Your firm failed to exercise appropriate controls over computer or related systems to assure that only authorized personnel institute changes in master production and control records, or other records (21 CFR 211.68(b)).
Your firm’s [redacted] “Jasco LC-Net II” HPLC instruments do not have restrictions in place to prevent any change or deletion of analytical raw data. Additionally, there is no audit trail in place to determine any previous deletion of raw data.
View the original warning letter.
You failed to establish and maintain process control procedures , including documented instructions and written SOPs for steps in the testing of blood and blood components [21 CFR 606.100(b), 820.70(a)(1)]. Specifically: “a) There are no written procedures describing computer software[redacted] functional requirements or descriptions of functions and there is no computer manual. The database functions as the information management tool used to collect, organize, process, analyze, secure and maintain testing data. “We also note that you have failed to establish an adequate system for authorizing, granting, and rescinding computer access to functions in the [redacted] and adequate computer security provisions to assure data integrity. Current users do not use appropriate access such as passwords and user-id and personnel who have changed jobs still have access to the system.
View the original warning letter.
Failure to establish and maintain procedures for the identification, documentation, validation or where appropriate verification, review, and approval of design changes before their implementation, as required by 21 CFR 820.30(i).
…
Failure to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements, as required by 21 CFR 820.50. For example: Your firm does not have a purchasing control procedure and has not evaluated the contract manufacturer to ensure that manufacturing processes are appropriately validated. In addition, there are no maintenance procedures in place, nor has your firm established procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.
View the original warning letter.
Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 CFR 211.68(b)]. For example: a. Your firm did not put in place requirements for appropriate usernames and passwords to allow appropriate control over data collected by your firm’s computerized systems including UV, IR, HPLC, and GC instruments. All employees in your firm used the same usemame and password. In addition, you did not document the changes made to the software or data stored by the instrument systems. Without proper documentation, you have no assurance of the integrity of the data or the functionality of the software used to determine test results. b. Your firm had no system in place to ensure appropriate backup of electronic raw data and no standard procedure for naming and saving data for retrieval at a later date. In your response, you state that you will maintain backup of electronic raw data and all technicians will have their own user identification (ID) and password.
View the original warning letter.
Failure to maintain adequate drug disposition records raises concerns about subject safety and data integrity. We acknowledge that your written response states that upon your discovery of both the lack of drug accountability and the missing vials, pharmacy and research SOPs were evaluated and revised; and that future studies at your site will be conducted under the umbrella of US Oncology Research, which has an electronic drug accountability system. However, as the clinical investigator, it was your responsibility to ensure that adequate records of the disposition of the drug were maintained; and US Oncology Research’s policies, procedures, and activities do not negate your responsibility as the clinical investigator.
View the original warning letter.
Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 C.F.R § 211.68(b)]. For example, your firm has failed to periodically conduct back-up procedures for the [redacted] Server, Equipment [redacted] (Building [redacted], Room [redacted]) since August 2010. This server was used to store, back-up, and/or archive raw test data from computer systems (Software:[redacted]controlling and monitoring [redacted] High-performance liquid chromatography (HPLC) systems in accordance to SOP, [redacted]titled, [redacted].” During the inspection, the [redacted]server was observed as being tagged out-of-service since February 2009.
View the original warning letter.
Failure to establish adequate procedures for acceptance of incoming product, as required by 21 CFR 820.80(b). For example, testing records for timers received on March 27, 2009; April 9, 2009; April 17, 2009; and May 28, 2009, only included a computer printout of the final data as the original raw data of the testing conducted and acceptance data for each of the timers were not maintained.
View the original warning letter.
Failure to establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met, as required by 21 CFR 820.30(a)(1). For example: You do not have design control procedures. You also have no documentation of design validation or design change controls for the Antalgic-Trak, including no documentation of risk analysis or structural [redacted] testing of the embedded software.
View the original warning letter.
Failure to establish and maintain adequate procedures for validating the device design. Design validation shall be performed under defined operating conditions on initial production units, lots, or batches, or their equivalents. Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis, where appropriate, as required by 21 CFR 820.30(g).
View the original warning letter.
Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 C.F.R § 211.68(b)]. For example, your firm lacks control of the [redacted] computer system which monitors equipment, room differential pressure, room humidity, and stability chambers. Although the system is password protected for temperature and humidity set points, all employees have access to the room where the [redacted] computer system is located and the external hard drive is not password protected. During the inspection we observed that an employee was able to alter or delete data without a password and save the changed file.
View the original warning letter.