How do you find the correct balance between doing enough and doing too much while validating your electronic documents and signatures?

Solution Overview

Purpose

REST ASSURED!ER&S™  is a complete solution developed to produce documented evidence of the management of electronic documents and signatures (ER&S) compliant with the requirements of both the regulated life science industries and their regulators. If your organisation is a regulated company which needs to have its electronic records and signatures trustworthy and reliable both for business reasons and for fulfilling regulatory obligations,  or if you are a supplier of systems, products, or services to such companies, choose REST ASSURED! ER&S™  for complete confidence that the process of validation will address international regulations and guidelines for ER&S adopting a risk management approach based on record impact on business continuity, product quality and/or patient safety.

Scope

REST ASSURED! ER&S™  addresses compliance with international regulations related to electronic records (with or without electronic signatures) that are created, modified, maintained, archived, retrieved, or transmitted by automated systems. within the life science industries including pharmaceutical, biological, and medical devices. The automated systems could be new, existing, or those that have already been subject to compliance check of ER&S. REST ASSURED! ER&S™  takes into account the current GxP life science requirements as specified in:

• US Codes of Federal Regulations (CFRs) covering GCP, GLP, GMP, and medical devices
• US CFR regulation 21 CFR Part 11
• GAMP 4, GAMP Guide for Validation of Automated Systems
• PIC/S (Pharmaceutical Inspection Convention/ Pharmaceutical Inspection Co-operation Scheme) Guidance
• EU Directives laying down the principles and guidelines of good manufacturing practices in respect of medical devices and medicinal products for human and veterinary use
• International Conference on Harmonization (ICH) guidelines
• ISO 14971:2000 Medical Devices – Application of risk management to medical devices

Methodology Highlights

REST ASSURED! ER&S™  adopts a risk management approach to ensure the compliance of regulated electronic records and signatures.

Why is risk management essential for the compliance of ER&S?

• The purpose of risk management is to identify potential problems before they occur, so that activities may be planned and executed as needed across the life of the product to mitigate adverse impacts on the quality of products compromising the safety and health of patients, users, or, where applicable, other persons.
• Risk management helps to focus the compliance activities on critical issues making the process more effective and efficient

What activities do we perform while managing risks to electronic records?

• We identify regulated electronic records and signatures
• We also identify electronic records and signatures that are not regulated
• We perform a data flow analysis identifying the role of each record and signature in the process
• We identify the “technology gaps” in the workflow causing a transition from electronic to hand-written signature (hybrid document management system). In such cases it is worthwhile analysing the scope of redesigning the workflow to enable a paper-less production process to enhance productivity
• We assess the potential impact of each record/record type on the product quality and patient safety using the categories.: High Impact, Medium Impact, Low Impact
• We assess risks to electronic records based on impact
• We scale the risk management depending on the impact severity
• We perform for each high impact record a formal risk assessment identifying hazards which might be human-related, computer-related, or physical/environmental
• We perform for each potential hazard identified a Failure Mode and Effects Analysis (FMEA) considering severity of the consequence, probability of occurrence, and likelihood of detection prior to harm occurring
• We specify controls to manage the identified risks
• We verify the implementation of the specified controls
• We define a plan for monitoring the effectiveness of controls during periodic review of systems
• We document all the activities performed.