Failure to adequately establish and maintain procedures for software validation and to perform risk analysis, where appropriate, as required by 21 CFR 820.30(g). For example: a. Design validation of device software was not performed for some versions of the software and is inadequate for other versions. Specifically, your firm has not conducted validation of your [redacted] Software after changes to the software’s functionality have been made from your first distribution of Version [redacted] through your current Version [redacted]. Also your firm’s most current software validation of the [redacted] Software [redacted] Platform is inadequate in that the validation that was conducted for Version [redacted] consisted primarily of functional testing (black-box testing) and lacks other elements of software validation including structural testing (white-box testing).
View the original warning letter.
Your firm failed to establish and maintain adequate procedures to control design validation , including software validation and risk analysis, where appropriate, as required by 21 CFR 820.30(g). For example: a. Because you failed to follow your procedure, the acceptance criteria were not complete prior to the performance of validation activities. Specifically, [redacted] for ECAT scanners introduced an error in the scan start time used in the decay correction algorithm. This error was most pronounced in the TTTT/EEEE mode which was not tested during the validation of the software update.
View the original warning letter.
Failure to have a validated and secure computerized system. Additionally, there were no written protocols to assign levels of responsibilities for the system. It was noted that the [redacted] instrument model [redacted] used for the analysis of [redacted] failed to have password control for the analysts and the supervisor. It was observed that the data stored on the computer can be deleted, removed, transferred, renamed or altered. While your firm’s management stated that they would like to implement certain improvements in order to establish a security system, no documentation or commitment has been provided. Please note that computerized systems should have sufficient controls to prevent unauthorized access or changes to data. There should be controls to prevent data omissions and assure back-up. There should be a record of any data change made, the previous entry, who made the change, and when the change was made.
View the original warning letter.
Failure to validate manufacturing processes and approve according to established procedures, where the results cannot be fully verified by subsequent inspections and tests. [21 C.F.R. 820.75(a)] Specifically: Computer Numerical Control (CNC) Machine #C-4 had out of specification results during operational qualification conducted during validation. These out of specification results were not investigated or addressed in the validation report.
View the original warning letter.
Failure to validate computer software for its intended use according to an established protocol when computers or automated data processing systems are used as part of production or the quality system; as required by 21 CFR 820.70(i). For example: For yours, Asheboro, NC, facility, the [redacted] Training Database software validation used to document employee training was deficient in that the test scripts were not available to show the execution of the software validation protocol. It appears that at least five (5) tests specified in the approved protocol were not performed.”
View the original warning letter.
Failure to maintain accurate, complete, and current records of each subject’s case history and exposure to the device [21 CFR 812.140(a)(3)].” “We also note that according to Ms. Little-Tierney, all of the original medical records involved in this study were discarded after they were scanned. Your response to the FDA 483 indicates that your medical practice normally operates as a [redacted] office, relying on [redacted] copies of records. Any [redacted] records you maintain must be sufficient to meet your underlying recordkeeping obligations. As we noted above, as an investigator, you are required to maintain accurate, complete, and current records as provided for in 21 CFR 812.140 (a). You must maintain all required records for a period of two years after the latter of the following two dates: the date on which the investigation is terminated or completed, or the date that the records were no longer required for purposes of supporting a premarket approval application or a notice of completion of a product development protocol. (See 21 CFR 812.140(d)).
View the original warning letter.
View the original warning letter.
Failure to assure that when computers or automated data processing systems are used as part of the production or quality system the manufacturer shall validate computer software for its intended use according to an established protocol, as required by 21 CFR 820.70(i). For example, electronic records are used, but there was no software validation. No procedures are established to validate for its intended purpose the Microsoft Word or Microsoft Excel software used in creating and maintaining nonconformance records, product return records, internal audit corrective action records, or preventive action records. View the original warning letter.
View the original warning letter.
Appropriate controls are not exercised over computers or related systems to assure that changes in analytical methods or other control records are instituted only by authorized personnel [21 CFR 211.68(b)]. Specifically,
View the original warning letter.