Data Sheet

MasterControl Validation
Strategy FAQ

Why Did We Formalize Our Validation Strategy?

At MasterControl, we believe our customers should be able to focus their time
and efforts on their business activities rather than on the business of validation.
We believe our software can help make our customers’ processes more robust
and efficient. By minimizing the validation effort required to use MasterControl
software, our customers can focus on using the software to help provide life-
changing products to more people sooner.

What Are The Guiding Principles Of Our Validation Strategy?

• Validation should be part of change control.

• Validation should be risk-based.

• Validation should leverage as much work of trusted vendors as possible.

• Customer performance qualification (PQ)-level testing should focus on

critical business processes (CBP).

Why Is Validation Part Of Change Control?

An installation or upgrade is a change to your system, and change control provides
a framework to manage these changes. By making validation a part of change
control, it is more likely to remain focused on verifying that the change meets the
user requirements and less likely to experience the scope creep often associated
with validation.

Why Risk-Based?
The “risk-based” terminology has been in use for over a decade, and it is
commonly accepted across industries and regulatory bodies. Taking a risk-based
approach ensures that critical processes are the focus of testing and allows
employees to focus on their core business tasks.

1
 Data Sheet

What Testing Does MasterControl Perform Before Validation?

MasterControl does extensive testing before validation:

• Hourly unit, integration and functional testing of thousands of individual tests

-- Includes direct code testing and user interface testing

• Daily manual code inspection and verification

• Regular (weekly) manual functional testing of hundreds of complex tests

• Regular automated Operational Qualification (OQ) regression testing

• Regular scalability testing assessing high usage and system responsiveness

• Regular security testing

• Regular manual investigative testing

• Regular system upgrade testing

Is Anyone Else Doing This Sort Of Testing?

Many companies are doing some level of risk-based testing. However, a large
number are still using antiquated validation methodologies. We believe that
no one is testing to the same level of comprehensiveness and innovation as
MasterControl. Competitors usually either have automated but very light
validation, or manual paper-based, oppressive validation. MasterControl has
comprehensive OQ automated validation that ensures the software is tested
completely and quickly.

MasterControl’s validation documentation is delivered in the form of an automated

Transfer OQ (TOQ). With MasterControl Transfer Performance Qualification
(TPQ) for Spark, our cloud-based QMS for small businesses, we conduct all of
the PQ testing and deliver the documented proof to satisfy regulatory validation
requirements.

Is The Automated TOQ (ATOQ) As Accurate As The Traditional

TOQ?
Yes. In fact, it is more accurate, cleaner and easier to review and understand. The
automation tool does exactly what it’s told to do. It won’t click around to find a
workaround when an error appears, it won’t mistype Pass/Fail, etc. You won’t find
line-throughs with initials and dates for misprinted information. Essentially, the
ATOQ eliminates the user error that accompanies manual executions.

MasterControl Validation Strategy FAQ 2

 Data Sheet

How Do I Know That The Automation Did What It Says It Did?

There is even more objective evidence with the ATOQ than you can reasonably
obtain with a manual execution. The ATOQ comes with:

• Completed validation scripts

• Inline screenshots and execution notes
• Video recordings of each test execution

Additionally, each execution is fully reviewed manually. Reviewers report their

findings in a separate report that is also included with the ATOQ. We are sure that
no one else has this level of documentation and validation scrutiny.

Is Automation A Viable Way To Validate (i.e., Will The FDA

Accept It)?
Absolutely. First, the FDA does not mandate a particular validation methodology.
The agency wants you to state how you are going to validate, and then prove
that you did it that way. Second, regulatory and guidance agencies across the
spectrum not only state support for automated testing, but in many cases provide
guidance regarding how to accomplish automated testing successfully.

What Can I Do If Management, An Auditor Or A Regulator

Doesn’t Accept This Data?
Please refer to the questions that were answered previously in this FAQ
document, specifically the items regarding accuracy and objective evidence.
We believe our validation methodology and ATOQ will stand on its own. If the
customer is still adamant that they cannot accept the ATOQ, the blank OQs are
still available to be purchased as a separate product, and the system can be
validated manually. However, as of version 11, MasterControl no longer offers
manual execution assistance, so manual validation will be entirely the customer’s
responsibility. In our experience, this will take a minimum of 30+ person-weeks for
All Access validation.

How Does This Testing Approach Impact My Existing Risk

Assessment?
For the ATOQ testing approach, it should not affect your existing risk assessment
at all. We’ve merely changed the method of performing the OQ testing. The actual
customer work of reviewing the ATOQ for the risk assessment should occur much
faster due to the clarity of the documentation.

For the single-version testing approach, the risk assessment should also be easier.
Though some bugs will be found in v11, this is by far the most extensively tested
release we’ve offered. As we continue with this release approach, the levels and

MasterControl Validation Strategy FAQ 3

 Data Sheet

frequency of testing will continue to increase. Customer testing can be pared

down to high- and medium-risk processes that are critical to business operations
or could affect data integrity or patient health.

What Else Has Been Done To “Validate” The Automation Tool?

Per guidance from GAMP, etc., automated test tools do not need to be validated,
but they do need to be tested and qualified to ensure they will do the job
adequately. MasterControl qualifies the test tools with a User Requirement
Specification (URS), Functional Requirements Specifications (FRS), completed
automated test script and qualification report containing the test findings. All
of these documents are available as part of the TOQ product. Additionally, all
documents have been reviewed by MasterControl’s Quality department. That
review found that the reports and documents were accurate, easy to read, of
extremely high quality and had a fewer observations associated with the review
than are typically found for a manual validation.

What Will Customers Do With All The Time They Save With Our
Validation Approach?
The FDA recommends focusing on processes and activities that contribute to
the company’s quality processes and products. Validation merely verifies that
the software meets the customer’s needs and usage. This validation approach
will ensure that the least burdensome approach is pursued - as recommended
by the FDA - meaning the customer will be able to spend more time on their core
business activities.

About MasterControl

MasterControl Inc. creates software solutions that enable life science and other
regulated companies to deliver life-improving products to more people sooner.
MasterControl’s integrated solutions accelerate ROI and increase efficiencies by
automating and securely managing critical business processes throughout the
entire product lifecycle. More than 1,000 companies worldwide, ranging in size
from five employees to tens of thousands, rely on MasterControl cloud solutions
to automate processes for new product development, clinical, regulatory, quality
management, supplier management, manufacturing and postmarket surveillance.
MasterControl solutions are well-known for being scalable, easy to implement,
easy to validate and easy to use. For more information, visit
www.mastercontrol.com.

© 2019 MasterControl Inc. All rights reserved.

DSVL11.0.0USENLT-01/17

MasterControl Validation Strategy FAQ 4