Validation of Electronic Logbooks in Pharmaceutical Manufacturing

Because of the need to enhance efficiency and to minimize data errors and strengthen data integrity, the pharmaceutical sector is currently making the transition from paper-based records to e-systems. This trend is exemplified by the fact that more and more equipment operation logs, cleaning practices records, calibration logs, maintenance records, environmental and utility operation records are getting converted into electronic logbooks.

Despite the evident benefits that electronic logbooks offer, they have also raised new issues of compliance and validation. Unlike paper records which were typically traditional, electronic logbooks depend on various essential components i.e. software and hardware, databases/ networks and user access control systems. Poor validation of electronic records can result in serious consequences for many companies.

From my own experience I know that many companies are obsessed with the desire to switch to using electronic logbooks in order to be more productive. However, they do not believe that the systems should be validated. It should be pointed out that regulators never approve electronic recordkeeping systems only because they allow companies to reduce paperwork, but they expect clear evidence of the fact that the system works properly, preserves data integrity and is compliant with regulations.

What is an Electronic Logbook?

An electronic logbook is defined as a program that runs on a computer. It is used to record, store and maintain GMP records in electronic format, in place of paper logs. The most common examples of electronic logbooks usage include:

• Equipment usage logs
• Equipment cleaning logs
• Preventive maintenance logs
• Calibration activities logs
• Utility monitoring logs
• Environmental monitoring logs
• Temperature and humidity information
• Sterilization cycles logs
• Facility inspection logs
• Shift handover logs

Electronic logbook records are kept as part of GMP rules and must meet requirements of computerized system validation.

Why Electronic Logbooks Validation is Required

Electronic logbooks are key tools for achieving GMP goals and making decisions about product quality. If the records are not accurate or complete, it may lead to disruption of equipment qualification, maintenance planning, batch release, investigations, or even compliance with regulatory authorities. Validation ensures that the following is documented and proven for the system:

• It operates in accordance with user specifications
• It keeps records of GMP information accurately
• It prevents unauthorized changes to the records
• It provides complete audit trails
• It protects e-records
• It allows high-quality data retrieval

Without sufficient validation, the reliability of electronically-run GMP records may be questioned during the inspections by compliance authorities.

Regulatory Expectations

Regulatory bodies necessitate that electronic logbooks be compliant with principles of computerized system validation and data integrity. Commonly tested items include:

• Validation documents
• User Requirement Specifications (URS)
• Functional specifications
• Risk assessments
• Testing protocols
• Audit trail functionality
• E-signatures
• User access management
• Backup and recovery protocols
• Change control records

Validation has to assure that the system is reliable in all stages of its lifecycle.

Risk Assessment Before Validation

Validation must be initiated with a Quality Risk Management (QRM) procedure that is properly documented. The evaluation must take into account:

• Key GMP actions
• Risks regarding data purity
• Complexity of the system
• Influence on the enterprises
• Effect on the patient’s safety level
• Risks related to lawmaking

For instance, while an electronic logbook that records processes related to sterilizers can entail more risks related to compliance than one that provides information on office maintenance. The intricacy of validation should correspond with the risks level.

Creating the User Requirements Specification (URS)

The URS specifies how the electronic log book should be configured according to the user’s requirements. The following features may be required in the system:

• Safe log in for the user
• Providing date and time stamping
• Creating electronic signatures
• Keeping audit trail
• Searching of records
• Report generation
• Using role-based access
• Backing up data automatically
• Alarm notifications
• Keeping records for a specified period

Thus, a properly written URS is essential for any successful validation project.

Function and Design Specifications

When the URS is signed off, it is the responsibility of the supplier or in-house IT team to create detailed design and function specifications. The information contained will cover:

• System architecture
• Database structure
• Software functions
• Security measures
• Logic of the workflow
• Interfacing with other systems

Good specification would also assure that the validation tests would confirm the expected functionality of the system.

Installation Qualification (IQ)

IQ provides assurance that equipment is installed properly and functions reliably. Some common activities involved are:

• Getting confirmation on software installation
• Configuring servers
• Testing network
• Checking operating system
• Installing a database
• Checking hardware
• Verifying licensing

All documentation supporting the installation, such as installation logs and configuration settings, should be included in the IQ report.

Operational Qualification (OQ)

OQ assists in ensuring that the electronic logbook has been working in accordance with specifications. Some common tests carried out are:

• Verifying user login
• Controlling passwords
• Creating records
• Editing records
• Creating audit trail
• Using electronic signature
• Searching
• Generating reports
• Testing alarms

All tests must have pre-defined criteria for meeting standards and results must be recorded.

Performance Qualification (PQ)

Performance Qualification (PQ) validates that the system works appropriately during standard pharmaceutical processes. PQ often involves the following activities:

• Obtaining records of actual equipment use
• Taking down maintenance information
• Keeping log of cleaning activities
• Obtaining information during multi-user operation
• Verifying the regular process flow
• Recovering information during various activities

From my experience, involving the actual users ensures that any practical issues of operation are revealed which might be ignored in OQ phase.

Audit Trail Verification

Audit trails are one of the most scrutinized components in regulatory audits. To ensure adequate validation, it is essential to confirm that the audit trail records:

• Identity of the user
• Date and time
• Original value
• Changed value
• Reason for change
• Deletion attempts as needed

Audit trail data must be reliable, comprehensive and out of the reach of unauthorized modification.

Electronic Signatures

In cases of electronic signature usage, validation must confirm that they can be legally linked to individual users. The system must indicate:

• Identity of the user
• Password verification
• Connection of signature and records
• Possibility of repudiation

Electronic signatures must be equal to handwritten signatures in terms of legal significance.

Security and Access Control

Access management is vital for data integrity. Validation should ensure:

• Unique users
• Role permissions
• Password requirements
• Automatic session timeouts
• Locked out after repeated attempts
• Administrator permissions capabilities

Users should only have access to what they need for their job role.

Backup and Disaster Recovery

Electronic logs should be accessible after a sudden failure occurs. Validation should verify:

• Automatic backups
• Backup restoration
• Disaster recovery method
• Correctness of data restoration
• Recovery time objectives

Frequent and consistent recovery testing gives assurance that the GMP records can be recovered as needed.

Change Control and Periodic Review

Implementation is not the end of validation. Further changes must be properly managed. Among these are the following:

• Software updates
• Database changes
• Replacement of servers
• Installation of new system interfaces
• Enhancements of security

In addition, periodic assessments of the system confirm that the electronic logbook is still functioning in its confirmed state.

Common Electronic Logbook Validation Issues

Common issues discovered by regulatory inspections include various shortcomings found in e-log book validation. Some common findings include:

• Lack of user requirement specification
• Insufficient risk management
• Poor documentation of tests
• Missing audit trail verification
• Inadequate electronic signature testing
• Joint user accounts
• Inadequate backup verification
• Failure to analyze software updates
• Incomplete periodic review
• Poor change control documentation

Most of these observations can be regarded as quality system problems, not software problems.

Recommendations for E-Log Book Validation

Compliance and reliability of the E-Log book can be improved by following good validation practices.
Best practice recommendations include:

• Prepare the user requirement specification before the development
• Use a risk-based validation approach
• Verify all key elements of the cGMPs in the processes of IQ, OQ and PQ
• Make sure that the audit trails and the electronic signatures are tested properly
• Use role-based access
• Perform the backup and recovery validation
• Fully document the validation process
• Use the change management process
• Perform the periodic review of the system
• Train users before the implementation and before major upgrades

These practices help ensure that electronic logbooks remain reliable throughout their operational lifecycle.

Modern pharmaceutical manufacturing relies heavily on electronic logbooks that come with a host of advantages, including efficient processing, excellent traceability and high data integrity. A good electronic logbook system will bring about all those benefits provided that it is validated and life-cycled. Validation reveals if the electronic logbook serves its intended purpose of recording GMP operations correctly, of safeguarding electronic records, of retaining traceability of information collected through the system.

As I have learned from my experience, organizations that utilize electronic logbooks as GMP computerized systems and not just as digital forms have better compliance, lower number of mistakes and higher degree of assurance during inspections.

Regulatory References

1. FDA Guidance for Industry: Part 11, Electronic Records; Electronic Signatures — Scope and Application
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application
2. Computer Software Assurance for Production and Quality Management System Software
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-management-system-software
3. EU GMP Guidelines Volume 4, Annex 11: Computerized Systems
https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en

Share

Tweet

Share

Pin it

Share