POINTS TO CONSIDER FOR COMMISSIONING AND QUALIFICATION OF MANUFACTURING FACILITIES AND EQUIPMENT - Risk Management Applications in Pharmaceutical and Biopharmaceutical Manufacturing - page 166

In many cases, information can be gleaned from prequalification testing. This
includes construction testing, FAT and SAT, as well as commissioning tests. It
is important that this information is accurate, from a reliable source, follows
GDP, and is aligned with the qualification requirements. As mentioned earlier,
the qualification team should consider risk to product quality as a criterion for
deciding what prequalification information to use in lieu of or in combination with
qualification tests. A simple risk formula analysis can be used to help determine
the use of the information.

Risk = Severity × Occurrence × Detection

Risk is a factor of severity or impact of a failure, the probability of the failure
occurring, and the likelihood that the failure will be detected and corrected before
it can affect product quality. For equipment functions that have a relatively low
impact on product quality, are not likely to fail, and have other controls in place
to detect the results of such a failure, accepting prequalification information
may be an efficient and effective means of obtaining qualification information.
However, higher impact functions or those with no or little means of detection
represent higher risk and may require additional testing. The functions that may
be prone to failure should be considered for redesign as a means of mitigation.
Again, the capability of and confidence in vendors and construction personnel will
also be a strong factor in considering the use of prequalification information. In
many cases, the vendor and construction personnel have such a strong expertise
or utility in the testing as to overcome process failure concerns. Quality unit
review and approval is recommended for any product-quality-risk-related test
information and results.

7.3.17 Computer System Validation

Many of the points presented in this chapter on general system and equipment
qualification are applicable to computer system qualification. Systems should be
designed to user requirements and specification. System and instrument instal-
lation, wiring, and component verification should be based on risk to product
quality, as should functional and operational checks, alarms, and monitoring
results and displays.
Some automated systems perform multiple functions, with some affecting
product quality and some not. It may not be possible to qualify those functions
that impact quality without also testing those functions that do not—especially
if the functions are interrelated. Caution should be used to assure that non-
impact functions do not interfere with impact functions. Security of the entire
system—including access restriction, change control, and audit trail may be inter-
related. This may especially be relevant to open systems that have connections
to larger systems or to the Internet.
A clear understanding of the computer system function, including a review of
software logic, would mitigate the risk of inadvertent or unexpected interference
between applications.