How do you design and execute PQ protocols for computer systems that use cloud services or AI?

1 Define the PQ scope and objectives

The first step in designing a PQ protocol is to define the scope and objectives of the PQ, based on the user requirements and specifications of the system. The scope should clearly identify the system components, functions, features, and interfaces that are subject to PQ, as well as the acceptance criteria and test methods. The objectives should state the purpose and expected outcomes of the PQ, as well as the roles and responsibilities of the testers and reviewers. The scope and objectives should also consider the risks and impacts of the cloud or AI elements on the system performance and data integrity.

2 Review the cloud or AI provider's validation

The second step in designing a PQ protocol is to review the validation documentation and evidence provided by the cloud or AI service provider, such as the service level agreement (SLA), the validation master plan (VMP), the installation qualification (IQ) and operational qualification (OQ) reports, and the data protection and security policies. The review should verify that the provider's validation meets the applicable regulatory and industry standards, such as GAMP 5, ISO 27001, and GDPR, and that the provider has adequate controls and procedures to ensure the quality, integrity, security, and availability of the cloud or AI service. The review should also identify any gaps or limitations in the provider's validation that need to be addressed or supplemented by the PQ protocol.

3 Design the PQ test cases and scenarios

The third step in designing a PQ protocol is to design the test cases and scenarios that will simulate the normal operating conditions and expected user interactions with the system. The test cases and scenarios should cover the system components, functions, features, and interfaces that are within the PQ scope, as well as the cloud or AI elements that affect the system performance and data integrity. The test cases and scenarios should also include the expected inputs, outputs, results, and deviations, as well as the test data, tools, and environment. The test cases and scenarios should be traceable to the user requirements and specifications, and should be reviewed and approved by the stakeholders before execution.

5 Evaluate the PQ test results and deviations

The fifth step in executing a PQ protocol is to evaluate the test results and deviations against the acceptance criteria and specifications. The evaluation should determine whether the system meets the user requirements and specifications under normal operating conditions, and whether the cloud or AI service provides the expected quality, integrity, security, and availability of the data and functionality. The evaluation should also analyze and document the root causes, impacts, and corrective actions of any deviations, errors, or failures that occurred during the testing. The evaluation should also verify that any deviations, errors, or failures have been resolved or mitigated before closing the PQ protocol.

6 Prepare and approve the PQ report

The final step in executing a PQ protocol is to prepare and approve the PQ report, which summarizes the PQ scope, objectives, methods, results, deviations, and conclusions. The PQ report should provide sufficient evidence and documentation to demonstrate that the system performs as intended under normal operating conditions, and that the cloud or AI service complies with the regulatory and industry standards for data integrity and security. The PQ report should also include any recommendations or suggestions for improvement or optimization of the system or the cloud or AI service. The PQ report should be reviewed and approved by the authorized personnel before releasing the system for operational use.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?