# Presentation: 737774

## A CASE STUDY: The modification of a legacy process control system

**[The case for data integrity without “Part 11" compliance]**
**Presented by John T. English**
**Validation & Regulatory Compliance**

## A Case Study:  Legacy and Data Integrity

**Preliminary Observations**
**Part 11 compliance has meta-expectations**** **
**Not every system is a mainframe or networked**** **
**Criticality is in the eye of the beholder! **** **
**Not all data is created equally.**

## A Case Study:  Legacy and Data Integrity

**Response to a production need**
**Adapt an existing custom application platform**** **
**Use ‘proven’ technologies to avoid delay**** **
**Have all calculations and record-keeping be as automated and paperless as possible**** **
**Let the operators do their jobs and**** ‘just walk away’**** **

## A Case Study:  Legacy and Data Integrity

**What were the results?**

## A Case Study:  Legacy and Data Integrity

**SYSTEM DESIGN**
**INFRASTRUCTURE:****	****Intel Processor/ Windows 9X****	****PLC**** **
**APPLICATION ENVIRONMENT:****	****Custom/bespoke applications****	****	****Higher level language program for instructions****	****	****Graphic tool for HMI****	****	****Standard tool for Ladder Logic**** **
**ORGANIZATIONAL****	****Procedures**
**	****	****Documentation**
**	****	****Training**

## A Case Study:  Legacy and Data Integrity

**ISSUES:   1. SDLC****	****	****Informal Methodology, not an elaborate Model.**
**	****	****   ****2.  SECURITY**
**	****	****	****The ‘ ON/OFF’ switch security approach**
**	****	****	****Locked doors do not = locked system**
**	****	****   ****3.  PROCEDURES**
**	****	****	****Covered system operation**
**	****	****	****NOT system data**
**	****	****    ****4.  DATA ARCHIVING**
**	****	****	****See Number 3 – ‘NOT’**
**	****	****    ****5.  AUDIT TRAILS**
**	****	****	****None apparent.**

## A Case Study:  Legacy and Data Integrity

**Response:  Lack of Data Integrity**
**Solution:   ****A. Write the SOP to document****	****the existing data backup “practice”****	****‘Take credit for ...’ copying file,****	**** maintaining drive, storing transmittal media**
**	**** ****	****and archive of date to network directory****	****	****under security **
**	****B.  Overcome Objections:**
**	****	****	****It’s not fully compliant**
**	****	****	****The FDA won’t like it**
**	****	****	****They only want to see optical media**

## A Case Study:  Legacy and Data Integrity

**Response:  Lack of Data Integrity**
**Solution:   ****C. Demonstrate the ability to retrieve data**
**	****All files were available****	****Rapid retrieval**
**	****	****IT security combined with departmental procedures**
**	****	****Time and date stamping**

## A Case Study:  Legacy and Data Integrity

**Source for the following :****US FDA Office of Regulatory Affairs**
**Investigation Operations Manual (2003)**Chapter 5 Establishment Inspection
**Subchapter 520 - Evidence Development ****Sections 527-529**

## A Case Study:  Legacy and Data Integrity

## A Case Study:  Legacy and Data Integrity

**527.44 Data Integrity of Records Provided by Firm **
**Many manufacturers are using computers to store records concerning complaints, failure data, returned goods, servicing, testing results and others. Record traceability and data integrity are always concerns when you copy or use computerized data. **
**It is difficult to determine what records are to be designated as originals or copies of original records. It is important, when obtaining hardcopy or copy of computerized data, for you to capture some method of dating. ****The date of an electronic file can be captured by recording ****the date and time from a file listing in DOS or with File Manager in Windows.**** **
**	****This may not always be possible, but some attempt should be made to date and time stamp electronic data.**** **

## A Case Study:  Legacy and Data Integrity

**FINAL NOTES**
**Compliance is not supposed to an unattainable goal**** **
**Errors are expected – and expected to be controlled**** **
**‘****A good procedure today is better than ****	****a plan to make a perfect system ****	****some time in the future.’**** **
**In a perfect world, data integrity ****	****will NOT be an issue.  ****	****For the rest of us, there is still the FDA.**

## A Case Study:  Legacy and Data Integrity

**A Reflection:**
**“****Machines are built by men****and will always be at risk of failing. ****All we can do is make them****as safe as possible ****and ensure that those who operate ****the machines act responsibly."**