The annex takes a risk-based view across the whole life of a system. Risk management should be applied throughout, with the extent of validation and data integrity controls based on a justified, documented assessment of the system’s impact on patient safety, product quality and data integrity. The same text forms Annex 11 of the PIC/S GMP Guide, and the UK applies equivalent requirements through UK GMP, so the expectations an MHRA inspector brings are essentially the same.
The main requirements
- Personnel and suppliers — close co-operation between process owners, system owners, QPs and IT; formal agreements with suppliers and service providers, with clear responsibilities.
- Validation (section 4) — documentation and reports covering the life cycle, an up-to-date inventory of systems, user requirements traceable through the life cycle, and evidence of the supplier’s quality where relied upon.
- Data and accuracy checks (sections 5 and 6) — built-in checks for the correct and secure entry and processing of data exchanged electronically, and additional checks for critical data entered manually.
- Data storage and printouts (sections 7 and 8) — data secured against damage, regularly backed up and checked for accessibility; clear printed copies, with an indication of whether data have been changed since entry.
- Audit trails (section 9) — based on risk, a system-generated record of all GMP-relevant changes and deletions, with the reason documented; audit trails available, convertible to an intelligible form and regularly reviewed.
- Change and configuration management, periodic evaluation (sections 10 and 11) — changes made in a controlled manner, and systems periodically evaluated to confirm they remain valid.
- Security and incidents (sections 12 and 13) — physical and logical controls restricting access to authorised persons, with access changes recorded; incidents reported, assessed and their root cause identified.
- Electronic signature and batch release (sections 14 and 15) — e-signatures with the same impact as handwritten ones, permanently linked to the record, and including time and date; release recorded only by authorised persons who are clearly identified.
- Business continuity and archiving (sections 16 and 17) — provisions to keep critical processes going if the system fails, and archived data checked for accessibility, readability and integrity.
