ERP Vladation advice required

Hi All,
I’m a CSV Validation specialist. I’ve worked in the pharma industry for about 17 years now in all areas of validation and QA. I’ve always contracted in a consulting capacity but I am currently in my first staff position.
I am working for a medical device company who are a big global company in lot’s of different industries, they are fairly new to medical devices.
They are mainly contract manufacturers of Class 3 implants, hip joints, knees, vertibrae etc.
They say they plan to move into end-to-end products and obtaining their own FDA licence.
They sold the position to me as requiring regulatory advice and requirements. I have put in place lots of procedures they were missing and slowly starting to implement validation and good documentation into their ways of working but they are really beginners in terms of regulatory expectations.
I was not directly involved but was aware that they were in the process of implimenting a new ERP system (ERP LX). Having been involved in a few ERP validation projects myself I was quite interested with how they were going about it.
My problem is this, I repeatedly told the Quality Manager to be careful with the validation as it is lengthy and detailed to get right requiring plenty of resource with some good CSV experts. I was always assured it was under control.
I heard they were going live with it and decided to have a closer look. I was shocked at the fact no lifecycle quality controlled documentation had been created. No URS which obviously means no detailed FS, there is no correct risk/impact assessment and no traceability matrix, and no OQ testing!
From what I can see there is just the old fashioned IT type testing which is very minor in detail and documentation.
I decided to call a meeting with key people, Site Director, Quality Manager and IT manager to try and assess what they have/haven’t done. I then walked through how it should be done. They could not comprehend the effort I was suggesting, yet my entire approach was was completely backed up with GAMP and FDA requirements. They took it on board but say they cannot have the resource required and they seem to want to try and created various documents after the event just to say they have them! They are missing the point of what we do and why completely.
But I feel like one voice not getting heard.

So my question is how best to convince them what they have to do? I do not want to be involved in a company that are determined to learn the hard way.

I’m sorry for the very long post but I wanted to try and get the background as clear as I can.

Please ask anything you need for more info on this situation and all suggestions are more than welcome.

Thanks for your time, my kind of people :slight_smile:

First split the ERP into commercial section (used by company business interests) and product control, records and production parameters. Out of these two groups the records judged to be required by regulatory predicate rules must now be segregated into two groups.

The latest guidance on Part 11 requirements (see; http.

) allows the use of any electronic systems providing the system does not store or contain a master record for any predicate data judged in according with these latest guidance rules to be; critical data.

The above referenced document gives the criteria that should be used in making this judgement. Basically this means that if the information is electronically generated but almost instantly (within a defined period of time) downloaded and held as hard copy, then the FDA will accept the hard copy as the master record ( this is a complete turnaround on the original ruling). If the record is kept in the electronic store then Part 11 applies as moderated by the guidance document reference above.

The ERP system must be validated and a separate judgement made to verify that it is not critical software (completely separate from part 11 judgement). This judgement must verify that the software does not manipulate regulatory data in such a method as to make a ruling or judgement on product quality, efficacy or records. Where software is found to carry out such actions then a justification must be raised and details documented for the scope and form of the life cycle validation that the regulators expect to see in place.

These guidance rules very clearly state that all software used in the industry that is subject to a predicate rule (that includes everything from SOP’s/training records/calibration/production control/equipment control and management to stock control) has to be validated in accordance with 21 CFR Part 820.70.(i)

If I can help further Kev, feel free to contact me on;


Thanks for sharing. It’s great