Impact Assessment / Regulatory Change Control

For impact systems and/or regulated change control activities BSUBAS anticipates that a formal Change Control system has been implemented and a client Quality Unit is the ultimate Change Authority.

Reference Code of Federal Regulations (CFR) Title 21 Part 11, 21 CFR Part 820.70(i), Annex 11 which states, “Alterations to a system or to a computer program should only be made in accordance with a defined procedure.” However, Annex 11 concludes with, “Every significant modification should be validated.”

 A BSUBAS Impact Assessment reviews the requirement of validation changes be confirmed with the following:
   1) Has the intended use of the facility or associated automation system changed?
   2) Has the system architecture, including the system components or the system-to-system interactions changed?
   3) Is this a major revision release of the automation system?
If the answer is “yes” to any or all of these questions then in most cases full validation is most likely required. Validation documents may only need to be reviewed and certain components may not need revalidation, lessening the scope of validation.
If the answer is “no” to all of these questions, changes then become part of a software continuous improvement or enhancement which can particularly occur in automation systems in the form of configuration updates or data fixes, or are minor system revisions and enhancements.

The requirement of a full validation effort is then primarily dependent on risk and impact. (Note: Validation risk can impact business and system risk and thus should be evaluated separately.)