What the inspector wrote
The IT service management system recorded 41 changes to the validated laboratory data system over 24 months, including vendor patches, database maintenance, configuration changes to result calculation parameters and creation of administrator accounts. None was recorded in the site change control system, none had a QA-approved impact assessment and none had documented regression testing. The site's computerised system validation procedure stated that changes were controlled 'through the IT change process'.
Why it was cited
Annex 11 paragraph 10 requires that any change to a computerised system, including configuration, be made under a defined procedure, and paragraph 4.8 requires GMP systems to be subject to change control. An IT process without QA involvement, impact assessment on the validated state or regression testing does not meet either requirement, however well it serves IT.
Configuration changes to calculation parameters and creation of administrator accounts are changes to the controls on GMP data. That they were treated as routine administration is the reason the finding is major rather than other.
What would have prevented it
- Make the GMP change control the authority for any change to a validated system, with the IT ticket as the implementation and evidence record. No change to a GMP system is scheduled without a change control number.
- Classify system changes (infrastructure, configuration, code, vendor release, data and access) with a defined assessment and regression scope for each, proportionate to risk as GAMP 5 second edition describes.
- Reconcile the IT change log against the change control log at each periodic review under Annex 11 paragraph 11.