Validation of SAS (Statistical Analysis System) macros in GCP domain

[mark_denham]

There has been an internal request to develop a repository of SAS macros.

The idea is that when creating TFLs (Tables, Listings and Figures) for clients a lot of macros are re-utilized time and time again. Generally we work by double programming (i.e. one to write the code that will be used and another individual who writes a second program in parallel in order to verify that both achieve the same results).

It was envisaged that the macros which are most frequently used be placed in a secure (read-only) repository and validated. In this way both programmers (the coder of the program that will be used and the programmer of the QC program) would be able to use a common repository of pre-validated ‘generic’ SAS macros.

I suppose my main questions would be:

What extent of validation is required? As it is custom-written code I would categorize it as Category 5 according to the GAMP guidelines. I imagine needing to create a Validation Plan, URS, FDS and Risk Analysis, followed by the standard testing phase.

Has anyone any experience in this area that could provide guidance, suggestions or pointers as to whether I am on the right track? I want to make sure that the validation effort is scaled in proportion to the program itself. Since each macro is small, the creation of a lot of documents and tests does appear (in foresight as being very labour-intensive).