Ten years after our original discussion of Computer System Validation (CSV) gaps, laboratories still face frustrating roadblocks. In 2015, the three core CSV challenges were systems that:

1. Did not function as intended
2. Did not meet an aspect of 21 CFR Part 11
3. Did not meet a general CSV requirement

Although these challenges remain relevant, the landscape has evolved with increasing data integrity concerns, cloud solutions, automation, AI, and cybersecurity threats. 

Today, software configuration isn't always sufficient to meet regulatory requirements. Standard operating procedures (SOPs) can be crucial for bridging validation gaps. Here, we explain how to strategically use SOPs to address these persistent and emerging challenges.

The Enduring Challenge: Software That Does Not Function as Intended

Despite vendor testing, complex lab software and hardware may still have bugs. Our 2015 advice stands: contact the vendor first, then try disabling the problematic function if it is noncritical. However, simply documenting an unused feature might not suffice for critical GxP processes. 

Regulatory agencies emphasize proactive risk assessment and mitigation. If a function may fail, a rigorous risk assessment is vital to understand the impact on data quality or patient safety. Consider the interconnectedness of modern lab informatics; failure in one area can have ripple effects. If a function cannot be disabled without impacting core functionality, SOPs can define the use prohibited for GxP activities.

Using SOPs to Address Functional Gaps

Organizations should document system changes across several SOPs, ensuring the following features are present:

• Clear Identification: Explicitly name the problematic function and prohibited actions.
• Detailed Workarounds: Provide validated alternative manual or procedural steps.
• User Training: Document SOP training, emphasizing restrictions and alternatives. Assess user competency.
• Data Review: SOPs must include steps to verify the prohibited function wasn't used, potentially involving audit trail checks or manual verification.
• System Administration Controls: Outline technical controls to limit access to non-compliant features where possible.

The Evolving Landscape of 21 CFR Part 11 Compliance and Data Integrity

Data integrity, guided by ALCOA+ principles, is the key consideration due to increased regulatory scrutiny. Although hybrid manual and electronic systems remain valid, there's a greater expectation for robust electronic controls to minimize human errors. 

New considerations for 2025 include:

• Emphasis on Audit Trails: Comprehensive, detailed, accessible, and tamper-proof records of who did what, when, and why.
• Metadata Management: Ensuring the integrity and traceability of how data is created, modified, and stored.
• Electronic Signatures: Meeting stringent identity verification and nonrepudiation requirements, with biometrics and multifactor authentication becoming common.
• Data Governance Frameworks: Formal frameworks to ensure data integrity across all lab systems.
• Cloud-Based Systems: New validation complexities related to vendor responsibility, data residency, and security controls, requiring understanding of shared responsibility models.
• AI and Machine Learning: Validating algorithm accuracy and reliability of data inputs and outputs presents novel challenges.

When facing Part 11 gaps, a thorough risk assessment considering long-term data integrity and compliance is crucial. Justifying procedural workarounds requires strong rationale and controls. Consulting a laboratory software validation SME with current data integrity expertise is highly recommended.

Using SOPs to Address 21 CFR Part 11 and Data Integrity Gaps

When systems lack specific Part 11 controls, SOPs can implement compensating procedures:

• Manual Audit Trails: Mandate manual logging of critical actions (who, when, why) with controlled logs.
• Witnessing and Second Person Review: Require a second person to witness and document critical data manipulations or system changes lacking electronic controls.
• Paper-Based Signatures: Define when and how paper signatures are used with electronic records in hybrid systems to ensure traceability.
• Data Backup and Archival: Detail manual backup procedures, media handling, and long-term retention if electronic capabilities are limited.
• Metadata Management: Define manual recording and linking of essential metadata not automatically captured.
• Periodic Data Review and Verification: Include specific checks for integrity and completeness, especially where procedural controls compensate for system limits.

Adapting to Modern CSV Requirements

General CSV requirements like backup, security, and recovery have evolved, too:

• Cybersecurity: A critical aspect of CSV, including vulnerability assessments, intrusion detection, and data breach response.
• Data Integrity in Backups and Recovery: Ensuring data integrity and availability during backup and recovery, with testing to verify completeness and accuracy.
• Integration and Interoperability: Addressing data flow and integrity across integrated lab systems.
• Disaster Recovery and Business Continuity: Validation should consider plans ensuring data availability during unforeseen circumstances.
• Automation and Robotics: Requiring specific attention to control software, data interfaces, and potential impact on data quality.

Addressing these modern requirements necessitates collaboration between business, IT, vendors, and cybersecurity experts, using a comprehensive, lifecycle-based risk management approach.

Using SOPs to Address General CSV Requirement Gaps

SOPs can provide procedural workarounds for technical limitations:

• Manual Backup Procedures: Detail frequency, media, storage, and verification if automated backups are unreliable.
• System Access and Security: Define user roles, access requests, and manual reviews if granular security controls are lacking.
• Disaster Recovery Steps: Outline manual data recovery and communication protocols if automated recovery is insufficient.
• Change Control Procedures: Detail the process for requesting, evaluating, approving, implementing, testing, and documenting system changes if built-in features are limited.

Moving Forward: Expertise and Collaboration are Key

The 2015 core message remains: overcoming CSV challenges requires technical understanding, regulatory knowledge, and problem-solving skills. However, in 2025, increased complexity of systems and workflows is the reality. The following key points should be considered.

• Deep Expertise is Essential: Engage laboratory software validation SMEs with current knowledge.
• Cross-Functional Collaboration: Foster a one-team approach between laboratory, IT, QA, validation, and cybersecurity personnel.
• Risk-Based Approach: Underpin all validation with thorough, documented risk assessments.
• Continuous Improvement: Ensure ongoing compliance through monitoring, reviews, and proactive maintenance.

If your 2025 CSV projects face roadblocks, consider the evolving data integrity landscape, integrated systems, and cybersecurity. Embrace expertise, collaboration, and a robust risk-based approach for successful validation.

Important Considerations for Using SOPs as Gap Fillers

• Justification and Risk Assessment: Clearly document the rationale for procedural controls with a thorough risk assessment to demonstrate effective risk mitigation.
• Clarity and Detail: Write clear, concise, and unambiguous instructions.
• Training and Adherence: Provide comprehensive training and strictly enforce and monitor adherence.
• Periodic Review: Review SOPs regularly to ensure effectiveness and alignment with system updates and regulatory changes.
• Auditability: Ensure procedural control execution is auditable through documentation.
• Mitigation, Not Substitution: Although valuable, SOPs are often temporary guidance; the goal is robust built-in controls.

Thoughtful development and implementation of SOPs can effectively address validation gaps, maintain compliance, and ensure data integrity despite system limitations. Well-defined procedures, trained personnel, and diligent oversight are key.

How have you used SOPs to ensure your laboratory is fully compliant?

‍

‍