Please help with the following.
During an audit, I’ve found some software which would be GAMP category 4 (configurable) which is involved in a critical GMP activity and I do not consider it wholly validated. The software controls a printer which prints information onto the product - the valdiation I was auditing is for the introduction of the whole process line to make the product, of which this software and printing is a part.
During IQ the software was checked to ensure that it was the specified supplier and version number (it was): back-up was taken and configuration noted as part of that process. Then at OQ, the printing was functionally tested to ensure that it printed the correct information in the right place (it did). During PQ of the line, 3 batches of product were made and the printing (correct information and readability) were checked through sampling each batch in accordance with the normal sampling plans. Each batch only passed (for printing) if each sample was correctly printed and readable (ie zero failures). All batches passed. So I consider this part of the validation as good.
But, although there are basic user needs in the URS, there are no specifications from the supplier (funcational or design) - also there is no evidence that the software supplier was considered - ie no audit of any kind, nor justification for not auditing; and no evidence that the software was written to any kind of standard or quality system. I consider this a problem for configurable software.
In mitigation, the supplier is a large reputable company who supply this software and the type of printer into many companies and industries, in large quantity (probably thousands of units if not tens of thousands). In addition, the whole line has now been operational for about a year, and there are no complaints related to the printed information being in any way incorrect or illegible.
So finally - my question is this. Should the software be retrospectively validated in any way, and if so, what should that consists of? Or can justfication be made to consider it validated, and if so, from when (ie from when the line went into production or from now?) If from now, what are the implications (if any) for product made between line going operational and now? If justification is possible, what should be considered?
Sorry for the long post - hope someone can offer some advice!