The Essence and Role of CSV

The Necessity and Essence of Validation

When asked about the necessity of validation, many people respond that “it is a matter of course.” Since we are entrusted with patients’ lives and health, quality assurance is important, and this is considered natural. However, the pharmaceutical and medical device industries are not the only ones that affect human life and health.

The nuclear power industry, aviation industry, and elevator industry are examples of such sectors. If the quality of products in these industries deviates even slightly, it could cause tremendous health damage. The point to consider here is whether, for example, airlines are responsible for quality assurance of aircraft.

To give a concrete example, do JAL or ANA conduct testing of the software installed in the cockpit of jumbo jets? The answer is no. The primary responsibility for quality assurance of jumbo jets rests with Boeing. This is a natural consequence of the principle of manufacturer responsibility. Of course, airlines also conduct inspections upon receipt and ongoing quality control, but the central responsibility for quality assurance during the design and manufacturing stages lies with the manufacturer.

Division of Responsibilities Between Manufacturer and User

The primary responsibility for quality assurance of a company’s products should be borne by the manufacturer. The roles of user companies—airlines such as JAL and ANA—include aircraft maintenance, training of pilots and cabin crew, creation of safe operation manuals, and appropriate verification upon receipt. These are part of the obligation to safely operate and maintain aircraft whose quality has been assured.

Similarly, in the pharmaceutical industry, it is important to recognize that suppliers bear responsibility for the majority of quality assurance for computer systems. It is necessary to realize this point early. The FDA’s (U.S. Food and Drug Administration) 21 CFR Part 11, EU GMP Annex 11, and PIC/S (Pharmaceutical Inspection Co-operation Scheme) guidance all emphasize the importance of supplier qualification and division of responsibilities.

Leveraging Suppliers and Achieving Efficiency

Promoting the utilization of suppliers means that, for example, software testing does not need to be duplicated by pharmaceutical companies. Duplication of work should be avoided. This is a waste of compliance costs and ultimately leads to increased burden on patients.

There is no need for pharmaceutical companies to recreate documents created by suppliers. Work such as reformatting to match pharmaceutical company templates does not generate essential value. What is important is to verify that the documents provided by suppliers meet regulatory requirements and contain necessary information.

Supplier Quality Management Systems

Suppliers should maintain their own appropriate Quality Management System (QMS), and their activities should be conducted in accordance with their own QMS. It is desirable for them to have a QMS based on international standards such as ISO 9001, or a systematic quality management system equivalent to or better than such standards. In other words, it is necessary to respect the supplier’s QMS.

Furthermore, user companies should not impose their own SOPs (Standard Operating Procedures) or GAMP 5 methodologies directly on suppliers. This is because these may not necessarily be optimal for suppliers, and forcing implementation using methods incompatible with their own processes may actually degrade quality assurance. However, the premise is that the QMS must be sufficient to meet regulatory requirements; companies without a QMS, or with only an insufficient QMS, are not appropriate partners for validation activities.

The Importance of Supplier Assessment

For this reason, supplier selection is a key factor. It is necessary to conduct supplier assessments (supplier evaluation) and, when necessary, supplier audits. GAMP 5 Second Edition (published in 2022) and PIC/S GMP Guide Annex 11 position supplier qualification as an important element of the validation lifecycle.

In supplier assessments, it is important to verify the following aspects: appropriateness of organizational structure and quality control systems, existence and effectiveness of QMS, technical capabilities and track record, understanding of regulatory requirements, document management and traceability, change management processes, and security measures and data integrity responses.

The Role of Subject Matter Experts

Additionally, Subject Matter Experts (SMEs) need to control suppliers. This is because vendor companies do not necessarily have detailed knowledge of pharmaceutical and medical device company products, processes, methodologies such as GAMP, or GxP regulations. Therefore, it is necessary to correct and supplement areas where supplier understanding is insufficient through reviews of User Requirements Specifications (URS) and Functional Specifications (FS).

GAMP 5 requires SMEs to collaborate with and appropriately control suppliers. SMEs have the role of deeply understanding the intended use of the system, business processes, and regulatory requirements, and appropriately communicating these to suppliers. On the other hand, suppliers must have the capability to develop systems and implement CSV (Computer System Validation). This is an extremely important point.

The Essential Purpose of Validation

The purpose of validation is to demonstrate that a system conforms to user requirements and functions appropriately for its intended use. In other words, it is to align system functionality and performance with user requirements.

Who bears the primary responsibility for this work? From the perspective of system design, development, and configuration, it is the supplier. Many people may think that CSV and validation are conducted solely by pharmaceutical and medical device companies—that is, user companies—but this is not accurate.

Validation as Shared Responsibility

In reality, validation should be implemented as a shared responsibility between user companies and suppliers. Just as quality assurance of jumbo jets is led by Boeing, validation of computerized systems used in pharmaceutical companies—that is, the work of conforming to user requirements—should be led by vendors.

However, user companies have the following important responsibilities:

• Clear definition and communication of requirements
• Supplier qualification and oversight
• Implementation of User Acceptance Testing (UAT)
• Appropriate operation and maintenance of the system
• Continuous verification of conformance

Meanwhile, the main responsibilities of suppliers are as follows:

• Ensuring design quality
• Implementing appropriate development lifecycles
• Conducting necessary verification activities
• Ensuring documentation and traceability
• Change management and support

Modern CSV Approaches

The FDA’s Computer Software Assurance (CSA) guidance, issued in 2023, further promotes a risk-based approach and recommends efficient validation activities based on critical thinking. This emphasizes the importance of activities that truly focus on risk, rather than formal document creation or repetitive testing.

When suppliers have appropriate QMS and conduct effective quality assurance activities, user companies can leverage their deliverables and focus on their own areas of responsibility. This enables reduction of compliance costs and allocation of resources to more essential quality assurance activities.

This is an extremely important concept and is the essence of CSV in the pharmaceutical industry and the key to efficient and effective implementation.