Sec. 425.300 Computerized Drug Processing; Source Code for Process Control Application Programs (CPG 7132a.15)
BACKGROUND:
An increasing number of pharmaceuticals are being manufactured under the control of computer systems. The manufacturing procedures, control, instructions, specifications and precautions to be followed within such automated systems are embodied in the computer program(s) which drive the computer. Depending of the complexity of the programs, they may also contain controlling data on product formulation, batch size, yields and automated in-process sampling/testing procedures. In a manual system such procedures, instructions, specifications, precautions and other controlling data would be embodied in master production records which must be reviewed and approved before implementation and which must be maintained, as required by the current good manufacturing practice regulations (CGMP's). Such manual records are, of course, prepared in human readable form.
In the case of computerized drug process control, certain information required by
CGMP's to be in a master production record is contained in the source code for the
application program. (An application program is software written to specified user
requirements for the purpose of performing a designated task.) Source code is the human
readable form of the program, written in its original (source) programming language.
Source code must be compiled, assembled, or interpreted before it can be executed by a
computer. Because the source code ultimately has a direct and significant bearing on drug
product quality as manual master records, it is vital that source code and supporting
documentation be reviewed and approved by the drug manufacturer prior to implementation,
and be maintained as the CGMP's require for master production and control records. (E.g.,
see 21 CFR 211.100, 211.180, and 211.186.) Careful review of source code and its
documentation is especially important for assuring that process specifications,
conditions, sequencing, decision criteria, and formulas have been properly incorporated
into the computer program; source code should also be reviewed to detect and remove dead
code--non-executable instructions which are usually artifacts of earlier versions of the
program.
Supportive program documentation, such as flow diagrams and explanatory narratives, can
be useful in understanding and reviewing source code. However, such documentation is not
an acceptable substitute for source code itself.
POLICY:
We regard source code and its supporting documentation for application programs used in
drug process control to be part of master production and control records, within the
meaning of 21 CFR Parts 210 and 211.
Accordingly, those sections of the current good manufacturing practice regulations
which pertain to master production and control records will be applied to source code.
Issued: 4/16/87