Medical technology and healthcare market:
Effective validation processes

A formal process by which qualified representatives from the disciplines involved review proposed or implemented changes to a computer system. The main goal is to document the changes and ensure that the system is maintained in a controlled state.

The criteria that a system/component must meet in order to be accepted by a user, customer or other authorized body.

Tests conducted to determine whether or not a system meets the acceptance criteria and to enable the customer to accept or reject the system. See also Factory Acceptance Test (FAT) and Site Acceptance Test (SAT).

Software that is installed on a defined platform/hardware and offers specific functions.

Systematic, independent and documented process to obtain audit evidence and its objective assessment to determine the degree of fulfillment of the agreed criteria.

System-side control mechanism that makes it possible to document changes and deletions.

Regulatory and legal requirements (e.g. 21 CFR part 820 (FDA, USA), ISO 13485) for quality assurance of the production processes and environment.

A CCGMP-compliant quality management system serves to guarantee product quality (safety and effectiveness) and to fulfill the regulatory and legal requirements that are binding for marketing.

The review is used to manually check the work results of the software development. The review is a more or less formally planned and structured analysis and evaluation process of the software. During code review, a program section is proofread by one or more reviewers after or during development in order to find possible errors, simplifications or test cases.

A wide range of systems including but not limited to:

automated manufacturing equipment, automated laboratory equipment, process control and process analysis, production control, laboratory information management, production resource planning, clinical trial data management, vigilance and document management systems. The computer-based system consists of hardware, software, and network components as well as the controlled functions and the associated documentation.

Documented evidence that the proposed equipment/hardware design is suitable for the intended purpose.

A process or meeting in which a system, hardware or software design is presented to project personnel, managers, users, other interested parties for comment or approval. Types can be critical design part reviews, preliminary design reviews, or system reviews.

Good Automated Manufacturing Practice, guide for validating automated systems in pharmaceutical manufacturing.

Comply with all relevant pharmaceutical and associated life science regulatory requirements.

Computerized systems subject to GxP regulations. The regulated entity must ensure that such systems comply with relevant regulations.

International Conference on Harmonization

Documented evidence that a system complies with written and previously approved specifications.

Protection against unauthorized modification of information

International Society for Pharmaceutical Engineering

Abbreviation for IT Infrastructure Library. A collection of good practice guides on IT service management. These include services related to IT. The service lifecycle includes strategy, design, transition and implementation of the services as well as their continuous improvement.

Individuals with specific expertise in a particular area or area should take a leadership role in verifying computerized systems. The responsibilities of subject matter experts include planning and defining verification strategies, establishing acceptance criteria, selecting appropriate test methods, conducting verification tests, and reviewing the results.

A configuration refers to a specific adaptation/setting of programs or hardware components of a computer to user requirements. In addition to the installation (initial setting), the term also includes the selectable presets (also options) of the operating parameters.

Requirements specification that describes what the computerized system (hardware and software) is intended to do and includes criteria or conditions that must be met.

All phases of the system lifespan from initial requirements to decommissioning including design, specification, programming, testing, installation, operation and maintenance.

Approach to achieve consistent quality assurance across all levels during the design, development, creation and operation of computer-aided systems.

Manufacturing Execution System

Complete transfer of data to another computer system with the aim of using the data in the new system in the future.

Documented evidence that a system functions as previously specified across all operational areas.

Documented evidence that a system is capable of executing a process or controlling process activities as specified, while the system is operating within its operating environment.

A documented assessment of the documentation, procedures, records, and behavior of a computer system to determine whether that system continues to be in a validated state or what actions are required to return the system to a validated state. The frequency of the checks depends on the system complexity, the system criticality and the frequency of changes.

Specification that documents the functional requirements for a system or system component. It describes what the system or system component does, not how it is built.

FS can be part of the URS.

Recognize, evaluate, understand and prevent side effects, especially long-term and short-term side effects of medications.

When a system is put into operation for the first time, it is subject to a prospective validation review.

Prospective validation is the norm. The procedure and the individual validation activities are described in the respective validation plan. The observations should be carried out under real conditions and the findings should be noted on the corresponding protocols.

The person responsible for the business process.

All activities that prove and document that the equipment has been installed correctly, is working correctly and is producing the expected result. Qualification is part of validation, but the individual qualification step alone is not sufficient for process validation.

The risk-based qualification of buildings, rooms, systems, devices and IT infrastructure is an essential part of quality assurance in a regulated environment and required by law (EU Guide to Good Manufacturing Practice). A planned and documented process must demonstrate that the equipment and premises are suitable for the intended purpose and will actually function reliably under the on-site conditions.

Design qualification: Determination of the requirements for the device or system. This includes user requirements as well as functional and design specifications.

Installation qualification: Documents the installation and commissioning of the system or machine and shows that applicable regulations, required performance data and specifications are adhered to.

Functional qualification: Device test or testing process that evaluates the correct functioning of a system or device.

Performance qualification: Field test that documents the use of the equipment in routine operations.

(1) Computer instructions and data definitions presented in a form suitable for the assembler, compiler, or other program code translator.

(2) The human-readable version of a program's instruction list that causes a computer to perform a task

Method of software development in which a system is quickly ready for use and is then improved and expanded in a series of iterations until the requirements are met. The specification is created parallel to the development of the software.

Systems requiring validation that have already been used productively over a longer period of time but have not yet been validated must be validated retrospectively. For the retrospective validation, an experience report must be created based on available data.

Retrospective validations are only carried out in exceptional cases, as the regulatory requirements clearly require prospective validation. The justification for the need for retrospective validation is given in the experience report.

Validation of a previously validated system that has been changed. A revalidation can be carried out due to changes to the system or based on a periodic review.

Validation of a previously validated system that has been changed. A review (or revalidation) can be carried out due to changes to the system or on the basis of a periodic review.

The combination of probability of occurrence of a Damage and its severity (ISO/IEC Guideline 51).

The assessment of the risk associated with the identified hazards.

The systematic application of quality measuresmanagement principles, procedures and practices on the tasks of assessing, controlling, communicating and testing risks.

An interface is a defined transition between data transmission devices, hardware components or logical software units.

System and data security includes all technical and organizational measures to protect against loss, damage and unauthorized changes and thus ensure confidentiality, integrity and availability.

Standard Operating Procedure

A document that fully, accurately, and verifiably describes the requirements, design, behavior, or other characteristics of a system or component—and often—the procedures used to determine whether those requirements have been met.

The person responsible for the availability and maintenance of a computerized system and the security of the data stored on the system.

Specification that documents how the system is built. It typically includes the system structure, components, algorithms, logic, data structures, input/output, interface descriptions, etc.

The TS is based on the FS.

A set of test inputs, operating conditions, and expected results designed for a specific goal, such as executing a particular branch of a program or verifying compliance with a specific requirement.

(1) Tests that ignore the internal mechanisms or structures of a system or component and focus exclusively on the results (outputs) in response to selected specifications (inputs) and execution conditions.

(2) Test conducted to assess the conformance of a system or component to specific functional requirements and corresponding predicted results.

Synonym: Black box test, input/output related test. In contrast: structural test.

A document that describes the scope, approach, resources and schedule of the intended testing activities. It specifies the test items, the functions to be tested, the test tasks, who will carry out these tests, and any risks that require planning for unforeseen events.

(1) Test that includes all internal mechanisms (structures) of a system or component. Types can be: branch test, path test, statement test.

(2) Test that ensures that each program statement is executed and that each program statement performs the intended function.

Synonym: white box test, glass box test, logic-driven test, unit test.

Achieve and maintain compliance with applicable GxP regulations and fitness for purpose by:

• the use of principles, approaches and life cycle activities within the framework of validation plans and reports
• the application of appropriate operational controls throughout all phases of the system's life

A systematic approach to verifying that computerized systems, whether used individually or in combination, are fit for purpose, installed correctly, and operating correctly. This is an umbrella term that includes all types of procedures to ensure that the system is fit for purpose, such as qualification, commissioning and qualification, verification, system validation and others.

Sometimes used in place of IQ, OQ, PQ.