A risk assessment is presented for determining the amount of qualification and validation work required to show that instruments
and computerized laboratory systems are fit for their intended purpose.
Risk management is one of the new requirements for the pharmaceutical industry following the publication of the Food and Drug
Administration's (FDA) "Good Manufacturing Practices (GMPs) for the 21st Century" (1) and the International Conference on Harmonization (ICH) Q9 on Quality Risk Management (2). How much qualification and
validation work is required in connection with a regulated task is dependent on a justified and documented risk assessment.
The United States Pharmacopeia (USP) General Chapter <1058> (3) on analytical instrument qualification (AIQ) has an implicit risk assessment in that it classifies
instrumentation used in a regulated laboratory into one of three groups: A, B, or C. The chapter defines the criteria for
each group, but leaves it to individuals to decide how to operate the classification in their own laboratories.
Software is pervasive throughout the instruments and systems in groups B and C, as acknowledged by <1058> (3). From a software
perspective, Good Automated Manufacturing Practice (GAMP) 5 Good Practice Guide (GPG) for Validation of Laboratory Computerized Systems
(4) is widely recognized within the industry and by regulators, but it is not consistent with some of the elements of USP <1058>. The USP general chapter is currently under revision and ideally the revised version will be fully compatibility with the GAMP 5 guidelines and good practice guides (4–6). In the meantime, however, users are left with a question: Do I follow USP <1058> or GAMP 5? We shall answer this question here.
Some Problems with USP <1058>
In November 2010, there was an American Association of Pharmaceutical Scientists (AAPS) meeting in New Orleans, Louisiana,
where the status of <1058> was debated. That same month Bob published some of his thoughts about the advantages and disadvantages
of that general chapter (7). The advantages consisted of the classification of instruments and systems, which was also its
greatest disadvantage, as it was too simplistic. Simply saying that an instrument fit into group B ignored the possibility
that there were in-built calculations that needed to be verified because of 21
CFR 211.68(b) requirements (8) or that some instruments enable users to build their own programs. Furthermore, the approach to
software for group C systems was na´ve as it placed the responsibility for validation on the supplier rather than the user.
Chapter <1058> also referenced the FDA guidance for industry entitled General Principles of Software Validation (9), which was written primarily for medical devices; the configuration and customization of software is not mentioned there.
GAMP Good Practice Guide for Laboratory Systems Updated
The publication of the first edition of the GAMP Good Practice Guide for Validation of Laboratory Computerized Systems (5) had some problems. However, in the recently published second edition (6), the good practice guide was aligned with GAMP 5 (4) and was updated to be risk-based (as reflected in the new title). Collaboration with us during the writing enabled both
the good practice guide and the new draft of USP <1058> (11) to be more closely aligned and have a unified approach to qualification and validation of instruments and computerized
laboratory systems. (The GAMP GPG uses the term laboratory computerized system in contrast to the more common term of computerized laboratory system; however the two terms are equivalent.) We have a paper soon to be published that maps the two approaches and shows that they
are very similar despite some differences in terminology (12).
Progress Updating USP <1058>
The original basis of USP <1058> was the 2004 AAPS white paper "Analytical Instrument Qualification," which focused on a risk-based approach to AIQ
by classifying apparatus, instruments, and systems depending on the laboratory's intended use. The definition of the intended
use is the key part of the process, because the same item could be classified in any of the three groups depending on its
use. Intended use is also an essential part of our risk assessment presented in this column.
However, the current weakness of the overall risk-based approach is the way in which software is assessed. Software is pervasive
in group B instruments and group C systems. Chapter <1058> currently references the FDA guidance document, General Principles of Software Validation (9). This guidance was written primarily for medical device software, which is neither configured (modified to the business
process by vendor supplied tools) nor customized (writing software macros or modules that are integrated with the application).
Given that many analytical instruments and systems are configured or customized, this guidance does not fit well in a regulated
GxP laboratory environment.
In January 2012, we published a stimulus to the revision process in the on-line version of Pharmacopeial Forum (13), in which we proposed an update for USP <1058>. In our proposal, instrument qualification was integrated with computerized system validation rather than being two
separate activities. This would provide regulated laboratories with the opportunity to reduce the amount of work and avoid
potential duplication. In this publication, we included a risk-assessment flow chart for determining the amount of work to
perform to qualify analytical instruments and, where appropriate, validate the software functions and applications. From the
comments received, we updated the flow chart. We present it here as a simplified method for classifying the apparatus, instruments,
and systems in your laboratory.