Hi,
We currently have a fully validated live CDS system within a GMP
environment.
We are going to need to validate and implement a test system for our
CDS soon. It has been suggested that we could host the test server
within a virtual enviroment using VMWare. I have some misgivings about
this.
The live server is in a “real” environment. How could one demonstrate
equivalence between the live and the test system if one of the servers
is in a virtual enviornment and the other is not?
Does anyone have any experience of doing this?
Any comments greatly appreciated.
The best way to do this of course is to run your production server in a VM aswell, andthen just clone it for testing.In the absence of that I would just confirm that all your connectivity(networking, etc) isequivalent in the VM and functions properly. The rest is covered as category 1in GAMPand you shouldn’t have to do much beyond confirming that your software isinstalledproperly.I would like to know how you decided that you needed to validate the testsystem. Thereare no requirements for validating test systems in the regs, and per theguidance youshould perform a risk assessment to determine if validation is required. Iwould suggestthat the risks associated with a test system are pretty low, and failures wouldbe highlydetectable and would have a negligible impact on patient safety.And you’re dealing with COTS and OS level stuff here.
If you don’t perform your validation activities in the production
environment, they are usually performed in an environment that mirrors
the production environment. Sometimes this validation
environment is called a QA environment, validation environment, test
environment, etc. Usually you validate the non-production environment
because it is this environment in which you base your decisions on
whether or not the system is meeting the intended use and needs. When
this decision is made, it should incorporate the risks associated with
the fact that the decision is based on the non-production environment;
i.e., what are the perceived risks associated with the differences
between the two environments and are they acceptable? I prefer to
mitigate these risks by allowing controlled and limited use cases in the
production environment prior to “releasing” the production environment
for use by all.
Going forward, this non-production environment becomes the environment
in which all subsequent changes are tested/validated prior to making the
change in the production environment. There may be instances, e.g.,
non-critical systems, whereby the non-production environment does not
need to be maintained in a controlled manner.
On the other hand, the question/statement about “…would like to know
how you decided that you needed to validate the test system…” probably
has more to do with semantics than not already realizing that which was
stated above.