Part 11 Guidance /risk of including unqualified system/ids in a change request

Hi All,

I manage QMS part for a biotech company and would like clarification/guidance with regards to IT change request.
As a practise my company uses system id/numbering as part of describing a change request item.
These ids/numbering are from a smartsheet tracker which is non qualified/validated system.
Could someone provide guidance as to what risk/questions can be asked during FDA inspection related to these unqualified system ids/numbering?

 

To add on to the post @Jennifer Kirley made (in which her point about overthinking is spot on!!!), FDA also published a (draft) guidance on computer software assurance. There are no prescribed methods for validating non-product software and this, to me, really helps put those efforts in proper perspective.

Regardless, you should always consider what happens if the software fails? Also consider basic security - can someone delete lines in the smartsheet (inadvertently or maliciously)? It just makes good business sense to consider risks with your applications and take appropriate measures to control them.

You asked:

That's really hard to answer since this gets into whether such aspects are inspector's "hotbuttons." Most of the inspectors that I have dealt with don't really dig in much here. If the use of software is brought up, they may well ask if it's validated and then drill down from there. Generally speaking, if you show your system is controlled, they may not look too closely.

You mention Part 11 but it doesn't sound like this is either managing electronic records required by regulation or electronically signing any such record so I would not expect Part 11 to be applicable.

 

Thank you! This is very helpful!