Sec. 425.300 Computerized Drug Processing; Source Code for Process Control Application Programs (CPG 7132a.15)

BACKGROUND:

An increasing number of pharmaceuticals are being manufactured under the control of computer systems. The manufacturing procedures, control, instructions, specifications and precautions to be followed within such automated systems are embodied in the computer program(s) which drive the computer. Depending of the complexity of the programs, they may also contain controlling data on product formulation, batch size, yields and automated in-process sampling/testing procedures. In a manual system such procedures, instructions, specifications, precautions and other controlling data would be embodied in master production records which must be reviewed and approved before implementation and which must be maintained, as required by the current good manufacturing practice regulations (CGMP's). Such manual records are, of course, prepared in human readable form.

In the case of computerized drug process control, certain information required by CGMP's to be in a master production record is contained in the source code for the application program. (An application program is software written to specified user requirements for the purpose of performing a designated task.) Source code is the human readable form of the program, written in its original (source) programming language. Source code must be compiled, assembled, or interpreted before it can be executed by a computer. Because the source code ultimately has a direct and significant bearing on drug product quality as manual master records, it is vital that source code and supporting documentation be reviewed and approved by the drug manufacturer prior to implementation, and be maintained as the CGMP's require for master production and control records. (E.g., see 21 CFR 211.100, 211.180, and 211.186.) Careful review of source code and its documentation is especially important for assuring that process specifications, conditions, sequencing, decision criteria, and formulas have been properly incorporated into the computer program; source code should also be reviewed to detect and remove dead code--non-executable instructions which are usually artifacts of earlier versions of the program.

Supportive program documentation, such as flow diagrams and explanatory narratives, can be useful in understanding and reviewing source code. However, such documentation is not an acceptable substitute for source code itself.

POLICY:

We regard source code and its supporting documentation for application programs used in drug process control to be part of master production and control records, within the meaning of 21 CFR Parts 210 and 211.

Accordingly, those sections of the current good manufacturing practice regulations which pertain to master production and control records will be applied to source code.

Issued: 4/16/87