# Presentation: 591512

## New GAMP Good Practice Guide for Electronic Record and Signature Compliance

- Arthur D. Perez, Ph.D.
- Chairman, GAMP Americas

## Guiding Principles for New GPG

- Consistent approach to ERS management
- Manage risk by
- Defining minimal acceptable standards
- Applying stronger measures only where warranted
- Simplicity of Approach
- Assessment must not be harder than applying maximum controls
- Facilitate interpretation of predicate rule requirements
- Minimal impact on transition from old compliance programs to new
- Encourage and facilitate new technologies that may involve electronic records and/or signatures
- Consider and comply with international regulations
- Including USFDA, EU, PIC/S Guidance, Japanese MHLW

- FDA Public Meeting

- June 11, 2004

## Key Concepts

-  Scalability of assessment process based on *record impact*
**Direct Impact** records have obvious and significant effect on public health
**Indirect Impact** records that provide evidence of compliance but do not have obvious and significant effect on public health
**Non-impact** records that have negligible or no effect on public health
- Identify the potential hazards
- Possible occurrences that could threaten a record
- Power failure, security breach, virus, attempted fraud
- Leverage GAMP’s classic three-components risk assessment
- Degree of harm
- Probability of fault
- Detectability of fault

- FDA Public Meeting

- June 11, 2004

## Simple Risk Assessment

***Priority***** *****1***

***Priority 3***

***Priority 2***

***Class 3***

***Class 2***

***Class 1***

- GAMP 4 describes a simple two-step process
- Plot **severity** vs. **probability** to obtain **risk class**
- Plot **risk class** vs. **detectability** to obtain ***risk priority***

- FDA Public Meeting

- June 11, 2004

## ISO 14971-Based Approach to Risk

**Non-impact**

**Direct impact**

**Indirect impact**

- FDA Public Meeting

- June 11, 2004

## Controls Based on Risk and Impact

**No Impact:** Use “Good IT Practices”

**Increasing rigor of****control required**
*Consider:*
- Stricter controlsMore controlsMore frequent controlsAutomatic controlsIncreased internal audit

**Severity**

**Risk**

***Effect on:****** ***Patient safetyProduct safetyCompliance

***Potential for:**** *Loss of recordCorruption of recordWrong record

**Direct Impact:**
- Use risk assessment to identify specific  controls & rigor

**Indirect Impact:**
- Use Generic Checklist controls

- FDA Public Meeting

- June 11, 2004

## Controls Based on Risk and Impact

| Control | No Impact
“Good IT Practice” | Indirect Impact
Formal Processes for: | Direct Impact 
Formal processes for: |
| --- | --- | --- | --- |
| Access control | - Controlled access | authorization process
access management
password management
documentation | rigorous authorization control
strict and proactive access management
user profiles
unique accounts
stringent PW management
physical security
full documentation |
| Backup and Restore | Checking of outcome
Multiple copies (redundancy) | Checking of outcome
Multiple copies (redundancy)
Formal periodic testing
Documentation | Checking of outcome
Multiple copies (redundancy)
Formal periodic testing
Full documentation 
Remote storage locations
Automated processes |

- Rigor of Controls

- FDA Public Meeting

- June 11, 2004

## Appendices

- Validation Policy
- Validation is an expected control
- Audit Trails and Data Security
- Level of control commensurate with risk/impact
- Audit trails only where they make sense
- Record retention
- Format choice reflects actual business process
- Format choices based on risk assessment
- Optimal format may change as record ages

- FDA Public Meeting

- June 11, 2004

## Appendices

- Copies of Records
- Useful access necessary for inspectors
- Use of common portable formats
- Legacy Systems
- Document justification of classification as legacy
- Guidelines for evaluating effect of upgrades
- Document that system satisfies predicate rule
- Predicate Rules Requiring Records or Signatures
- US (21 CFR 50, 54, 56, 58, 210, 211, 312, 314, 820)
- EU
- Japan

- FDA Public Meeting

- June 11, 2004

## Appendices

- Sample Case Studies
- Spreadsheets
- Packaging equipment
- Clinical trial label manufacture
- SCADA
- HPLC
- Chromatography Data System
- Interactive Voice Response System (IVRS)
- Adverse Event Reporting System
- Batch record system

- FDA Public Meeting

- June 11, 2004

## Appendices

- Forms for Indirect Impact Records
- For risk assessment and identification of controls
- Risk Assessment for Direct Impact Electronic Records
- Adapted from GAMP 4 Appendix M3
- Includes roles and responsibilities
- Form for Previously Assessed Part 11 Systems
- Glossary
- References

- FDA Public Meeting

- June 11, 2004

## Summary

- The New GAMP GPG for Electronic Record and Signature Compliance offers
- A pragmatic approach to complying with record requirements in electronic systems
- A combination of record classification and risk assessment that
- Places controls where they are needed
- Is not so ponderous that firms will find it easier to work toward a single excessive standard
- Extensive examples of application of the process

- FDA Public Meeting

- June 11, 2004