Q: Under GAMP5 definitions, I’ve found that assigning a category to a software product is a bit confusing — particularly distinguishing between Category 3 and 4.
My understanding is that Category 3 software allows the user to make selections (configure) the application from predefined choices, while Category 4 software allows for user programming of the application — but no code changes. In which category would a Programmable Logic Controller (PLC) fall?
The difference in the categories is important to us because, as we go from Category 3 to Category 4 or higher, the resources required from the supplier and the end-user increase for validating and supporting the software.
A: GAMP5 is industry guidance based almost completely in the pharma world. Good Automated Manufacturing Practice (GAMP) is focused mostly on categories of software/systems for purposes of stratifying things like expected deliverables and the extent of validation.
Under GAMP5 definitions, Category 3 software is used out of the box. There are no configurations. An example would be Microsoft Word. You use the functionality “as is” for your purpose of writing an SOP or a document.
In contrast, Category 4 is configurable software. To use it, you have to set up the application using configuration settings. An example is TrackWise, a work-flow program that is configurable and thus considered Category 4. You set up the work flows and the decision matrices to work for your processes.
Some Category 4 software has very little in the way of allowable configurations. Others are highly configurable, almost to the point of programming.
PLCs are generally considered Category 4 or 5 under the GAMP5 definitions, but it depends on their use and their amount of customization. In general, they are customized using ladder logic, which is programming. The customization can only be done once.
In most PLCs, the initial programming is done by an equipment manufacturer with the PLC set to factory settings. If the company buying the equipment cannot change the programming (or ask the manufacturer for special programming), the system would be Category 3.
Regardless of the GAMP category, software must be validated for its intended use. The process that uses the equipment, the software, or both must be validated for intended uses. Remember, a computerized system includes not only the hardware and software, but also the people and the procedures.
While it may appear there is more documentation required for Category 4 or 5 software than for Category 3, the complexity of each system is what really dictates the amount of paperwork required. Intended use requirements or User Requirements are required by FDA for all regulated systems, because companies must demonstrate the computerized systems meet the intended uses of their processes.
Validation is to the intended use of the computerized system. User requirements, functional requirements, design requirements (if there is configuration or coding) and testing can be in one document or 20, depending on what makes sense for the system and the process. The documentation also serves as an important reference for system maintenance and upgrading.
Software often has bugs in it, even software that is widely used. No matter what GAMP5 definitions you use for the software, all functions used in a regulated process must be tested. Your goal is to find the bugs that could require additional controls or that could present problems to your process.
Answered by Janis Olson, Vice President of Regulatory and Quality Services for EduQuest, who served 22 years at the U.S. FDA as an expert field investigator and co-authored the PDA Good Electronic Records Management (GERM) guidance. Jan also is the co-developer and instructor of EduQuest’s training class on FDA Auditing of Computerized Systems and Part 11/Annex 11 Compliance.