London, ON — July 27, 2023 — On the 19th of May, 2023, The International Council for Harmonisation (ICH) released the third revision of its Good Clinical Practice (GCP) guidelines for public consultation. A notable addition to this revision is a new section dedicated to computer systems and information. This is a significant milestone as it brings recognition to the increasing importance of digital tools in clinical research.

To understand the implications of this new section, it is beneficial to compare it with existing regulations and guidelines, namely the 21 CFR Part 11, GAMP 5 and the FDA’s draft guidance on Computer Software Assurance (CSA) for Production and Quality System Software. This commentary article aims to provide a comparative analysis of these regulatory frameworks, highlighting their similarities, differences, and potential impacts on the industry.

ICH GCP Revision 3 – Emphasizing Data Integrity and System Validation

The ICH GCP Revision 3 introduces a comprehensive section on computer systems, emphasizing the importance of data integrity, system validation, and user training. It stipulates that computer systems used in clinical trials must be validated to ensure accuracy, reliability, and consistent intended performance. It also mandates that users of these systems be trained appropriately.

21 CFR Part 11 – A Pioneer in Electronic Records and Signatures

The 21 CFR Part 11, established by the FDA, sets the standard for electronic records and electronic signatures in the United States. It shares common ground with the ICH GCP Revision 3 in terms of data integrity and system validation. However, it further extends its scope to include detailed requirements for electronic signatures, audit trails, and documentation, which are not explicitly addressed in the ICH GCP Revision 3.

GAMP 5 – A Risk-Based Approach to Compliant GxP Computerized Systems

GAMP 5, developed by the International Society for Pharmaceutical Engineering (ISPE), provides a structured and scalable approach to the validation and compliance of GxP computerized systems. It shares common ground with the ICH GCP Revision 3 in terms of data integrity and system validation. However, GAMP 5 further extends its scope by introducing a risk-based approach to system validation, focusing on critical aspects that can impact patient safety, product quality, and data integrity.

FDA’s CSA Guidance – A Shift Towards Risk-Based Approach

The FDA’s draft guidance on CSA represents a shift from a prescriptive to a risk-based approach. It aligns with the principles of ICH GCP Revision 3 and 21 CFR Part 11 in terms of ensuring data integrity and system validation. However, it introduces a more flexible, risk-based approach to software validation, focusing on critical thinking and assurance activities that matter most to patient safety and product quality.

Comparative Analysis

While all the frameworks emphasize the importance of data integrity and system validation, they each offer unique perspectives. The ICH GCP Revision 3 provides a broad, international standard for computer systems in clinical trials, while the 21 CFR Part 11 offers a more detailed, prescriptive approach, particularly around electronic records and signatures. GAMP 5 provides a structured framework for the entire system lifecycle, from concept to retirement, including detailed guidance on risk management, supplier control, configuration management, and system retirement. These aspects are not explicitly addressed in the ICH GCP Revision 3. On the other hand, the FDA’s CSA guidance emphasizes a risk-based approach using critical thinking and flexibility.

Conclusion

The introduction of the new section in the ICH GCP Revision 3 presents an evolving regulatory landscape for computer systems in the life sciences industry. I am thrilled to see that systems and digital tools, systems, and Information Technology overall are getting the recognition they deserve.

The FDA’s CSA guidance, although still in draft, has sparked a crucial discussion about the extent of validation efforts and the importance of risk-based approaches. While the ICH GCP Revision 3 acknowledges the importance of systems and digital tools, it does not encourage a risk-based approach to the same level as the CSA guidance. There is a potential risk that the industry might interpret Revision 3 as a step back from the path that CSA has charted. As a digital technology community, let’s unite and maintain the momentum of critical thinking and risk-based approaches.

As our industry continues to transform, keeping up-to-date of these and other regulatory changes becomes more than just a necessity—it’s an exciting journey of discovery! Engaging in lively discussions about the implications of these changes is enlightening and vital for our collective progress. By doing so, we can harness the power of technology to enhance human health responsibly and effectively. I’m eager to hear your thoughts on this topic. Let’s turn this into a vibrant exchange of ideas—feel free to share your perspectives!

 

Tomasz Bartlomiejski

CRA Resourcing Manager, Clinical Operations