Qualification of IT Infrastructure in GMP

EU GMP Annex 11 defines that:

“The application should be validated; IT infrastructure should be qualified.”

Maybe it is also meaningful to read this sentence twice. The regulation is not stating that “computerized systems should be validated” (remember, that the title of Annex 11 is Computerised Systems; more because of historical reasons) – the “application” should be validated in the meaning of a tight correlation to GMP relevant processes, other validation activities (e.g. process validation), the quality system (PQS), and on the basis of a prospective Quality Risk Management (QRM) concept. This “application” is not only “a set of software and hardware components which together fulfill certain functionalities”, it includes also the impact to processes parameters, the management and work by operators, contract, supplier and project management, data migration from other systems, raw data management, IT security aspects, and any other environmental factor. In other words if you validate “only” a computerized system its functions will work properly right now, but it does not include that it is tailored to suit to the processes and operations today and tomorrow.

So this if for example also the reason why it is beneficial to create User Requirement Specifications on the basis of a Process Map and to write each requirement more on a process-based view instead purely on a technical or functional way.

Secondly both statements are divided by a semicolon (;). The inspector working group (authors) would also have been able to use a full stop, a comma, or an “and” or “or” between both statements – but they decided to use a semicolon. This is not just a coincidence. Basically we have two IT layers – at the bottom the technical IT infrastructure and its hardware and software (network) components and placed on this the dedicated business applications. The basis of any validated application is therefore always a qualified IT infrastructure. In principle “qualification of the IT infrastructure” is sufficient (if it under control), because each validation of an application is implicitly also testing the IT infrastructure, but only at this point of time of verification.

Now knowing that an IT infrastructure might be a very dynamic set it does not only contain the pure technical aspects (hardware and software of a network), it also requires IT services and quality principles, e.g. like a change control process to keep in under control – or to keep it qualified for all validated applications running on it.

Annex 11 stated also that: “An up to date listing of all relevant systems and their GMP functionality (inventory) should be available”. What this means in practical terms is that it is useful to maintain one inventory list for applications and one for the IT infrastructure components – and to define the criteria which elements will be related to an application and which to the IT infrastructure. Also such principles are based on a horizontal (controlled and harmonized IT infrastructure) layer and a vertical application setup.

How to qualify an IT Infrastructure – what is it?

The definition of qualification is according EU GMP: “Action of proving that any equipment works correctly and actually leads to the expected results.”

“Equipment” in this meaning might be also related to IT infrastructure components. Also it should be considered that this “Action” should provide documented evidence and proof that the IT network actually leads to the expected results – a running, stable, and validated application.

The de-facto standard ISPE GAMP 5 (not a law or regulation) is also containing this risk-based, layered approach in its definition of software categories: category 1 for so called Infrastructure Software and categories 3 to 5 for applications of different sorts (mainly based on configuration or development). In addition ISPE GAMP 5 refers on the first page (section 1. Introduction – page 11) to different other standards like ITIL, CMMI, ISO standards, development standards, etc.

For the “qualified IT infrastructure” there are mainly two fields of interest:

IT service management services to businesses and its customers (ITSMS)
Information Security Management System (ISMS)

It might be interesting, that ISMS as a term was already used in the Draft Version of the Annex 11, but not anymore in the final revision. But this can be seen as an important hint for implementation.

So called Best Practice Standards for ITSMS and ISMS are existing for sure already – there is no need or regulatory requirement to reinvent the wheel especially for GxP compliance. The magic is more on how to implement such comprehensive standards in general and how to provide and satisfy regulatory requirements in terms of documented evidence.

Best Practice and Certification Standards – and the real world

The ISO/IEC 27001 standard specifies the requirements needed to implement an effective Information Security Management System (ISMS) in an organization. ISO 20000 is the first worldwide standard specifically aimed at specifying an integrated set of management processes for the effective delivery of high quality IT service management services to businesses and its customers (based on ITIL).

Such certification standards can define the WHAT, but they do not include the HOW TO. Just an integration into an existing IT structure by a tick-box mentality approach, writing some procedures around it and to stick the paid certificate an a wall will not satisfy the compliance requirements nor result in business profits or cost savings.

The implementation should be based on a well-balanced, efficient, and risk-based approach – covered by a controlled quality program considering the appropriate best practice standards and the GxP risks and processes.

In addition the current Aide Memoire on Annex 11 of the German ZLG states that purely a certificate does not replace the activity of a supplier evaluation.