Effective and practical risk management options for computerised system validation

Risk management and risk assessment for computerised systems validation is a key regulatory issue following the Food and Drug Administration's (FDA) reassessment of the 21 Code of Federal Regulation (CFR) Part 11 regulations (Electronic Records and Electronic Signatures final rule). This paper reviews the GXP (i.e. Good Laboratory Practice (GLP), Good Clinical Practice (GCP) and Good Manufacturing Practice (GMP)) regulatory requirements and associated guidance documents and then focuses on the International Standards Organisation (ISO) 14971 risk management process and vocabulary for an overall risk management framework. Several risk analysis methodologies are presented and assessed for their applicability for computerised system validation (CSV). The conclusion is that one methodology does not fit all situations and the prudent professional should select the best methodology applicable for the problem at hand. Finally, an overall risk management process flow for CSV is presented and discussed based on two questions: ‘Do I need to validate the system?’ and if so, ‘How much work do I need to do?’ A single integrated document is presented as an alternative to a full V-model for the validation of lower risk computer systems. Copyright © 2005 John Wiley & Sons, Ltd.