When (and why) does your eQMS need revalidation?

What is validation?

At its core, validation is simply proving a piece of software -- including your quality management software -- does what it says it can do and that it’s fit for its intended use. For example, that your eQMS training module allows you to assign, track, and report on training, and you plan to use it that way.

Regulatory bodies like the FDA want to see that you’ve validated any software that has an impact on your cGMP, cGCP, or other GxP  operations before you start using it.

If your life sciences company is using an electronic quality management system, you’ve gone through the validation process already (...hopefully), so congrats! Job well done.

What is revalidation?

Validation happens when you first bring an eQMS on board, but it’s not a one-and-done task. Software platforms make updates often, and depending on the size and impact of those updates, you may need to revalidate the quality management system.

The basic concept of revalidation is the same: after a feature has been added or changed, can you prove the system still does what you need it to do? Does it still protect patient data and support your GxP efforts? Do any of your quality processes have to adapt based on the platform update?

The tricky part is determining when revalidation is necessary and when you can requalify the eQMS without it.

Revalidation vs Requalification

There may be times when you only need to requalify your quality management software rather than do a full revalidation. But what’s the difference?

When you requalify an eQMS, you carry out a series of steps that confirm the QMS software is still fit for its intended purpose after an update. Those steps could be as simple as reading the release notes and determining the platform still has the features you need.

Or maybe you read through the eQMS vendor’s revalidation documents, decide you trust their testing, and declare the system requalified.

Revalidation involves proving the eQMS is still fit for use by running test scripts that are specific to your company’s unique configurations, and then documenting the results. Revalidation can be part of your requalification process, but it’s not always a requirement.

Think of it like conducting a job interview. When you interview a candidate, you qualify them by making sure their experience matches the requirements for the job. You might do a background check, call a couple of references, etc. But maybe you want to go a step further and prove their experience, so you give them a test.

They mentioned they could code in a specific language, so you ask them to do a small coding test to validate that their qualifications actually meet your needs.

Does an eQMS need to be validated after every update?

True to quality’s complex nature, the answer is “it depends.” Some updates will require revalidation of the software... and some won’t. To determine the right answer, you have to look at a few key factors:

Vendor Type

If a software vendor isn’t critical to your GxP operations, you may not even need to keep track of their updates or changes. For example, maybe your Marketing team uses Word Documents to write a monthly newsletter. The software isn’t storing sensitive information or patient data and isn’t crucial for business continuity, and therefore isn’t among your critical vendors that need to be revalidated.
On the opposite end of the scale, your eQMS likely contains a lot of sensitive information and plays a vital role in your GxP activities. It’s a critical vendor and therefore every update warrants at least a read-through of the release notes.

Impact of the Change

• How will this change impact the team?
• How will it impact the way you work?
• Will it impact workflows?
• Will it impact data storage, privacy, or security?
• Will it require the team to retrain on the software?
• Will any quality processes need to be updated?
• Is the update considered high risk (a substantial change), medium risk (a minimal change), or low risk (a cosmetic change)?

The bigger the impact, the more likely the update will require a revalidation of the system.

Revalidation best practices

• Have a revalidation policy in place: It may seem obvious, but one of the most important components of a good revalidation policy is...to actually have a revalidation policy in place. You’d be surprised how many organizations don’t consider revalidation at all until they’re asked for validation documentation during an audit years later. Whether it’s a change control category, a change management procedure, or simply a checklist, your quality process needs something that reviews changes in software and provides justification for your revalidation decisions.
• Consider impact now vs later: Even if you find a software change doesn’t impact your operations now, consider how it might impact you later.
  Your team might only use the Documents and Training modules of your eQMS, and so an update to the Issues module has no impact on your current GxP activities. But what if 6 months later your team begins to use Issues?
  You need a procedure in place that triggers a reevaluation of the software, whether that’s a periodic review to see if any previous software changes have now become relevant, or a workflow that launches a new risk assessment when your use changes.
• Ask your eQMS vendor about their validation documentation: eQMS vendors conduct validation on their systems, and users can often utilize this documentation during their own validation and revalidation processes.
  Unfortunately, a lot of eQMS vendors charge clients extra fees to access these validation documents, which forces clients to either start validation from scratch or pay a hefty price on top of the software cost. Remember, you don’t have to accept this as the norm.
  While you’re evaluating which eQMS platform is right for your team – or considering if it’s time to switch your current eQMS provider – ask the vendors whether or not they charge for revalidation document access. And don't forget to check out this free eQMS Buyer's Guide to learn more questions to ask a potential vendor before choosing an eQMS.

Want to learn more about revalidation, data security for quality management, and quality KPIs? Check out our  eQMS 301 eBook: Best practices for eQMS revalidation, data security, and quality ROI.