We provide a very specific data collection process. The process uses a standard data management system to collect data, the data is then processed by a SAS program and the output of the SAS program evaluated by trained medical reviewers for accuracy. We have SOP’s that govern the SAS program development process.
Our GXP Quality Department insists that this should be governed by our Computer Systems Validation SOP’s. I disagree since there isn’t a computer system, but a SAS program.
My suggestion is that the process owner treat this like a process validation and develop a SOP that governs the entire process from data collection from the data management system to the medical review process. The SOP should define the process inputs and appropriate controls over the handling of the data. The SAS program development SOP’s should be used to assure the program processes the data and the expected outout produced. lastly, the process SOP should include govenance on the medical review post process.
In my opinion you are on the right page, If the SAS program is individually qualified or Validated for intended purpose then you can go ahead with the the whole process validation in which SAS will act as a part of data generation process.
The QM folks want me to follow the CSV SOP’s. Our CSV SOP’s ultimately produce an output which is a computer system. I’ve suggested an SOP for the entire process and an individual SOP for the SAS program. I would think this would produce a validated SAS program. A simple flow for this SOP would be to define the requirements, update the program, code review, test to requirements and an acceptance report. Seems to be like this would be enough and that the CSV SOP would be overkill.