Your Data lifecycle extends across departments and its governance requires good practices to be followed. Understanding the criticality’s of setting common Master Data and policies is very important and extended educational efforts should be considered at corporate level.

When implementing digital solutions for quality processes, GxP activities, the data management policies should apply to any computer software’s involved, all along the data lifecycle, data workflows and related processes, with particular attention to system integrations.

Setting adequate policies for Validation and Data Integrity is crucial to ensure the required corporate quality levels in managing your data and controlling the right functioning of those computerized systems throughout their life.

This article is providing a summary of the key concepts to be considered for validation management and the ones for ensuring proper data integrity policies using computerized system.

Build Comprehensive Validation Policies for the computerized systems involved in your data lifecycle.

The validation policy should be applicable to any computerized system that is deemed to have an impact on GxP activities. Examples of such systems include, but are not limited to, automated manufacturing or laboratory equipment, process control systems, MES, LIMS, regulatory compliance, and document management systems.

The validation cycle should establish documented evidences and provides a high degree of assurance that the systems will operate on day one and will continue to operate along updates and upgrades, amongst all users’ levels, in a reliable and reproducible manner, according to the documented requirements and within a controlled environment.

Key concepts to be applied for computerized system validation management

1. Design and manage the system lifecycle under Quality requirements.

The compliant state of the systems must be maintained until the systems are decommissioned. From the first moment, i.e. concept of the system, through implementation and routine operation till complete retirement of the computerized system, appropriate documented procedures must be developed and followed accordingly.

2. Adapt the validation lifecycle activities based on the outcome of both Risk and Supplier Assessments.

The validation efforts all along the computer software lifecycle are directly proportional of the outcome of the risk assessment and the supplier assessment.

An audit of the Supplier´s Quality system will provide an excellent baseline to extrapolate the effort required for initial validation and for supervision of the updates, upgrades and good functioning during its entire lifetime.

Additionally, the risk evaluation should consider the system complexity, its maturity level and the functionality required to control the underlying processes, along with the amount of data to be stored, recalled, processed and secured. The architecture of the hardware and the software that comprise the computerized system will also have an impact on the system complexity and must be considered when developing the validation activities. Finally, the configuration of the software application and the software functionalities must also be considered in the validation process and as such during the risk assessment.

3. Leverage the supplier involvement throughout the validation lifecycle activities. The supplier may be able to provide a considerable degree of expertise through the process and help reduce the validation activities. Where documents are supplied, those should be reviewed and accepted for use.

Ensure solid Data Integrity Policies that cover your complete Data Life Cycle

 These policies should describe responsibilities and activities related to the integrity of your data collection, storage, management and archival on the computerized systems. The necessary measures should be defined to satisfy the data integrity requirements, (see ALCOA definition) and guarantee that data collected and managed are complete, consistent and accurate throughout the entire data life cycle.

Key concepts to be considered to ensure proper data integrity policies using computerized system

1. Evaluate the system criticality through a risk assessment to define priorities in reinforcements and liability of the system to be validated
2. Assess and address Interfaces during validation to ensure that transfer of data are correct and complete. The interface between the originating system, data acquisition and recording systems should be validated to ensure the accuracy of data. It should always be possible at any time, at any decision level, to easily access the original raw data.
3. Incorporate validated checks to ensure the completeness of data acquired, as well as any metadata associated with the data. Ensure that critical data are reviewed by the appropriate user and verified to determine that operations were performed correctly. Any necessary changes to data must be authorized and controlled in accordance with approved procedures.
4. Configure and enforce User access controls so that Input of data and changes to computerized records are made only by authorized personnel
5. Assigned Individual Login IDs and passwords for all and every staff needing to access and utilize the specific electronic system in order to allow proper traceability. Shared users are not allowed for GxP critical activities.
6. Define standard procedure for new users’ settings and requests for new privileges.
7. Configure Audit Trail functionalities properly to capture any activities related to the acquisition, deletion, overwriting and changes to data for audit purposes.
8. Ensure solid format storage to ensure that data are not vulnerable to manipulation, loss or change. Storage of data must include the entire original data and metadata, including audit trails, using a secure and validated process. The data should be accessible and readable, and its integrity maintained for all the period of archiving
9. Define procedures for Backup and copies.They must have the same appropriate levels of controls so as to prohibit unauthorized access to, changes to and deletion of data or their alteration. True copies of dynamic electronic records can be made, with the expectation that the entire content (i.e., all data and metadata) is included and meaning of the original records are preserved.
10. Define Procedures that describe the process for the disposal of electronically stored data. These procedures should provide guidance for the assessment of data and allocation of retention periods and describe the manner in which data that is no longer required is disposed of.

From NL42 consulting, we can help you setting the adequate set of policies. We review and audit your situation, provide risk assessment, supplier assessment and recommendations for remediation when needed.

Just contact us for initial evaluation

L'articolo Are your Data Management Policies supporting the GXP compliance? proviene da NL42 | Paperless Lab Academy®.

This is not another data integrity article, yet this is about demonstrating to auditors that you do have it all right and under control. So we’d like to highlight the importance of assessing the complete life cycle of your data and managing it for complete compliance to data integrity requirements.

We’ve all attended the thousand trainings, webinars and presentation about Data Integrity recommendations and guidelines. We know by heart the ALCOA definition and read several scary 483 letters.

You probably have also been involved in a specific DI project in your company or simply been asked to attend a series of internal training courses to increase self-awareness about the impacts of your actions. Corporate policies and messaging reinforced with nice posters have also probably popped up and decorated nicely the corridors and the cafeteria.

Beside the human factor being approached by reinforcing corporate ethical rules, the integrity of your data is a matter of managing adequately the company data lifecycle and in its multiple data workflows.

We, at NL42 ,are known at the Paperless Lab Academy for reinforcing the concept that no digital transformation project goes without a clear understanding of your data life cycle which we organise in 4 main steps when speaking about electronic data: eData, we will focus on the initial raw data capturing at eConnect, correct and compliant handling at eManage, easy access to data insight for sound decision making at eDecide .

Two major concerns the auditors will focus on

When investigating possible Data Integrity breaches, auditors are in the end, just using common sense and applying an implacable logic on “HOW” your data are managed. They will tend more and more to prefer seeing digital solutions implemented, with CFR21/11 capabilities enabled, correct users´ right access definitions and more. Even if all possible human interactions prone to transcription errors are removed, there are still two major concerns the auditors will focus on.

1)    Accessing the original raw data and its metadata

The eConnect step is becoming of crucial importance as the attention of the auditors is moving to laboratory instrumentation and capabilities to provide electronic format of their data ouput. Raw data and corresponding metadata should be accessible in order to verify easily non only the final result outcome but to review the whole data processing itself too.

Additionally, to the capability to review the data processing, all related information about quality control records, exceptions and re-evaluation should be perfectly accessible anytime.

Curiously for the past 10 years, even though the laboratory information management systems have considerably improved their interfacing capabilities with the laboratory instruments, the instrument integration tend to fall always in a phase 2 implementation and most of the time not being implemented at all.

2)    Assessing the Vendor, Documenting and Validating the computerised systems

Assessing the vendor´s product development quality system, documenting from the very first moment of the project planning to ease the validation steps is again a strong recommendation from our side.

Unfortunately, this had to be reinforced again recently by the EMA. In April 2020, the EMA has released a “Notice to sponsors on validation and qualification of computerised systems used in clinical trials” that could easily be extended to any scientific data management workflow still not matured enough regarding data integrity management.

The integrity of your paperless processes is built on the foundation of thorough understanding of your data lifecycle and precise documentation for qualifying the functionalities and validate the reliability and robustness of your computerised system in managing your data. Failure to document and therefore demonstrate the validated state of a computerised system is likely to pose a risk.

Join our project “Let´s Restart Together” , we can help you!

We´d like to help you in making sure your investment in time and money are fully compliant and protecting you from any potential risk.

Contact us 

L'articolo How to be sure that your Data Integrity project has fully covered your eData LifeCycle? proviene da NL42 | Paperless Lab Academy®.

Data integrity is not a new trend

You know that data integrity is not a new concept. You know of multiple examples not even related to the pharma industries that had a strong impact in the society. Like the one that happened in the automotive industry, with a catastrophic environmental fraud in cheating with emissions tests. The top management lost the job; billions were wiped from the company’s shares; and the country economy faced a big threat. In the Food industry, species authentication is also misleading the consumers in some occasions with incorrect labelling.

Today, we take numerous professional and private decisions along the day based on captured data, and we get used to trust them and the company behind those data. Once the information is acknowledged as incorrect, inadequate, even fraudulent, the trust is then broken. Unfortunately, the list of examples is long, and the final consequence always the same. A lack of trust impacts directly the final product and the company producing it.

Data integrity in laboratories

At the laboratory, you also might have run several internal meetings about data integrity, deciding how, what, when and who should be taking care of it. Too often the data integrity concerns focus on quality processes and data produced within the quality control department. We all then end up concentrating intensively in the potential gaps and risks that data silos might generate. Also, because, the auditors are getting extremely well trained in flagging the potential breaks directly at the source of a chromatographic raw data collection system.  Anyhow, multiple laboratory solutions and methodologies are available. The Internet of Lab Things (IoLT), the Integration of instruments (Ioi), the audit trails, the electronic signature and more, are technical solutions that once implemented ease the data flow and limit the breaks to any ALCOA+ listed concepts.

Unfortunately, too often, the preparation to an audit accelerates the buying decision process of a software solution with the aim of quickly saving the situation by showing to auditors an informatic dedicated tool implemented. The typical situation that cumulates so many “should not do it that way” which outcome results in a poor implementation with hybrid processes that increased the risks to data integrity breaks.

The right approach for data integrity is to review processes, incorporate new methodologies and make sure that new standard operative procedures are followed correctly with a good understanding of the benefits for the employee and the company to do it right. We started by being concerned about data integrity when what should be addressed is change management and enhancement of the company cultural awareness. An educational program is to be planned at corporate level involving all functions and departments.  The commitment of the company management is then a must to convey the correct message of recommended habits and attitude changes. The management commitment is a requirement to assure that the company is delivering reliable information. Management should instil the right attitude within the company providing guidance and leadership speaking about delivery of reliable information to the market.

Data integrity is, in the end, about Company Integrity

The commitment from management is critical, all markets should take data integrity as a serious issue as the risks of mishandling information are dramatic.

In commercial companies, we get quickly trained about how critical it is to get our computers and mobile phones backed up, generally connected to cloud applications storing securely the internal confidential information. No one’s goes for a coffee without blocking access to the personal computers with controlled unique password. How it happens that in other departments of the same company, password is easily shared if not completely visible on a simple post-it?
All employees should be committed to produce, handle and deliver accurate information. This is a long process which is not related to systems, technological solutions and processes. It is mostly related to corporate culture.
Company’s management should invest a significant portion of time in introducing a culture of reliability, quality and confidence that will generate trust within customers, suppliers and shareholders.

L'articolo Data Integrity, Company Integrity: a Management Commitment proviene da NL42 | Paperless Lab Academy®.