QA Standard Operating Procedure IT-Based Risk Analysis

No. Rev. No.

SOP08-7 7.0

Page Rev. Date

1 of 3 2 June 2003

Standard Operating Procedure 08-7

IT-Based Risk Analysis

Intranet: SOP08-7.doc

QA Standard Operating Procedure IT-Based Risk Analysis

No. Rev. No.

SOP08-7 7.0

Page Rev. Date

2 of 3 2 June 2003

1 Purpose of the SOP

It is the goal to assess the risks involved with the use of software in cGMP environments.

2 Procedures for Implementing the SOP

A risk analysis is to be performed for functions of product developments to be used in GMP environments pursuant to the TSOP08-7 IT-Based Risk Analysis for Products. Critical functions are: Functions accordingly marked in the user requirements specification / functional specification (customer projects) Functions with an impact on the quality of a pharmaceutical product, which is manufactured under the guidance and control of Werum software or the manufacturing documentation of which is having an impact with regard to Potency Quality Purity Identification Functions relating to system safety: access to the system access to functions In the case of customer projects customer-defined risks shall be considered in the design and test phase. In general, a risk analysis is based on the functional specification. Within the contractual scope Werum can support the customer in creating a risk analysis (IT-based review). For this purpose the "IT-based PAS-X Risk Analysis" is available.

3 Release
Release procedures shall be pursuant to the project initiation check list.

Intranet: SOP08-7.doc

QA Standard Operating Procedure IT-Based Risk Analysis

No. Rev. No.

SOP08-7 7.0

Page Rev. Date

3 of 3 2 June 2003

4 Documentation
4.1 Products For product developments of software of project class 1 (GMP projects) the risk analysis is performed on the basis of exemplary workflows. A risk analysis defines which risks there are and how the risks can be minimized. Risk analyses are subject to change management procedures. 4.2 Projects The IT-based risk analysis is carried out according to the customer QM system and pursuant to contractual agreements for project class 1 (GMP projects). Risk analyses for customer projects are archived in the same way as functional specifications.

5 Other Applicable Documents

SOP06-1 SOP08-5 Creation of user requirements specifications / functional specification Testing

6 Templates
Template TSOP08-5 TSOP08-7 PAS-X Risk Analysis for Virtual Factory Testing Risk Analysis

Intranet: SOP08-7.doc