Issue link: https://www.e-digitaleditions.com/i/1394390
www.biopharminternational.com July 2021 BioPharm International eBook 17 or proce s s d ata). E x a mple s cou ld inc lude using d iag nost ic mode or c a l i b r a t i o n m o d e , a c c e s s i n g t h e sof t w a re out side of t he net work , sav ing in a different f ile location, or using a hybrid paper/electronic p r o c e s s . A r i s k a s s e s s m e n t a n d m i t i g a t i o n s t r a t e g y s h o u l d b e c on side r e d to en s u r e c ompl i a nc e with ALCOA principles. It is recognized that some of the p r e v i o u s l y m e n t i o n e d e x a m p l e s may requ i re non-sta nda rd access. The accounts and roles utilized by t he vendor shou ld be u n ique a nd conf igured to ensure attributabilit y and be specif ic to the work being p e r f o r m e d . T h e s p o n s o r s h o u l d ensu re (t h rou gh a w r it ten a g re e- ment, direct training, or other writ- ten pro c e s s) t h at t he v endor h a s appropriate technical and good doc- umentat ion t ra in ing per sponsor's applicable standards and retain this documentation. Data review should follow the sponsor's standard prac- t ic e s a nd may i nc lude a def i ne d , documented risk-based approach for rev iew s of vendor-generated data. System level reviews should include rev ie w s of vendor account access. Vendor-generated data on sponsor i n s t r u m e nt s s ho u l d b e i n a l i g n- ment w ith the sponsor's standards for segregation of duties. Controls shou ld be in place to ensu re data integrit y is appropriately managed. In particular: • Access needs to be traceable. • Specif ic and unique user roles, permissions, and passwords for access are required. • Where appropriate, access should be provided on a temporary basis and subsequently rescinded after a defined period. • C o nt r ol s fo r r e m ot e a c c e s s , espec ia l ly by vendors, shou ld be eva luated to determine the effectiveness of physical controls and to ensure appropriate data and system protection. • Data sec u r it y (i nc lud i ng t he abi l it y to delete/mod if y data) should be subject to appropriate controls (technical, administrative, or procedural); consider accidental loss or corruption of sponsor data. • Changes in the data retention path (relative to that in the qual- if ied conf ig uration) should be subject to change management. • Reviews of vendor data (including t he aud it t ra i l, i f appl icable) shou ld b e def i ne d b a s e d on documented risk. • Vendors should be granted access at the lowest level that allows the performance of necessary duties. • I n c a s e s w h e r e a d m i n i s t r a- tive access is required for the vendor to perform their duties, t hei r abi l it y to ma ke c r it ica l changes (such as deleting, edit- ing, or modifying data without Biopharmaceutical Analysis Data Integrity Scenario Location of data generation Data storage/ archival Data review System level review Audit Scenario A Vendor generates attributable electronic data for equipment support at sponsor site following standard workflows At sponsor site Follows sponsor's standard IT process Follows sponsor's standard process Follows sponsor's company procedure. In scope for audit of equipment/ work process/data generated using equipment Scenario B Vendor generates attributable electronic data for equipment support at sponsor site following non- standard workflows (e.g., accessing the software outside of the network, saving in a different file location or a hybrid paper/ electronic process) At sponsor site Follows potentially non-standard process. Controls needed for ALCOA need to be managed by written agreement (including IT controls such as retention, review, archival and other data integrity concerns) Follows potentially non-standard process Follows sponsor's or vendor's company procedure. ALCOA controls (including who retains, reviews and archives) should be managed by written agreement In scope for audit of equipment/ work process/data generated using equipment. Should be in-scope for sponsor and vendor. Scenario C Vendor generates attributable electronic data for equipment support at vendor site following vendor standard workflows At vendor site (should limit ability to subcontract without sponsor preapproval in the written agreement) Follows vendor's standard process. Controls are needed for ALCOA which need to be managed by written agreement including IT controls such as retention, review, archival and other data integrity concerns Follows vendor's standard process Follows vendor's company procedure. ALCOA controls (including who retains, reviews and archives) should be managed by written agreement In scope for audit of equipment/ work process/data generated using equipment. Should be in-scope for sponsor and vendor. Table I. Scenarios under which outsourced data may be generated and managed. ALCOA is attributable, legible, contemporaneously recorded, original or a true copy, and accurate