Example SOP: Networked HPLC Systems on Chromeleon CDS

In short: This example SOP shows how a QC laboratory can control a networked chromatography data system (CDS) such as Chromeleon: who gets which role, how accounts are created and locked, how data sources are organised and who may lock, unlock or back up data. Adapt it to your validated system and your own quality system. Menu names and screen steps depend on the software version, so check them against the vendor manual.

This is an illustrative template. Every number, role name, folder name and SOP number below is an example in-house criterion unless a regulation is cited next to it.

1. Objective

To describe how HPLC systems connected to a central Chromeleon server are used, so that chromatographic data is attributable, protected from unauthorised change and recoverable.

2. Scope

The SOP applies to the Chromeleon server, all client PCs and all HPLC systems operated through Chromeleon in the Quality Control laboratory of the manufacturing site.

3. Responsibility

4. Procedure

4.1 Regulatory expectations behind this SOP

The controls below are designed to meet these expectations for computerised systems:

• Access restricted to authorised persons, with creation, change and cancellation of access recorded (EU GMP Annex 11, clause 12.1 and 12.3).
• Systems that record the identity of the person entering, changing, confirming or deleting data, with date and time (Annex 11, clause 12.4).
• Audit trails for GMP-relevant changes and deletions, available in readable form and regularly reviewed (Annex 11, clause 9).
• Regular backups whose accuracy and restorability are checked (Annex 11, clause 7.2; 21 CFR 211.68(b)).
• Controlled changes to the system and its configuration (Annex 11, clause 10) and periodic evaluation (clause 11).
• For electronic records and signatures: limited system access, secure time-stamped audit trails, authority checks, and unique ID/password combinations that are periodically reviewed (21 CFR 11.10(d), (e), (g) and 11.300).

FDA’s Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018) adds that the system administrator role, including rights to alter files and settings, should be assigned to people independent of those responsible for the record content, with a documented list of authorised users and their privileges (question 4), and that shared login accounts do not allow actions to be attributed to a specific individual; shared read-only accounts are acceptable only for viewing data (question 5). Related reading: SOP on data integrity and What is data integrity in the pharmaceutical industry.

4.2 User management policies (example in-house criteria)

4.3 Roles (privilege groups)

Five role groups are defined in this example. Allocate privileges on a least-privilege basis and document them in the system’s access matrix, which is part of the validation package.

Rules: no role, including reviewer and administrator, has the right to delete data; the administrator role is held by a person independent of the QC analysts (in this example, from QA), so that no one can change the records of their own work.

4.4 Data management

A new data source is created every year, named for example CMDATA_YYYY (YYYY is the year) and mounted on every PC at the start of the year. A typical folder structure on the server:

Access to each folder is controlled by the role groups in section 4.3. Refer to your own method and sequence SOPs for the naming of items inside the folders.

4.5 Creating, modifying, locking and unlocking users

The software screens named below belong to the Chromeleon user-management tool; they differ between versions, so confirm each step against the vendor manual for your installed version.

1. QC raises the account request form (create, disable, lock, unlock, or change privileges). The QC Head and QA Head, or designees, sign it and submit it to IT.
2. IT creates or changes the account only after both approvals.
3. IT opens the user-management tool on the server or a client PC and logs in with its own administrator account.
4. IT adds a new user with a unique user ID and full name (a similar existing user can be cloned for identical privileges).
5. IT sets password expiry (45 days in this example) and enables the logon-retry limit as per section 4.2.
6. IT assigns the access group and privileges, then checks them against the approved request.
7. IT issues a temporary initial password through a controlled method and sets the account so that the user must change it at the first login. A fixed default password such as a number sequence, written in an SOP, must not be used. The user then sets a private password that IT does not know.
8. To change privileges, IT edits the user and repeats the check in step 6.
9. To deactivate a user, IT ticks the account-locked option. To reactivate, IT clears it after an approved request and issues a new temporary password as in step 7.
10. IT records every action in the account register, with the form number, date and the person who approved it (Annex 11, clause 12.3).

4.6 Administrator policies

• When the administrator changes, IT creates the new administrator and deactivates the outgoing one in the presence of the QA Head, and both actions are recorded.
• Administrators do not have the right to delete data.

4.7 User policies

• Accounts are created or changed only by IT after QC and QA approval.
• Only trained and authorised analysts operate the HPLC systems on the network.
• Inactive users are locked by IT after a periodic access review approved by QC and QA.

4.8 Data policies

• The reviewer locks the sequence after reviewing the data. A locked sequence is unlocked only on QA Head approval, with the reason documented.
• Audit trails are transferred from the local PC to the audit folder on the server at a defined frequency by authorised IT staff, and QA or the reviewer checks them as part of data review (Annex 11, clause 9).
• Record retention: electronic chromatographic data, audit trails and backups are kept at least 1 year after the expiry date of the respective product batch (EU GMP Part I, Chapter 4, section 4.11, or 5 years after QP certification if longer; 21 CFR 211.180(a)), and longer if local law or the marketing authorisation requires. They must stay readable for the whole period (Annex 11, clause 7.1).

4.9 General policies

1. The server is restarted only by authorised IT staff, after informing QC, when needed for performance.
2. Any maintenance is announced to the administrator first and its risk is assessed.
3. Backups (event logs, audit trails, sequences) are made only by IT as per the IT backup SOP, to approved media. Uncontrolled media such as personal USB drives are not used. Restoration is tested periodically (Annex 11, clause 7.2).
4. All network or server incidents are documented, and action is decided with IT and QA (Annex 11, clause 13).
5. A change control is raised for adding or removing a PC, a major change to the server or network, a software upgrade, and relocation of the server or a PC (Annex 11, clause 10).

5. Training

Trainer: Head of IT. Trainees: QA, QC and IT staff using or supporting the system. Users are trained before an account is activated (21 CFR 11.10(i)).

6. Annexure

Annexure I: Request form for user ID creation, locking, unlocking and change of privileges.

Frequently asked questions

Can several analysts share one CDS login?

No. Each person needs a unique account so that every entry is attributable. Shared logins are a common data integrity finding; see unofficial HPLC injections and shared login.

Should the CDS administrator be a QC person?

Preferably not. The administrator should be independent of the people generating the data, and administrator actions should be audit-trailed and reviewed.

Why not publish a default password in the SOP?

Anyone who reads the SOP could log in as a new user. Use a unique temporary password that must be changed at first login.

Does a CDS need to be validated?

Yes. Annex 11 requires a validated computerised system with a documented life cycle. Instrument checks are covered in HPLC calibration, part 1.

Abbreviations

CDS: chromatography data system. QC: Quality Control. QA: Quality Assurance. IT: information technology. OQ: operational qualification.

References

1. European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (effective 30 June 2011), clauses 7, 9, 10, 11, 12 and 13.
2. EudraLex Volume 4, Part I, Chapter 4: Documentation, section 4.11.
3. US FDA, 21 CFR Part 11, sections 11.10 and 11.300 (eCFR).
4. US FDA, 21 CFR 211.68(b) and 211.180(a) (eCFR).
5. US FDA Guidance for Industry: Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), questions 4 and 5.
6. Chromeleon vendor manual for the installed version (instrument-specific steps).