Is Cloud Computing Open or Closed System according to 21 CFR Part 11?

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

Basics of Cloud Computing Technology
Regulations and Expectations of Inspectors
Customer-Supplier-Relationship
Requirements for Cloud Service Providers (CSP)
Requirements for Supplier Evaluation and Supplier Audits
Requirements for Qualification / Validation
The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 24: If the pharmaceutical user has data in the cloud, what type of system is it? Is this an open or closed system according to 21 CFR Part 11? - Basics of Cloud Computing Technology
This is easy to answer using the definition below, even if it is an "on-premise" application: "It is an open system". The cloud provider carries out the compliance checks. The pharmaceutical company can only introduce the corresponding controls via contracts and check them via audits. Therefore, direct control is not possible!
Definition 21 CFR Part 11 § 11.3:

(a) The definitions and interpretations of terms contained in section 201 of the act apply to those terms when used in this part.
(b) The following definitions of terms also apply to this part:
 - (4) Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.
- (9) Open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.

Comments

Post a Comment

Popular posts from this blog

FDA describes detailed CAPA Procedure in Warning Letter

An FDA Warning Letter is a formal communication from the US Food and Drug Administration (FDA) notifying a company or individual of regulatory violations. These typically describe observations made during an inspection and list violations found (referencing the specific sections of the FD&C Act, the Code of Federal Regulations (CFR), and other applicable laws as appropriate). In addition, specific measures are listed that the recipient must take to remedy the violations. It does not go into great detail, especially not with regard to instructions on the desired procedure. In a Warning Letter issued to Sun Pharmaceutical Industries Limited (India) at the beginning of July, this is now different. It describes in great detail what the FDA considers to be appropriate CAPA measures in a specific case. What happened? The company was criticised for not adequately cleaning and maintaining the equipment used to manufacture drug products. According to the company's response, a defective ...
Read more

FDA Warning Letter Missing Ongoing Stability Studies for APIs

Company Antaria Pty. Ltd, Australia Synopsis  1.Inadequate Investigation  2. Own Analytal Methods used but proved to equivalent to USP methods 3.Annual Stability missed 1.Failure to adequately investigate and document out-of-specification results and implement appropriate corrective actions . Your firm manufactures API (b)(4) USP, labeled in part to be the active ingredient used in (b)(4). You failed to adequately investigate out-of-specification (OOS) test results. Specifically, your firm lacked adequate investigations and corrective actions for numerous OOS results obtained during laboratory testing of your API, including assay and loss on ignition (LOI) testing. The root causes were not clearly defined nor adequately documented, and lots with OOS results were released by your quality unit (QU). In your response, you state that staff turnover and insufficient staff training attributes to the lack of competency in good laboratory practices . Additionally, you state that you...
Read more

Understand ICH Q7

What is meant by ‘quality unit(s) independent from production The intent of the term ‘independent’ is to prevent any conflict of interest and ensure unbiased decision-making regarding quality-related decisions in the organization structure. The person in the quality unit who is responsible for final decision-making (e.g., batch release decision) should not have responsibilities for production activities [ICH Q7, 2.13]. Does ICH Q7 expect that the quality unit performs API release testing While the quality unit has responsibility for the release of the API, which includes oversight of the testing and results, ICH Q7 does not prescribe specifically who performs testing. ‘Quality control’ in the ICH Q7 Glossary [ICH Q7, 20] refers to the activities, not the organisational structure. For examples of quality responsibility related to testing and release, refer to [ICH Q7, 2.13, 2.22, and 11.12]. Appropriate laboratory controls should be followed [ICH Q7, 11.10, 16.10] regardless of who ...
Read more