Q: Our company uses a vendor-hosted system for Electronic Data Capture (EDC) of clinical trial data. The system is validated under the vendor’s validation lifecycle process, which our company will review and deem acceptable (or not) through our vendor audit program.
In the event of an FDA or third-party inspection where validation records for the system are requested, is it acceptable to reference the vendor’s validation and vendor qualification status under our audit program? Or are we expected to perform in-house testing of the electronic data capture system?
A: Your question raises two important and potentially related issues — the need for in-house testing over and above what your vendor has done, and the need to have objective evidence of the validation efforts.
The answers depend on your company’s specific use of the vendor’s electronic data capture system. For example, depending on how your company obtains the data from the vendor’s system and what interfaces are in place, FDA may expect you to perform some in-house testing to complement what the vendor has done…and possibly address the requirements or specifications your company originally gave the vendor.
FDA doesn’t care much about who has done the work. It wants to make sure good software and systems engineering practices have been followed and that validation has been properly conducted and documented based on your company’s intended use (which may or may not be the same as the vendor’s intended use).
[pullquote align=”right” cite=”” link=”” color=”” class=”” size=””]Ultimately, FDA holds your company responsible for the integrity, security and reliability of the data.[/pullquote]
In this regard, all of FDA’s expectations for validation and the resulting documented evidence applies, regardless of who develops and maintains the system. Ultimately, FDA holds your company responsible for the integrity, security and reliability of the data. And the agency expects you to have at least some evidence of the vendor’s validation efforts. So you should avoid a situation where you have only a statement that the vendor validated the system or only indirect evidence from your vendor management activities. Some vendors are more likely than others to share copies of their development methods and validation deliverables, so that may be an additional challenge to resolve. If possible, clarify that need upfront before contracting with your vendor.
Answered by Gordon B. Richman, formerly Vice President of Strategic Compliance Consulting for EduQuest and now Assistant General Counsel for Quality & Regulatory Affairs at Beckman Coulter. For additional information on FDA expectations for system validation and testing, attend EduQuest’s three-day training class, FDA Auditing of Computerized Systems and Part 11/Annex 11.