well as your risk aversion.
 

sreekiran14

Starting to get Involved
#5
I like how you summarized Validation activities.

Could you suggest me to what extent we need to perform (on behalf of CSV Qualification) the Bcakup/Restoration and Disaster recovery activities of the electronic records that computer system generates.
I am validating On premise systems and cloud based systems, your information will be helpful to guide me.

Thank you
 

sreekiran14

Starting to get Involved
#6
Hi,
We are upgrading from Master control On premise to Clod version, need to know if the
1 . Iis Data migration testing in scope or out of scope of CSValidation plan?
2, Data migration is tested by the customer or the vendor?

Thank you so much for your advise.
 
#7
The level or the extend of Validation needs as per CSV is all around "What you define in the User Requirments". If you say in those, the system must store data every 2 days, then in your validation, you run test to show the same. Makes sense? The simplest way to understand is "Validation is a way to TEST USER neeeds= things the user said he wanted the system to do"
 

sreekiran14

Starting to get Involved
#8
I got that point but what if the user requirements are not defined adequaltely . My argument with people here is that " How come the Data migration is out of scope of CSV" when we are migrating all the records from Old Master control version to new one during the upgradation to cloud system.
All I am looking to find out is does Data migration need to be in scope of CSV or out of scope of validation.


Thank you so much for your information.
 
#9
Your validation is only good as good are your URS....if you don't have URS or crappy URS..don't expect validation to be great

Not sure who advised data migration to be out of scope....data migration depending on how it's done need also validation ...if you are running a script to do so then scrip needs to be validated to bacially show input data equals output
 

sreekiran14

Starting to get Involved
#10
Thank you so much for the quick reply. Would you be able to point me to a guideline or any reference that I could point to the people here to enlighten. I couldn't find that terminology in Part11 guidance document.

Really appreciate your help.
 
Thread starter Similar threads Forum Replies Date
V Process, component or full product re-qualification: leaded to unleaded solder Qualification and Validation (including 21 CFR Part 11) 7
DuncanGibbons Understanding the applicability of Design of Experiments to the IQ OQ PQ qualification approach Reliability Analysis - Predictions, Testing and Standards 0
Y Examples of TRB Reports for MIL-PRF-31032 Qualification AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 0
Jane's Like-for-like critical raw material change qualification - type of testing/ number of lots required ISO 13485:2016 - Medical Device Quality Management Systems 4
K PQ validation qualification - Asked to write a PQ protocol ISO 13485:2016 - Medical Device Quality Management Systems 6
dinaroxentool Question about qualification as a medical device or accessory in Europe EU Medical Device Regulations 2
T Qualification testing of Lead acid batteries Reliability Analysis - Predictions, Testing and Standards 0
E Equipment Qualification - IQ/OQ per ISO 13485:2016 section 7.5.6 Process validation ISO 13485:2016 - Medical Device Quality Management Systems 7
D Determining of sample size for 'Operational Qualification' AQL - Acceptable Quality Level 3
B VDA 6.3 Qualification as Process Auditor training course and exam VDA Standards - Germany's Automotive Standards 0
D Performance Qualification per GHTF Guidance Other Medical Device Related Standards 12
M Informational EU – Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR Medical Device and FDA Regulations and Standards News 2
dgrainger Informational MDCG 2019-11: Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR Medical Device and FDA Regulations and Standards News 0
H How to prepare Performance Qualification (PQ) for autoclave General Measurement Device and Calibration Topics 2
D ISO 13485 - Equipment validation , qualification Qualification and Validation (including 21 CFR Part 11) 6
DuncanGibbons Qualification vs Certification in an Aerospace context AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 5
Z Operational Qualification for Injection Molding Supplier Quality Assurance and other Supplier Issues 6
S AIAG CQI Auditor Qualification and 3rd Party Certification Requirements General Auditing Discussions 2
D FDA Biomarker Qualification Program - Has anyone prepared an application? Medical Device and FDA Regulations and Standards News 0
R Qualification of Distributors such as McMaster-Carr and Digikey to Medical Device Companies ISO 13485:2016 - Medical Device Quality Management Systems 3
xcanals_tecno-med.es Qualification of sterilization indicators as medical devices with the EU MDR 2017/745 EU Medical Device Regulations 7
Z Training Qualification Matrix for ISO 9001:2015 Audit General Auditing Discussions 8
S Internal Auditing for API Spec Q1 - auditor qualification requirements Oil and Gas Industry Standards and Regulations 6
J Qualification of a Software as a Medical Device (SaMD) guidance under MDR EU Medical Device Regulations 9
I Compressed air system qualification and 1 micron particle analysis Other Medical Device Regulations World-Wide 0
S Medical Device Supplier Component Qualification Service Industry Specific Topics 0
O Clean room performance qualification (pq) - How many times can I do each test? Manufacturing and Related Processes 8
K Is Mold qualification / process validation always required? Manufacturing and Related Processes 7
Rameshwar25 IATF ADP - How to proceed for new auditor qualification IATF 16949 - Automotive Quality Systems Standard 17
S Do suppliers of prototyping components need to undergo supplier qualification? ISO 13485:2016 - Medical Device Quality Management Systems 3
P Qualification of weights used for curing epoxy Manufacturing and Related Processes 3
M Qualification of Freezer with IQ and PQ but no OQ Qualification and Validation (including 21 CFR Part 11) 2
S Supplier Qualification - How do we determine which suppliers to qualify? ISO 13485:2016 - Medical Device Quality Management Systems 6
J Installation Qualification (IQ) and Operational Qualification (OQ) for Laser Marking 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
C Qualification of Evaluator - Clinical Evaluation Report MEDDEV 2.7.1 Rev 04 CE Marking (Conformité Européene) / CB Scheme 3
J Simple supplier evaluation qualification process form that includes Risk Assessment Document Control Systems, Procedures, Forms and Templates 2
D What should an ISO 14644 Clean Room PQ (Performance Qualification) look like? Manufacturing and Related Processes 3
P Qualification of a Temperature Controlled Unit have to be empty? Qualification and Validation (including 21 CFR Part 11) 5
R Qualification of Evaluator - Clinical Evaluation Report MEDDEV 2.7.1 Rev 04 Other Medical Device and Orthopedic Related Topics 1
O AS9100 AQMS AEA Qualification Audits 4 Full QMS AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 5
C MSA for Non Manufacturing - Design Validation, Characterization and Qualification Lab Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 3
L Heated Sealed Packages - Sample Size for OQ (Operational Qualification) and PQ Inspection, Prints (Drawings), Testing, Sampling and Related Topics 11
Z Is PPAP Re-qualification needed in case of not quoted dimension change? APQP and PPAP 4
S Qualification Builds & Process Changes (AS9102 - First Article Inspection) AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 1
A Tracking Calibration and Qualification in an MS Excel Spreadsheet Calibration and Metrology Software and Hardware 6
P FDA has just released the forms for "Small Business Qualification and Certification" Other US Medical Device Regulations 6
P Vision Measurement System - Software Program Qualification Qualification and Validation (including 21 CFR Part 11) 6
C Process Qualification Sample size Document Control Systems, Procedures, Forms and Templates 6
P CMM Equipment Validation and Qualification Approach ISO 13485:2016 - Medical Device Quality Management Systems 11
M Chosing a procedure title - "Validation of equipment" or "Qualification of equipment" Document Control Systems, Procedures, Forms and Templates 8
Similar threads


















































Top Bottom