ARTICLE · 1181959
跨站点共享软件验证及文档系统合规性评估报告
跨站点共享软件验证及文档系统合规性评估报告Question 1: Management of Validation and Documentation When [Site A] and [Site B] Share One Set of Software Background: The software is deployed group-wide on a server in [Site A], and both [Site B] and [Site A] will use it. Answers & Recommendations: Establish a Validation SOP for Shared Software: Overall Approach: Adopting a "Global Core Validation Package + Local Deployment Validation Package" is a reasonable and industry-common practice. The global package covers general functionalities, while the local package should include a difference assessment, a no-difference declaration, and a cross-index table of validation documents for the two sites to ensure consistent GxP compliance. Document Retention: The site of use (Site B) must retain an electronic version of the global core validation package to meet local audit requirements for the traceability of the Validation Master Plan (VMP). Quality Service Agreement / SLA: Recommendation to Add: It is strongly recommended to sign an SLA / Quality Agreement between the two sites (or between the IT department and business units). It should define server operations, data backup, change notification mechanisms, disaster recovery, and response times. Since the server is in [Site A], cross-regional network stability and the support priority for [Site B] users must be specifically addressed. Question 2: Compliance of Using FMS for "Protocol, Schedule, and Change Management" (Note: This question does not involve specific location names, so the content remains unchanged) Background: FMS has upload, read-only, and email notification functions, but SD (likely System Admin/Document Officer) has editing/deleting/overwriting privileges. The system cannot control document versions, and the audit trail only shows the action (deleted file name) without tracing the specific file content. Answers & Recommendations: Assessment of FMS Current Role: Using it as a platform for file distribution and review (canceling paper, read-only permissions, notifications) is basically feasible. However, using it for the full lifecycle management of protocols, schedules, and changes poses compliance risks (especially in GxP/CSV scenarios). Version Control and Audit Trail Deficiencies: Core Risk: Inability to control versions and the lack of traceability after deletion/overwriting do not comply with GMP/GLP requirements for electronic record integrity and ALCOA+ principles (audit trails must be able to reconstruct the operational process). Feasibility of Manual SOP Compensation: Using an SOP for manual registration of deletion/overwriting reasons carries high risks and is usually difficult to fully accept. Manual compensation is prone to errors and struggles to prove a strong correlation with system operations. Improvement Suggestions: If continuing to use FMS, strict supplementary controls must be configured: e.g., prohibiting physical deletion (only allowing "obsolete/replace" while retaining historical versions), regular backups, exporting non-editable PDFs for archiving in a compliant system (e.g., DMS/QMS), and enhancing manual review logs. Root Solution: It is recommended to upgrade FMS to support version control and complete audit trails, or migrate core protocol/change management to a dedicated QMS/DMS system with electronic signature and version control capabilities. Summary: For Question 1, the "Global + Local" validation strategy is clear, but an SLA needs to be implemented. For Question 2, the use of FMS is compliant for distribution/review, but it has version and audit defects as a core management tool for protocols/changes. Relying solely on manual SOP compensation poses high risks; system upgrades or a professional document management system are recommended. The above analysis is based on general IT compliance (GxP/CSV) practices. Specific audit standards may vary depending on actual business and regulatory environments; this is for reference only.
