How do you conduct the periodic reviews and revalidation of the system after the PQ?

The frequency should be risk-based with the most conservative timeline for the high-critical risk systems. When you are establishing a process be mindful and add provisions to adjust the frequency based on any upgrade to the system in the past 6 months, or ongoing major enhancement, an internal or external audit where the system and its related process were reviewed in-depth. While creating the PR schedule for a given year keep this criteria in mind and adjust the frequency with proper justification. The topics that should be considered during such review are (not a comprehensive list)-Changes (All), Incidents raised, Deviation and CAPAs, Open Items from the last PR, Vendor Agreement including Quality Agreements, Governing SOPs/WIs etc.

Periodic review process serves as the formal confirmation that the validated state of system has been maintained throughout the review period. It must be conducted on recurring basis. The schedule for which is based up on the - 1. Systems impact (H/M/L) to GxP activities 2. categorization (GAMP Cat.1, 3, 4 & 5) 3. Risk to product quality and data integrity.

1. Understand the system criticality and complexity. 2. Understand the Risk Associated with the system. 3. Develop a process of performing the Periodic Review including the process of determining the frequency of the Periodic Review. This will help to bring uniformity 4. Generally Periodic Review include review of IT Changes, Major IT incident, Major deviation. It can also include User Reviews. 5. Document the findings and assign a tracking ID to it so that it can be traced till closure. 6. Document the conclusion of the periodic review

With periodic reviews, we can ensure that the system remains compliant with regulations and is fit for its intended use. I disagree with the claim that the periodic review frequency should not exceed two years. No regulation states that the periodic review frequency should be limited to two years. In my experience, once the operating history has been established and the system is stable, the frequency can be reduced. Usually, the timeframe for reviews ranges from 1 year to 4 years.

Periodic review is an important part of maintaining GxP state of the system. Frequency and scope of periodic review depends on the GxP Category of the system (As per GAMP 5) and impact of the system on business.

1. Regulated company shall have procedure for conducting Periodic review. The procedure shall include the steps, checks to be performed, roles and Responsibilities and process to handle any discrepancy found during the review. 2. Tracking ID shall be given to the findings to track them further till closure. 3. Any updation/modification of the system identified during the review shall be carried out as per Change Management process. 4. Periodic review report shall include the conclusion regarding the validated state of the system. 5. Report shall be maintained in repository for future usage. This includes for future Audits and Inspections.

After performing the periodic validation, if we have any findings or recommendations, we should document them. For these findings, we should initiate a CAPA and take remedial actions, such as re-validation, software upgrade/update, and documentation creation.

The result of periodic review must be formally documented in a Periodic Review Report that is approved by all appropriate parties and should contain the following sections. 1. Validation Documentation Review 2. Change Control Review 3. Deviation / CAPA Review 4. Audit Trail Review 5. Configuration Review 6. System Access Review 7. Backup and Recovery Review Document all findings of this review in the Periodic Review Report for the system. The Periodic Review report may be closed once all required mitigating activities are verified and closed.

Periodic review should ensure that all the changes taken place from the last date of periodic reviews are captured as per local guidelines including maintenance documents. Any actions raised as part of periodic review should be documented in change control. If any changes that were not documented, a deviation needs to be raised and risk to be assessed.

Sometimes, a major change / update is required or scope of use of the system is changed. In this case, revalidation is required. However, we don't need to do the full validation. We need to raise a change control and update validation plan, assess the risk again, and do component functionality assessment. We should only perform testing for those components that affect functionality.

Periodic Review Conclusions should include below: 1. No issues identified: The system is stable and in control. ? No further action (including requalification or revalidation) is required. ? The date of the next required review shall be determined. 2. Potential issue: ? Requalification or revalidation in whole or in part shall be required, or ? Further investigation/testing/data review shall be required. ? CAPA Procedure may be used to manage the investigation. 3. Issue identified: suspension of use of the system or the implementation of additional controls until corrective action can be implemented. This shall be documented as part of the CAPA record.