Audit Trail review of Waters Empower 2 software

[waleed.makarem]

Dear all ,

Currently I am performing Periodic review for HPLC data "Waters , Empower 2" . I do not know how to perform it , what are the items to check . eg , I know that changing the wavelength is critical to check , but flow rate is not critical . So , When checking the audit trail file from Empower 2 software , The method change was declared as "Change Instrument method to version 24" .

Does anyone has done this task and what is the best practice and how to perform .


Thank you all .

Waleed

[Alex Buske]

.... what is the best practice and how to perform .

Validation and Qualification is best performed by properly trained personal (don't forget about documentation!) according to a water proof SOP system based on sound scientific and regulatory knowledge.

I don't want to appear over critical, but are you sure what you are doing and why you are doing that?
Can a "Change Instrument method to version 24" have an impact on the safety of a drug product?

[unmgvar]

are you doing this as part of your QA requirements?
is there no SOP in place for you to use and guide you as to which parameters you are required to check and compare to the analyticsal method?
do you have any chromatographic knowledge?
or is it intended that you simply check the deviations from the method to the actual analyses method as it was done?
do you also need to check for the also important part of data analyses? are you seing that chromatography is properly integrated to process and report the correct values of the chromatogram?

[LC_labrat]

It depends on your goal of periodically checking. I work in a GMP environment so every HPLC instrument/sample set user set variable is verified to be correct including audit trails for every analysis.

In your case a change was made to the instrument method, it could be something simple as a user deciding to use Lines C/D instead of the previous A/B which has no impact on the data or it could be something significant such as the wavelength.

[benW]

...The method change was declared as "Change Instrument method to version 24" .

Hi,
With the above advice, you should also take this oportunity to review the quality/contents of the comments inserted during changes, identifying requirements for default strings or areas needing additional training.

As you have found, the comment "Change Instrument method to version 24" is not very meaningful...

[jlehman]

The audit trail should include what was changed for each new version of the Instrument Method, Sample Set Method, Processing Method etc. Each new rev gets a new method ID.

You should have an SOP that explains what you are supposed to be checking.

[dimitrije]

We are planning to start monitoring audit trails of Empower software in accordance with 21 CFR Part 11 and EU GMP Annex 11 Chapter 4.
We use a hibrid documentation system (electronic and paper).
Please, share with us your approach:
1. do we have to monitor all changes within 1 project (i.e. 1 test), each time after analysis is finished and attach printed audit trail report to batch Record, or
2. should we only have a daily check of entire Empower system regarding unauthorised access, deletions etc.

Best regards

[shaun78]

My approach to this has always been to set user rights to not allow them to change things we don't want them to change.

For example, if I validate a method, that method gets locked and only an administrator can edit it. In this case, even I am not an administrator, so I can't change my own method once I validate it; our IT department are the only admins.

There should be no generic accounts and users should never give out passwords. Therefore, there can be no unauthorized access. Only an administrator should be given the ability to create user accounts ... again preventing unauthorized access.

Users of a system should never be given the ability to delete anything relating to data. This is a violation of 21 CFR 11. If a user is unable to delete, there is no need to check to see if they have.

[dimitrije]

Please, share with us your approach: Our system audit trail data file currently has close to 500,000 individual audit lines. According to our procedure we only archive audit trail without removing data. Is it acceptable to remove data after archiving.

Best regards

[shaun78]

Yes, it is acceptable to remove the system audit trail after archival. In fact, this needs to be done otherwise it may start to cause problems with the data system if the audit trail becomes too large.

Always remember to maintain an archive of your archives.