Pharmaceutical wholesalers rely more and more on advanced IT systems for the storage, management and distribution of medicinal products. The introduction of information technology in the pharmaceutical industry has brought many benefits, but at the same time imposes responsibility for ensuring the security, effectiveness and compliance with regulations of these systems. The validation of computerized systems is a key element of quality assurance, and the GAMP (Good Automated Manufacturing Practice) guide, the GDP (Good Distribution Practice) and The Code of Federal Regulations (CFR) guidelines play a key role in this process.

What systems can be found in a pharmaceutical warehouse?

In pharmaceutical wholesalers can be find various types of computerized systems that support and improve the management and functioning of the entire organization. Some of the computerized systems in pharmaceutical wholesalers are:

• Warehouse Management Systems (WMS): WMS is used to automate and optimize warehouse processes such as receiving, storing, picking and shipping products. It help manage inventory, minimize errors and increase efficiency.
• Quality Management System (QMS): QMS enables monitoring and management of the quality of medicinal products as well as production and storage processes. Helps ensure compliance with regulations and quality standards.
• Transportation Management System (TMS): TMS helps to manage and optimize transport processes, such as route planning, shipment monitoring.
• Electronic Document Management System (EDMS): EDMS enables the management and storage of documents related to the wholesale business, such as procedures, trainings, quality documents, etc.
• Customer Relationship Management System (CRM): CRM helps manage customer relationships, track interactions, handle complaints, and improve customer service.
• Temperature and Humidity Monitoring Systems: These systems allow continuous monitoring and recording of environmental conditions in pharmaceutical warehouses, which is crucial to ensuring proper storage conditions for products.
• Access Control Systems These systems are designed to control, monitor and restrict the access of persons to specific areas, rooms or resources within the warehouse. This is an important element of ensuring physical security, data protection and compliance with regulations in the pharmaceutical environment.

These are just a few examples of computerized systems that can be found in pharmaceutical wholesalers. The choice of specific systems depends on many factors, such as the size and specificity of the warehouse, the scope of activity as well as legal and quality requirements.

What is computerized systems validation?

Validation of computerized systems is the process of systematically collecting, analyzing and providing objective evidence that a given computerized system meets specified requirements and expectations, works correctly, complies with legal requirements and is fit for its intended use. Validation is intended to confirm that the system is reliable, safe and effective, as well as to minimize the risk of operational errors or inconsistencies. This process involves a series of activities such as planning, designing, testing, documenting and monitoring to ensure that the system is compliant and meets high quality standards. 

GAMP Guide – what is it and what does it mean?

The GAMP (Good Automated Manufacturing Practice) guide is a set of guidelines and principles developed by the International Society for Pharmaceutical Engineering (ISPE) designed to provide a working framework for the validation of computerized systems in the pharmaceutical and other manufacturing industries. GAMP is widely used as a reference document that supports organizations in the process of designing, implementing and maintaining computerized systems, ensuring compliance with regulations, quality standards and industry standards. The GAMP guide covers the principles of risk management, design, testing, documentation and other aspects related to the life cycle of computerized systems in regulated environments.

What is Good Distribution Practice (GDP)?

Good Distribution Practice (GDP) was introduced by the European Medicines Agency (EMA) and the European Commission as part of a comprehensive approach to regulation in the pharmaceutical sector. The GDP is a set of guidelines and standards that define the requirements for the distribution of medicinal products in Europe to ensure their quality, integrity and safety. GDP is an element of the system for ensuring the quality of medicinal products at the distribution stage, and is also aimed at minimizing the risk of counterfeits, contamination and damage during transport and storage. The GDP regulates a variety of aspects such as batch traceability, documentation, risk management, staff training and much more.

In practice, the GDP is a key document for pharmaceutical companies involved in distribution. These organizations must adapt their distribution practices in line with GDP guidelines to meet legal requirements in Europe.

What is CFR?

CFR stands for “Code of Federal Regulations.” It is a collection of regulations and rules issued by various federal government agencies in the United States. The CFR is organized into different “titles,” each of which covers a specific subject area. These regulations are designed to provide detailed guidance and requirements for compliance with laws enacted by the U.S. Congress. Each CFR title is further divided into “parts,” which represent specific regulations within that title. For example, CFR Part 205 would refer to the regulations related to pharmaceutical wholesalers. 

CFR Part 21 encompasses a range of regulations related to the manufacturing, processing, packaging, labeling, and distribution of food, drugs, medical devices, and cosmetics in the United States. It covers topics such as good manufacturing practices (GMP), quality control, documentation, record-keeping, and other aspects of ensuring the safety, effectiveness, and quality of products regulated by the Food and Drug Administration (FDA).

The validation process in a pharmaceutical warehouse and the system life cycle

The validation process in a pharmaceutical warehouse is a fundamental step to ensure that computerized systems used in storage and distribution meet high standards of quality, safety and compliance with legal requirements. This comprehensive approach includes planning, designing, testing, implementation and monitoring of systems to ensure their technical and functional correctness, minimizing potential risks and errors. This process has a decisive impact on data integrity, avoiding errors and securing product quality throughout the supply chain.

The life cycle of a computerized system includes a series of closely related stages, from planning, design, installation and configuration to operation, developing the entire process from conception to decommissioning. This comprehensive approach ensures compliance with regulations and standards, minimizes the risk of failure and enables systems to function optimally over the long term. It is also crucial to constantly improve and adapt the systems to changing needs and technologies, which contributes to achieving operational excellence and excellent quality of medicinal products.

Process and the life cycle of the system in a pharmaceutical warehouse can be divided into several stages, these are not stages prescribed one to one from GAMP, CFR or GDP, but rather a combination of practical knowledge, good practices and the basics of GAMP:

Step 1: Validation planning

Validation planning is the first step in the process of validating a computerized system in a pharmaceutical warehouse. This is a key moment that forms the basis for the entire validation process. This step defines the goals, scope and timetable for the validation and defines the appropriate resources, procedures and documentation. The planning stage should consider the following points:

• Defining validation goals:

At the beginning of this stage, the validation goals are defined, i.e. what we want to achieve by carrying out the validation process. Objectives may include ensuring the quality of the system, compliance with industry regulations and GDP guidelines, and adapting the system to the needs of a pharmaceutical wholesaler.

• Determining the scope of validation:

An important step is also to determine the scope of validation, i.e. which parts of the computerized system will be subject to validation. The scope of validation may cover the entire system or its specific functions, modules or processes.

• Risk identification:

During validation planning, the risks associated with the system and the validation process are identified. This includes identifying potential threats to system quality, data security or compliance with regulatory requirements.

• Scheduling:

Validation planning includes setting a schedule that defines the order and timing of the various stages of validation. The schedule must be realistic and take into account the needs and availability of resources.

• Selection of validation methods and tools:

At this stage, the appropriate methods and tools that will be used to carry out the validation are selected. This includes the selection of appropriate tests, procedures, as well as data collection and analysis tools.

• Organization of the validation team:

During planning, a team responsible for carrying out the validation is organized. The team should consist of appropriate specialists in various fields, such as IT, pharmacy, quality or legal requirements.

• Documentation and procedures:

In this step, requirements for documentation and validation procedures are defined. All validation activities must be properly documented and procedures must be clear and comply with legal requirements.

• Determination of acceptance criteria:

Validation planning also requires the establishment of acceptance criteria to assess whether the validation process has been successfully performed. Acceptance criteria may include achieving specific test results, meeting quality requirements or compliance with regulations.

• Cost and resource assessment:

During planning, the costs associated with validation and the availability of appropriate resources, such as time, budget, equipment and personnel, are also assessed.

Step 2: Requirements specification

Requirements specification is one of the key stages in the validation process. This step defines the detailed requirements for each computerized system that will be validated. The requirements specification is a key document that forms the basis for designing, testing and evaluating the effectiveness of the system. The specification stage should consider the following points:

• Functional analysis:

In the requirement specification phase, a detailed analysis of the functionalities that the computerized system should meet is carried out. For a pharmaceutical wholesaler, this may include inventory management, order processing, quality control, temperature monitoring, batch tracking, reporting, etc. Functional requirements determine what features the system must have and how it should perform in different scenarios.

• Data security and integrity requirements:

Pharmaceutical wholesalers operate on sensitive data, such as data on medicinal products, information about suppliers and customers. Therefore, it is important to include aspects related to data security and data integrity in the requirements specification. These requirements include appropriate access controls, data security, mechanisms to protect against unauthorized access or manipulation.

• Compliance with regulations and industry guidelines:

Pharmaceutical wholesalers are subject to stringent legal regulations as well as industry guidelines such as GDP, CFR and the GAMP guide. The requirements specification must include compliance with these regulations and guidelines to ensure that the system meets legal and quality requirements. These requirements may concern both technical and procedural aspects related to the management of the system.

• Performance and scalability:

System performance requirements are also important, especially in pharmaceutical wholesalers, where order response time and access to data are critical. The requirements specification must specify the level of performance so that the system can handle the workload that will be placed on it in a production environment. In addition, the system should be scalable to adapt to changing needs and requirements in the future.

• Cooperation with other systems:

In a pharmaceutical warehouse, there are many different systems that must work together. The requirements specification must include requirements for integration with other systems, so that data is transferred in a consistent and error-free manner between different applications.

Step 3: Designing and configuring the system

Based on the requirements specification, a system design is created and configured in a way that ensures compliance with the assumptions and requirements and ensures compliance with the validation assumptions, legal regulations and quality requirements. Each modification in the project should be properly documented and verified. The design stage should take into account the following points:

• System design:

In the first part of this stage, a system design is created, i.e. a precise plan that defines how the system will work, what components it will contain, what will be the relationships between them and what will be the key functions and interfaces. The system design must take into account all the requirements contained in the requirements specification, ensuring that the system will fully meet expectations.

• Choosing the right technologies and solutions:

At this stage, decisions are made regarding the selection of appropriate technologies and solutions that will be used to implement the system. Choosing the right tools, hardware platform, and software is critical to achieving validation goals and ensuring optimal performance and security.

• Designing interfaces and integrations:

In a pharmaceutical warehouse, there are many different systems that have to work together. At this stage, interfaces and integration mechanisms are designed that will enable the correct exchange of data between systems. Consistency and correctness of data transfer is crucial for the efficient functioning of the warehouse.

• System configuration:

Once the design is established, the computerized system is set up. Configuration consists in adjusting the software, settings and parameters so that the system works as intended and required. Configuration tests are also performed at this stage to ensure that the system is ready for further validation steps.

• Ensuring compliance with regulations:

All design and configuration activities must be conducted in accordance with applicable industry regulations and guidelines such as GDP, CFR and the GAMP guide. Ensuring compliance with regulations is crucial to achieving acceptance and approval of the system for use.

• Documentation of the design and configuration process:

All actions and decisions taken during the design and configuration phase must be properly documented. Documentation is necessary for validation purposes to confirm that the system has been designed and configured as intended and required. Documentation may include documents such as functional specifications and technical specifications.

Step 4: System installation

At this stage, the computerized system is installed and deployed in a test environment. The installation process must be properly documented to enable it to be tested and assessed against validation assumptions and legal regulations. The installation stage should consider the following points:

• Environment preparation:

Before proceeding with the installation of the system, it is necessary to prepare the appropriate environment in which it will operate. The environment must comply with the validation assumptions and meet the technical requirements of the system. This includes both hardware infrastructure and relevant software such as operating system, databases, etc.

• Software installation:

Then, the actual installation and deployment of the computerized system software in the test environment is carried out. The installation process must be thoroughly documented so that all steps can be verified as required. 

• System configuration:

After installing the software, the system is configured according to the set parameters and requirements. The configuration must take into account the specific needs of the pharmaceutical warehouse and ensure the correct operation of the system.

• Installation Verification:

After the installation and configuration process is completed, it is verified that the system has been installed correctly. For this purpose, tests can be performed to check the functionality of the basic system functions and the general availability of the system to confirm that the system is ready for testing. It is verified that all components are properly installed and work as intended.

• Identification of possible problems:

Various types of problems or errors can occur during the installation process that need to be identified and documented. Identification of these problems allows to solve them and minimize the risk of similar situations in the future.

• Installation documentation:

It is important to keep accurate records of the entire installation process, including detailed hardware, software, configuration, and other relevant information. This documentation will be an important element in the subsequent stages of validation.

• Security and access:

Ensuring proper security and access to the system is crucial. Appropriate authentication, authorization and access control mechanisms should be set up to ensure data security and minimize the risk of unauthorized access.

• Preparation for validation tests:

After successfully completing the installation phase, the system is ready for further validation steps, such as functional testing, data integrity testing, performance testing, etc. All results and documentation from this step form the basis for subsequent validation activities.

Step 5: Testing the system

In this phase, various types of tests are carried out to assess whether the system works as intended and meets the specified requirements. The tests cover system functionality, data integrity, performance, and compliance with regulations. Test results are documented and analyzed. The testing phase should include the following tests:

• Functional tests:

Functional testing verifies that the system is operating in accordance with specified functional requirements. Various scenarios and use cases are performed to confirm that the system performs its functions in a correct and consistent manner.

• Performance tests:

Performance tests evaluate how the system behaves under load and whether it meets certain performance criteria. It is tested whether the system operates at a satisfactory speed and is able to handle the expected traffic and data volume in a real warehouse environment.

• Safety Tests:

Security tests verify that the system is adequately protected against threats and attacks, such as unauthorized access or leaks. Access control mechanisms, data encryption and other security measures are verified.

• Data integrity tests:

Data integrity tests are designed to ensure that the data stored and processed by the system are consistent with the assumptions, are not distorted and are not subject to loss. It is tested whether data is correctly entered, stored and transferred between the various components of the system.

• Access Control Tests:

Access control tests focus on verifying the effectiveness of authorization management mechanisms and access control to the computerized system. The purpose of these tests is to ensure that only authorized persons have access to the appropriate functions and data, which contributes to securing the system against unauthorized use and threats related to breach of confidentiality and information integrity.

• Backup and recovery tests:

Backup and recovery tests are designed to assess the effectiveness of data backup processes and restore the system to the state before the failure. These tests help ensure that in the event of data loss or system failure, full functionality can be restored quickly and efficiently and the computerized system continues to operate.

• Interface Tests:

Interface tests focus on assessing the correctness and effectiveness of communication and cooperation between different components or systems. Their goal is to ensure that the interfaces will function as expected, enabling the smooth flow of data and information, which is crucial for the integrity of the operation of a computerized system.

• Regression Tests:

Regression tests focus on checking whether changes made to the system did not cause unexpected side effects in the existing functionality. Their purpose is to ensure that new updates, fixes or changes have not compromised existing aspects of the system and that the system maintains its stability and consistency despite the modifications made.

All test results are thoroughly analyzed and documented. If problems or deviations from the assumed requirements are detected, the causes are identified and appropriate corrective actions are taken. Based on the test results, possible corrections and modifications to the system are made. Any bugs fixed are retested to make sure the issues are fixed. After all tests and corrections have been made, the entire testing process is formally approved. The approval confirms that the system meets the validation assumptions and is ready for further validation steps.

Step 6: Implementation and user training

The stage of implementing the system into the production environment is the key moment when the computerized system is transferred from the test stage to the production environment. This stage is intended to ensure a smooth transition of the system from the test environment to the production environment and to verify that the system performs as expected under real-world conditions. Here are some key aspects of this stage:

• Migration:

Before deploying to the production environment, organization should thoroughly prepare the system for the production environment (installation), making sure that it is fully ready to support real operations. A migration plan is created that outlines the steps, procedures, and responsibilities for moving the system to production. After the preparations are completed, the migration process takes place, which includes the transfer of the system, data and all configurations to the production environment. This process must be carefully monitored to ensure data correctness and integrity.

• Post-migration tests:

After the migration, tests are carried out in the production environment to verify that the system works as expected and meets the requirements of users and legal requirements. These tests help to detect possible problems, errors or inconsistencies.

• Procedures and instructions for use:

The implementation includes the introduction of appropriate procedures and instructions for using the system. The procedures specify what steps to take in different situations, how to use the system effectively and safely, and what to do in the event of problems. The instructions for use define the rules and limitations related to the use of the system for the end user.

• User training:

The key element of the implementation is the training of the end users, i.e. the personnel of the pharmaceutical warehouse who will use the system on a daily basis. The training aims to familiarize users with the functionalities of the system, its operation and procedures. All users should receive appropriate training before using the system.

• hypercare:

After the implementation of the system, its functioning is monitored and support is provided to users. The purpose of monitoring is to quickly detect any problems, failures or irregularities in the functioning of the system. User support allows to solve problems and answer questions, which increases the effectiveness and efficiency of using the system. The hypercare period usually lasts from several weeks to several months, depending on the complexity of the system and the degree of its implementation.

All activities related to system implementation and user training are thoroughly documented. The documentation includes a detailed description of the implementation process, training reports. At the end of the implementation and training stage, the warehouse staff is ready to fully use the system. All users are properly trained and ready to actively use the system in daily warehouse operations.

Step 7: Monitoring and maintenance (operation)

The exploitation phase of a computerized system is the phase in which the system goes into full production and daily use after completion of the implementation process. This is a key stage in which the system is used by users to perform various business tasks and achieve the goals of the organization. At this stage, organization focus on maintaining, optimizing and constantly improving the operation of the system.

The following key aspects occur during the exploitation phase:

• System maintenance:

System maintenance is a process whose aim is to ensure constant performance, reliability and compliance of the system with the requirements and expectations of users. By monitoring, diagnosing, and taking maintenance and corrective actions, the organization ensures business continuity and minimizes potential disruptions. This process also includes updating, optimizing and improving the system in response to changing business needs over the long term.

• Change management:

Change management is a structured process that aims to control the introduction of modifications, updates or new features to an existing system. Through strict planning, testing and implementing changes, the organization minimizes the risk of disruption to operations and maintains system integrity. This process includes user impact assessment, risk analysis, and process documentation to ensure consistent and secure management of the evolution of computerized systems.

• Deviation management:

Deviation management refers to irregularities, anomalies or unexpected events that may occur in the functioning of the system. Their identification, analysis and appropriate response are an important element of ensuring operational continuity and system integrity. The deviation management process includes documenting incidents, their classification and taking corrective actions aimed at restoring the optimal state of the system and minimizing potential risks.

• User training and development:

In the operation phase, user training is continued, and it is also possible to improve skills and knowledge related to the operation of the system, which contributes to minimizing errors and optimal use of its capabilities. This process also allows users to adapt to possible changes, updates or new system functions, and also promotes the active participation of users in improving processes and services related to the system.

• Periodic reviews:

Periodic reviews are regular assessments to monitor the performance, compliance and security of systems. System analysis identifies potential issues, upgrades, and improvements to ensure systems are reliable, efficient, and compliant with organizational and regulatory requirements.

• Revalidation:

As time passes and significant changes are made to the system, it may be necessary to revalidate. Therefore, care should still be taken to properly document activities, test results and procedures to facilitate future revalidations.

Regular monitoring and maintenance of computerized systems in a pharmaceutical warehouse are crucial to ensure their uninterrupted and safe operation. The introduction of appropriate procedures guarantees that the system can continue to meet legal requirements, minimize the risk of failures and errors.

Stage 8: Withdraw of the system

The system end-of-life phase is an important process to bring a computerized system to a controlled and safe end of operation. At this stage, a system that has reached the end of its life or is replaced with a newer version is taken out of daily use. A system recall must be performed in accordance with regulatory requirements and industry best practices to ensure a safe and controlled system shutdown. Here are some key aspects of this stage:

• Withdraw planning:

At the beginning of this stage, a system rollback plan is developed. The plan should specify the reasons for the withdraw, the timing of the withdraw, and a description of the actions and procedures that will be performed to successfully retire the system.

• Impact assessment:

Before proceeding with the actual withdrawal, an assessment of the impact of the withdrawal of the system on the operation of the pharmaceutical wholesaler is carried out. Warehouse operations, data availability, and other key features are verified to be unaffected by the withdraw.

• Secure data storage:

Before retiring the system, ensure that all data, documentation and other relevant information that may be needed in the future is securely stored. Data security is designed to avoid loss or unauthorized access to key information.

• Communication:

An important element of a system withdraw is both internal and external communication. Pharmaceutical warehouse personnel and system users must be adequately informed about the planned recall and any changes and actions resulting from this process.

• Carrying out a withdraw:

At this stage, the actual withdraw of the system is performed. Actions may include stopping the use of the system, removing it from the warehouse’s network and IT infrastructure, and transferring or archiving data in a secure and compliant manner.

• Withdraw Process Documentation:

The entire system withdraw process must be properly documented. The documentation should include a description of the activities carried out, dates and deadlines, confirmations of the implementation of the various stages and any decisions made during the process.

The end-of-life stage is an important step in managing the life cycle of a computerized system, which aims to ensure a smooth transition to new technologies and solutions, minimizing disruption and risk to the organization.

Documentation and archiving in the context of validation in a pharmaceutical wholesaler:

Documentation and archiving play a key role in the validation process in a pharmaceutical wholesaler, providing traceability, compliance and proof of the correctness of computerized processes and systems.

The documentation includes a comprehensive set of information such as the validation plan, qualification protocols, test protocols, analysis results, system changes and user training. This detailed documentation allows to reconstruct the entire validation process and provides transparency, which is crucial in the context of audits and quality assurance.

Archiving, on the other hand, consists in storing and managing documentation in a manner appropriate to the retention period and legal regulations. The archives contain the history of changes in systems, processes and documentation, which enables verification of past activities and tracking the evolution of systems over time. Archiving is also necessary from the perspective of meeting the regulations and documenting the actions taken in the validation process.

All these activities in the area of documentation and archiving are aimed at maintaining integrity, compliance and quality in the pharmaceutical warehouse, while creating a coherent environment enabling effective system validation. 

Summary

In conclusion, the validation process of computerized systems in a pharmaceutical warehouse is a fundamental step in ensuring the quality, safety and efficiency of operations related to the storage and distribution of medicinal products. It is a comprehensive strategy that includes a number of closely coordinated stages, from planning and requirements specification, through design, testing, implementation, to full operation of the system.

The purpose of validation is not only to ensure that computerized systems work correctly and as expected, but also to ensure compliance with pharmaceutical industry regulations such as Good Distribution Practice (GDP) or Code of Federal Regulations (CFR).

Validation of computerized systems translates into confidence that data, product information and documentation are accurate, confidential and integral. This allow to avoid potential threats to the quality of medicinal products, as well as minimize the risk of human errors or system failures, which is particularly crucial in the context of the sensitive pharmaceutical sector.

Piotr Frelek

Professional Validation Specialist