Utilizing Azure DevOps for FDA Computerized System Validation

Written by Donna Lenning, Principal, Healthcare and Life Sciences

This year the FDA Regulation 21 CFR Part 11 is 25 years old. Announced in 1997, with associated guidance published in 2003, Computerized System Validation (CSV) has evolved into a time-consuming, costly, manual, and rigorous process. It produces reams of paper documents, even as life sciences companies use technology to perfect their other GxP regulatory processes. CSV has lagged, and it is still being conducted as if it is 1997, not 2021. The industry may be killing more trees than producing quality benefits with CSV processes, whether performed with internal personnel or outsourced to the experts.

So, the question is…. How can we in the consulting industry help our life sciences clients move forward with a less rigorous, reduced cost, and faster validation methodology while still providing appropriate documented evidence that Microsoft Dynamics 365 operates as intended? The industry desperately needs a method to provide more substantial evidence that GxP systems like Dynamics 365 perform as expected and that the systems are implemented, used, and maintained with reduced risk, compliance, and superior quality while maintaining a validated state throughout the systems’ lifetime.

The answer may lie with Azure DevOps (ADO)

ADO Azure DevOps is a tool and service that provides project teams a place to plan work, collaborate on code development, and build and deploy applications. Azure DevOps supports a set of processes that brings project managers, developers, and other contributors together to complete software development and software implementations. So why not use it as a CSV repository?

Here are some components of the standard CSV methodology that could work well in ADO:

System Risk Assessment (SRA)

The first deliverable in the CSV process is the System Risk Assessment. Usually a paper process, the SRA can be created in ADO as a new work item with standard assessment questions such as System Complexity, GxP impact, Regulatory Applicability, and 21 CFR Part 11 Applicability. Using Microsoft Power Automate with ADO, the answers to the questions can automatically return results, such as whether the system should be validated, the overall risk level of the system, and a list of the validation documents that should be delivered as part of the CSV effort. The SRA results are then routed for automatic approval within ADO, removing all manual paper tasks.

User Requirements Specification (URS)

You cannot have a quality CSV methodology without a robust, accurate, and complete URS. Without a solid URS, a Life Sciences company cannot provide the documented evidence that a system works as intended, because there is not a way to know what the system is expected to do.

Requirements are usually gathered in an analysis phase within traditional projects. This would not change; however, the difference is that requirements specific to the life sciences industry can be pre-loaded into ADO as a Requirements work item. The user requirement can also be associated with industry-accepted business processes, such as those found in the American Productivity & Quality Center’s (APQC) Life Sciences Process Classification Framework. The time now spent in the analysis phase would be reviewing the pre-loaded processes and requirements, removing what is not relevant, and adding more client-specific nuances. The analysis phase would be shortened, and the result would be complete, avoiding missed requirements in later project phases such as design and development or testing. Approval of the URS also is documented in ADO.

Functional Requirements Specification (FRS)

The FRS is an essential deliverable for highly configurable and customized systems. The FRS is produced during a design and development phase and should document all configurations and any customizations, integrations, and/or data migration. Several work items, used together, would comprise the total FRS. These ADO work items include Configuration, Enhancement, Integration, and Data Migration. Each of these items are traced back to a user requirement (predecessor), and the FRS ADO work item would be the successor to the appropriate OQ test scripts, saving effort in building an independent Requirements Trace Matrix (RTM).

Operational Qualification (OQ)

The OQ test scripts can be developed as part of Conference Room Pilot (CRP) events using Microsoft’s Regression Suite Automation Tool (RSAT) with appropriate test prerequisites and data inputs. Each test when executed would provide the properly documented evidence that the associated user requires and the FRS items function as intended. The best news: once the test scripts are created, they can be used repeatedly for future revalidation change control efforts, such as patch releases and upgrades.

Moving from a pure paper-based CSV methodology to an electronic toolset such as ADO will provide environmental sustainability by saving trees and allows life sciences companies the ability to leverage a repeatable process. ADO streamlines documentation and emphasizes risk management, data integrity, and quality assurance. Using ADO can become the foundation for employing new technologies such as automation, and even Artificial Intelligence automated testing to meet all of the CSV regulatory requirements of the FDA.

Let’s stop doing CSV the same way we have for the last 25 years. It’s time to start the move into the future with a fully automated, compliant, and quality-based CSV methodology.