Regulatory Open Forum

Hello,

As per ISO 13485, 7.5.6, The organization shall document procedures for the validation of the application of computer software used in production and service provision. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application. The specific approach and
activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software, including the effect on the ability of the product to conform to specifications.

Could someone explain me in simple words why ERP/MRP system software validation is imp.?

Why it's critical to medical device as it has less impact to medical devices?

We are going to use new software and management asked me why we need for this within our QMS and the benefit it brings to the organization?

Your response would be highly appreciated.

Thanks

As you correctly recite, ISO 13485 (and other authorities like the U.S. FDA) require computer software to be validated if that software is used as part of the quality management system (QMS) or device production.  The most fundamental reason for this is the very same reason that we are required to have a QMS that conforms with ISO 13485, FDA, or other Good Manufacturing Practices (GMP) requirements in the first place. Specifically, history has shown that without a QMS covering certain GMP aspects (like QMS or process software validation, among many other topics), there are more medical device safety issues, patient injuries, unsatisfied customers, public health problems, and the like.

An MRP system is not immune to this phenomenon. Specifically, MRP subsystems such as modules for control of suppliers, manufacturing, inventory, device release, device tracking, etc., are the same kinds of GMP subsystems for which GMP controls are in any case demanded by ISO 13485, FDA, etc. Regardless of whether those subprocesses are automated with the aid of computer software or if they are instead done manually, GMP controls are still required. And when software is involved, it adds yet another layer of unique risks; thus the consequent need for expert software validation.

The good news is that we are allowed to set the extent of our software validation efforts commensurate with risk and complexity. That allows us a surprising amount of liberty, which is how we can devise software validation protocols that are as efficient and nimble as possible. If, the validation team has a fluent expertise in the fundamentals and science of medical device QMS or production software validation, then the effort can be surprisingly efficient. In contrast, lack of such expertise dramatically increases the costs, risk, and frustration of these validations.

My group's software validation specialists who helped write the world's gold standards just wrapped up an MRP system validation and we would be glad to assist you if needed. We apply the latest risk-based best practices and gold standards, along with, in this case, FDA's budding approach called Computer Software Assurance.

------------------------------
Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright by ComplianceAcuity, Inc. All rights reserved.

Original Message:
Sent: 02-May-2024 17:59
From: Anonymous Member
Subject: Software Validation - SAP/MRP System

This message was posted by a user wishing to remain anonymous

Hello,

As per ISO 13485, 7.5.6, The organization shall document procedures for the validation of the application of computer software used in production and service provision. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application. The specific approach and
activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software, including the effect on the ability of the product to conform to specifications.

Could someone explain me in simple words why ERP/MRP system software validation is imp.?

Why it's critical to medical device as it has less impact to medical devices?

We are going to use new software and management asked me why we need for this within our QMS and the benefit it brings to the organization?

Your response would be highly appreciated.

Thanks

Hello Anon

Your required validation exercise isn't testing that SAP's software actually works. What you're checking is that your configuration does what you need it to do.

(It's not that we never find bugs in commercial off-the-shelf software, but when you select a good supplier, they should be rare.)

The biggest value to the company from the requirement to validate the software probably comes when you start by defining what you need the software to do. When you get the various stakeholders to write down, unambiguously, what they expect from the system, and how it will integrate with various processes and with other tools, you are very likely to find gaps and mismatched expectations that will need to be resolved one way or another before the whole thing comes together in a usable way. By the time you try out all the steps in your processes in the sandbox, before the system goes live, you will see if all the inconsistencies have been worked out.

And you definitely want to try out the system before go-live. It would be very inconvenient to discover that certain parts weren't integrated correctly, preventing you from buying components, creating work orders, processing nonconformances, entering sales orders, printing labels, shipping devices to customers, or anything else you thought the system was going to let you keep doing.

As you correctly recite, ISO 13485 (and other authorities like the U.S. FDA) require computer software to be validated if that software is used as part of the quality management system (QMS) or device production.  The most fundamental reason for this is the very same reason that we are required to have a QMS that conforms with ISO 13485, FDA, or other Good Manufacturing Practices (GMP) requirements in the first place. Specifically, history has shown that without a QMS covering certain GMP aspects (like QMS or process software validation, among many other topics), there are more medical device safety issues, patient injuries, unsatisfied customers, public health problems, and the like.

An MRP system is not immune to this phenomenon. Specifically, MRP subsystems such as modules for control of suppliers, manufacturing, inventory, device release, device tracking, etc., are the same kinds of GMP subsystems for which GMP controls are in any case demanded by ISO 13485, FDA, etc. Regardless of whether those subprocesses are automated with the aid of computer software or if they are instead done manually, GMP controls are still required. And when software is involved, it adds yet another layer of unique risks; thus the consequent need for expert software validation.

The good news is that we are allowed to set the extent of our software validation efforts commensurate with risk and complexity. That allows us a surprising amount of liberty, which is how we can devise software validation protocols that are as efficient and nimble as possible. If, the validation team has a fluent expertise in the fundamentals and science of medical device QMS or production software validation, then the effort can be surprisingly efficient. In contrast, lack of such expertise dramatically increases the costs, risk, and frustration of these validations.

My group's software validation specialists who helped write the world's gold standards just wrapped up an MRP system validation and we would be glad to assist you if needed. We apply the latest risk-based best practices and gold standards, along with, in this case, FDA's budding approach called Computer Software Assurance.

------------------------------
Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright by ComplianceAcuity, Inc. All rights reserved.

Original Message:
Sent: 02-May-2024 17:59
From: Anonymous Member
Subject: Software Validation - SAP/MRP System

This message was posted by a user wishing to remain anonymous

Hello,

As per ISO 13485, 7.5.6, The organization shall document procedures for the validation of the application of computer software used in production and service provision. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application. The specific approach and
activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software, including the effect on the ability of the product to conform to specifications.

Could someone explain me in simple words why ERP/MRP system software validation is imp.?

Why it's critical to medical device as it has less impact to medical devices?

We are going to use new software and management asked me why we need for this within our QMS and the benefit it brings to the organization?

Your response would be highly appreciated.

Thanks