A Complete Guide to Computer System Validation (CSV)

ADDENDUM: Addenda, an addition to a document.

REGRESSION ANALYSIS AND TESTING: A task of verification and validation of software to the extent of analysis and testing.  Verification and validation should be repeated when changes are made to a component or system software previously discussed.

APPLICATION SOFTWARE: Software installed on a platform/hardware that provides specific functionality. Software or program that is specific to the solution of the application problem (GAMP5).

ARCHIVE: It is the process by which records are protected from the possibility of modification or deletion, and these records are stored under independent data control for the required retention period. Archived records must include, for example, associated metadata and electronic signatures.

AUDIT TRAIL (data audit): The audit trail is a form of metadata that contains information about actions associated with the creation, modification or deletion of GxP records. A data audit provides a secure record of life cycle details such as creation, addition, deletion or modification of information in a log, paper or electronic, without hiding or overwriting the original record. A data audit facilitates the reconstruction of the history of such record-related events, regardless of medium, including the “who, what, when and why” of the action.

AUDIT: Systematic, independent and documented process for obtaining audit evidence (records, factual statements or other information) and its objective evaluation to determine the extent to which audit criteria (set of policies, procedures or compliance process requirements used as reference) have been met.

BACKUP: A security copy. It is a copy of one or more electronic files made as an alternative in case the original data or system is lost or becomes unusable (for example, in the event of a system failure). It is important to note that the backup file differs in that backups of electronic files are usually stored only temporarily for the purpose of disaster recovery and may be overwritten periodically. Such temporary backups should not be considered a mechanism file.

BIOMETRIC: The method of verifying the identity of an individual based on the measurement of the physical characteristics of the individual(s) or repeatable action(s) if those characteristics and/or actions are measurable specifically for each individual.

BIOMETRIC DEVICE: They are used in computerized security systems primarily to identify physical characteristics such as facial features, eye patterns, fingerprints, voice and writing.

GOOD DOCUMENTATION PRACTICES: In the context of these guidelines, good documentation practices are measures that collectively and individually ensure that documentation, whether paper or electronic, is secure, attributable, legible, traceable, permanently and simultaneously recorded, original and accurate.

BUSINESS CONTINUITY PLAN: A documented and maintained plan to define the ongoing process supported and funded by management to ensure that necessary steps are taken to identify the impact of potential losses, maintain strategies for viable recovery and recovery plans, and ensure continuity of services of the written plan through staff training, testing and maintenance plan.

BUSINESS CONTINUITY PLANNING: A managed process for developing and maintaining interorganizational plans to counteract disruptions to business operations.

INSTALLATION QUALIFICATION OR INSTALLATION VERIFICATION TESTS: Documented that a system has been installed according to written specifications for design and configuration verification.

INSTALLATION QUALIFICATION: A documented evidence that equipment, facilities and systems have been installed according to previously established design specifications.

OPERATIONAL QUALIFICATION: A documented evidence that equipment, facilities and systems consistently operate according to previously established design specifications.

PERFORMANCE QUALIFICATION OR PERFORMANCE VERIFICATION TESTS / REQUIREMENTS: Documented that a system is capable of performing or controlling the activities of required processes according to requirements and user specifications written in your business environment and computer testing.

OPERATIONAL QUALIFICATION OR OPERATIONAL / FUNCTIONAL VERIFICATION TESTS: Documented that a system operates according to the operational specifications written along sets of specified operation checks.

QUALIFICATION: This is the performance of specific tests based on scientific knowledge to demonstrate that equipment, critical systems, facilities, personnel and suppliers meet previously established requirements, which must be completed before processes are validated. 

CAPAs: Corrective and preventive actions

CHANGE CONTROL: The process of ensuring that a computerized system remains valid following a change. It includes assessing the effect of the change to determine when and if repetition of a validation or verification process or a specific part of it is necessary for appropriate action to ensure that the system remains in a validated state.

LIFE CYCLE: All phases in the life of the system from initial requirements to retirement, including design, specification, programming, testing, installation, operation and maintenance.

Client-Server: The client-server model describes the interaction process between the local computer (the client) and the remote (server).
The client makes its requests (queries, applications, requests) to the server, which processes this request and sends the results back to the appropriate client.
Typically, clients and servers communicate with each other over a network, but they can also both be in the same system (same hardware).

CODING: It is the process of converting information from a source into symbols for communication. In other words, it is the application of the rules of a code.
The reverse process is decoding, that is, the conversion of these symbols into information that can be understood by the receiver.

CONFIGURATION: The adaptation of a software application or hardware element to other elements of the environment and the specific needs of the user.

CHANGE CONTROL (Parenteral Drug Association (PDA)): A formal process by which qualified representatives of appropriate disciplines review proposed or actual changes to a computer system. The main purpose is to document the changes and ensure that the system remains in a state of control.

CHANGE CONTROL AND MANAGEMENT OF DEPARTURES: Documented system for change control, including assessment and effect of proposed change on processes, computer systems.

COTS (COMMERCIAL OFF-THE-SHELF SOFTWARE): Commercially Available Software Direct Sales; a software component supplied by the supplier of a computerized system for which the user cannot claim full control over the software life cycle. Commercially available software whose suitability for use is demonstrated by a broad spectrum of users.

REQUIREMENT CRITERIA (IEEE): The criteria that a system component must meet to be accepted by a user, customer or other authorized entity.

DATA GOVERNANCE: All provisions to ensure that data, regardless of the format in which it is generated, is recorded, processed, retained and used to ensure complete, consistent and accurate recording throughout the data life cycle.

MASTER DATA: Unique data used on a shared basis by multiple users for different purposes.

DATA: Original records are true copies, including source metadata and all subsequent transformations. These reports are generated and recorded at the time of the GxP activity data. Data must be accurately captured by permanent means at the time of the activity. Data may be contained in paper records (such as worksheets and logs), electronic records and audit trail, photographs, microfilm or microfiche, audio or video, or any other means by which information related to GxP activities is captured.

DATA LIFE CYCLE: All phases of the process in which data is created, recorded, processed, reviewed, analyzed and reported, transferred, stored and retrieved and monitored until its disposal and destruction. Plans should be in place to assess, monitor and manage the data and the risks associated with that data in relation to the potential impact on patient safety, product quality and/or reliability of decisions made at all stages of the data life cycle. The set of records of all information relevant to the process in physical or electronic form. The computer system consists of hardware, software and network components, along with control functions and associated documentation. Tests performed to determine whether or not the system meets the acceptance criteria and to enable the customer to determine acceptance of the system. See also Factory Acceptance Test (FAT) and Site Acceptance Test (SAT).

ENCRYPTION: Encryption is the process of making information deemed important unreadable. Once encrypted, information can only be read by applying a key. This is a security measure used to store or transfer sensitive information that should not be accessible to third parties. It may include passwords, credit card numbers, private conversations, etc.

PRODUCTION ENVIRONMENT: The business and computing environment in which a computerized system is used by end users. Computerized systems for regulated production environment is the business and computing environment in which the computerized system is used for regulated good laboratory practices.

USER REQUIREMENT SPECIFICATIONS (URS): If prepared as a separate document, this is a formal document defining the requirements for using the system software on your planned production environment.

FUNCTIONAL SPECIFICATIONS: The functional specification document. This defines the functions and technology solutions specified for the computer system based on the technical requirements to meet the user requirement specifications (e.g., the specified bandwidth needed to meet the user requirements for the expected use of the system).

FDA: Food and Drug Administration, U.S. regulatory agency.

FDA Compliance Policy Guide 7153.17: Those that do not comply with 21 CFR Part 11 and were started on old computer hardware prior to August 20, 1997.

DIGITAL SIGNATURE: The electronic signature based on cryptographic methods for authenticating the sender, using a set of rules and a set of parameters capable of verifying the overall identity of the signer and the integrity of the data.

ELECTRONIC SIGNATURE: Compilation of computer data or a symbol or series of symbols executed, adopted or authorized by a person to be legally attested and equivalent to the person’s handwritten signature.

FIRMWARE: It is a program fixed on a ROM memory and logic sets the lowest level that controls the electronic circuits of a device. It is considered part of the hardware to be integrated into the electronic device as well as software, it provides logic and is programmed by some kind of programming language. The firmware receives external commands and responds to control the device.

STATIC RECORD FORM: Static record format like a paper record or PDF. It is one that is “fixed” and allows limited interaction between the user and the contents of the record. For example, a static record, once printed or converted to PDF files, cannot be reprocessed or allow more detailed baselines or display hidden fields.

GAMP: Good Automated Manufacturing Practices

GAP: G: Good, A: Average, P: Poor.

CONFIGURATION MANAGEMENT: A discipline that applies engineering, management, and supervision to identify and document the functional and physical characteristics of a configuration item. Management of changes to those characteristics, recording and reporting of change processing and implementation, and verification of compliance with specified requirements.

GxP: Acronym group of good practice guidelines for preclinical activities, clinical activities, manufacturing, testing, storage, distribution and post-marketing of pharmaceuticals, biologics and regulated medical devices, such as good laboratory practices, good clinical practices, good manufacturing practices, good pharmacovigilance practices and good distribution practices.

HARDWARE (HW): It is the physical part of a computer or computer system; it consists of electrical, electronic, electromechanical and mechanical components such as cable circuits and light circuits, motherboards, utilities, chains and other material, physical state, whatever it takes to make the team work.

GxP IMPACT: Action that can directly or indirectly affect regulatory compliance, quality policy, product quality and consumer perception.

INFORMATION: It consists of a group of data and ordered surveillance that serve to build a system based on a particular phenomenon or message from an entity. Information can solve problems and make decisions because its rational use is the basis of knowledge.

INFRASTRUCTURE: Hardware and software, and network software and operating systems, or in general, that allows the application to operate.

DATA INTEGRITY: It refers to the extent to which data are complete, consistent, accurate and reliable and that these characteristics are maintained throughout the life cycle of the data. Data must be collected and stored securely so that it is attributable and readable, while being original or a true and exact copy. Ensuring data integrity requires adequate quality systems and risk management, including adherence to sound scientific and good documentation practices.

ISO: International Organization for Standardization

IT: Information Technology

MAINTENANCE OF VALIDATED STATE: Maintenance of facilities, equipment and systems is another important step to ensure that the process remains under control. Once that is achieved, the qualified/validated status must be maintained through routine monitoring, maintenance, calibration procedures and programs.

METADATA: Metadata are data  that provide contextual information about other data needed to understand the data. This includes structural and descriptive metadata. These data describe the structure, data elements, interrelationships and other characteristics of the data. They also allow data to be attributed to a person. The metadata needed to assess data significance should be linked to data security and properly evaluated. For example, in weighting, number 8 is meaningless without metadata, i.e., the mg unit. Other examples of metadata are stamp date/time of an activity, the operator identification (ID) of the person who performed an activity, the ID of the instrument used, processing parameters, sequence files, etc. 

WHO: World Health Organization

PC: Personal Computer

PERIPHERAL: It is called peripheral and/or auxiliary and independent devices that are connected to the central processing unit of a computer, making input/output (I/O) complementary.

VALIDATION MASTER PLAN (VMP): The document containing information about the validation activities performed that establishes details and timelines for each validation work to be performed. Responsibilities related to the plan should be established in accordance with GMP. Systematic, independent and documented process for obtaining audit information and objective evaluation to determine the extent to which agreed criteria have been met.

PROGRAMMABLE LOGIC CONTROLLER (PLC): Hardware element that can be programmed to make decisions based on logical arguments (in the form of electrical signals that activate or deactivate a function). The PLC and connecting elements are considered Category 2 or modified hardware.

SOP: Standard Operating Procedure

PROCESS OWNER OR LANDLORD: The person responsible for the business process.

SYSTEM OWNER OR LANDLORD: The person responsible for the availability and maintenance of the security of a computerized system and the data contained in that system.

PROTOCOL: The written work plan that defines the objectives, procedures, methods and acceptance criteria for an investigation.

REQUIREMENT TEST (IEEE): It represents that stage of the software development life cycle in which the development team and the user area of an information system must ensure that the developed system conforms to the defined requirements.

USER REQUIREMENT TEST: Verification of fully computerized configured system installed in the production environment (or in an environment equivalent to the validation production environment) for, as intended, the computerized business process when standard end users trained in operational procedures are operating and that they define the use and control system. User requirement testing can be a part of performance qualification (PQ) or a separate step in PQ.

DISASTER RECOVERY: Process for planning or deploying resources to restore normal commercial function in the event of a disaster.

REGISTRATION OF LOTS: The set of records of all information relevant to the process in physical or electronic form.

ELECTRONIC RECORD: Any combination of text, graphics, data, audio, image or other representation of information in digital form that is created, modified, archived, retrieved or disseminated by a computer system.

VALIDATION REPORT: Document that states the conclusion and determines whether or not the system meets suitability to use force and good practice.

SCADA: Software for Supervisory Control and Data Acquisition. Often used to automate processes, it served as PLC hardware component to manage the actions by which the system takes control of the process.

SYSTEM SECURITY: Ensure the confidentiality, integrity and availability of their systems and networks. Security is divided into physical security and logical security.

SERVER: A server is a computer that is part of a network and provides services to other client computers.

QMS: Quality management system

OPEN SYSTEM: An environment in which access to the system is not controlled by persons responsible for the content of electronic records contained in the system.

CLOSED SYSTEM: An environment in which access to the system is controlled by persons responsible for the content of electronic records contained in the system. 

CUSTOM COMPUTER SYSTEM: A computerized system individually designed for a specific business process.

COMPUTERIZED/COMPUTER SYSTEM: Any equipment, process or operation that has attached to it one or more computers and associated software or a group of hardware components designed and assembled to perform a specific set of functions.

COMPUTERIZED/COMPUTER SYSTEM: A functional unit of one or more computers and associated input and output devices, peripherals and software, utilizing common storage for all or part of a program and all or part of the data necessary for program execution. 

QUALITY MANAGEMENT SYSTEM: Represents the set of measures taken in a planned and systematized manner to ensure that pharmaceutical products are of the quality required for their intended use. Quality Management therefore incorporates GMP, GDP, GLP, GDP, GVP, and Risk Management principles. Including the use of appropriate tools.

COMPUTER SYSTEM: A system containing one or more computers and associated software (IEEE).

COMPUTERIZED SYSTEMS: A computerized system collectively controls the operation of one or more automated processes and/or functions. It includes hardware, software, peripheral devices, networks, and documentation, e.g., manuals and standard operating procedures, as well as personnel who interface with the hardware and software, e.g., users and IT support personnel.

LEGACY SYSTEMS: A computer system that has become obsolete, but continues to be used by the user and is unwilling or unable to be easily replaced or upgraded.

SLA: Service Level Agreement, a written agreement between a service provider and its customer to set the agreed level of service quality.

OS: Operating System

INFRASTRUCTURE SOFTWARE: Infrastructure platform on which business software and systems operate or improve their operation.

BUSINESS SOFTWARE: Software used for business processes, which may include those subject to regulatory compliance. Software defined by a market-driven need, commercially available, and whose fitness for use has been demonstrated by a broad spectrum of business users. Software or a specific program for the solution of an application problem.

SOFTWARE (SW): A set of computer programs, instructions and rules for executing certain tasks on a computer.

THIRD PARTIES: Parties not directly managed by the holder of the manufacturing and/or import authorization.

TOKEN: It is a string of characters that has a coherent meaning in a certain programming language. Examples of tokens could be keywords (if, while, int…), identifiers, numbers, signs, or a multi-character operator (e.g. :=). They are the most basic elements on which any translation of a program is developed, they arise in the first phase, called lexical analysis, but are still used in the following phases (syntactic analysis and semantic analysis) before being lost in the synthesis phase.

USER: A person who uses a device or computer and performs multiple operations for different purposes. A user is often a person who acquires a computer or electronic device and uses it to communicate with other users, generate content and documents, use software of various types and many other possible actions.

COMPUTER SYSTEM VALIDATION (CSV): Documented process of ensuring that a computer system does exactly what it was designed to do in a consistent and reproducible manner (SUITABILITY FOR USE), guaranteeing data integrity and security, product quality and compliance with applicable GxP regulations.

VALIDATION OF COMPUTERIZED SYSTEMS: It is the confirmation by verification and provision of objective evidence that the specifications of the computerized system conform to the needs of the users and intended uses and that all requirements can be consistently met.