Q: If we perform a modification to a qualified SCADA (supervisory control and data acquisition) system, can we use the SCADA system while it’s still on-line — and also while we are performing the SCADA qualification?
A: The SCADA software manufacturer should tell you if you can perform a particular modification without taking the system off-line.
Most times, however, software upgrades need to be done when the system is off-line.
While the system upgrade question is fairly black or white, I think the harder question is whether you can use the system while you perform the SCADA qualification and assure that the system remains qualified or validated.
The answer is that you need to look at the modifications from a risk perspective. Some questions you need to ask yourself are:
- What is the risk that the changes could result in the manufacture and/or release of a product that does not meet its specifications and quality attributes?
- What is the chance that the documentation of the operation controlled by the SCADA system could be incomplete?
- What are the risks that the modifications could change the processes being controlled by the SCADA system?
- Are there others you need to ask or inform to determine the true risks to the product, process, documentation, and people (patients, employees, other stakeholders)?
“You need to look at the modifications from a risk perspective.”
If you determine these risks are all low, you could take a concurrent approach to qualification and validation. This approach allows you to qualify the system after the change — while continuing to use it.
Even with this approach, you will need to assure that you do not release product for distribution until the system is qualified.
If you don’t take the system off-line, you will have difficulty testing your negative scenarios (things that could go wrong that the SCADA system is supposed to handle correctly). This is because you do not want to have test data in the live system.
One more thought: if you have a training or test environment that is equivalent to the production environment, you could use that environment to do your qualification testing.
Answered by Jan Olson, Vice President of EduQuest, who served as an expert field investigator and director of information management resources during her 22-year career at FDA and who later co-wrote PDA’s Good Electronic Records Management guidance. Jan also is the co-instructor of EduQuest’s FDA Auditing of Computerized Systems and Part 11/Annex 11 Compliance training class.