针对数据管理，请问大家做过风险评估吗

一抹烟云

  请教各位，我们单位针对质谱系统数据完整性的问题，准备上实验室数据管理系统，是否应该在风险评估的基础上写URS，然后再进行系统验证。另外，大家是否有数据管理风评的经验，分享下，谢谢！

逍遥黑熊

Product quality Impact assessment 产品质量影响评估                                               
1        Q1: 设备是否直接接触产品，或者该设备被用于生产产品或控制产品质量？ Does the equipment have direct contact with the product, or is the equipment used in the manufacture or control of our products?                                       
2        Q2: 设备用于处理或加工产品？Does the equipment process a product?                                       
3        Q3: 设备用于清洁或灭菌(如CIP系统或SIP系统)？Is the equipment used for cleaning or sterilization (e.g. CIP or SIP systems)                                       
4        Q4:设备是否用于保存产品质量（如氮气，仓库）？Does the equipment preserve product quality (e.g. N2, Warehouse)                                       
5        Q5: 设备是否产生用于质量监控信息（如报警，IPC等），或者用于与药物安全相关的工艺？ Does the equipment produce information used for Quality Monitoring (e.g. alarm, IPC, etc.), or is it used for processes concerned with drug safety?                                       
6        Q6:该设备是否为可能影响产品质量的工艺控制系统（如PLC，DCS）且没有系统独立验证控制系统的性能？Is the equipment a Process Control System (e.g. PLC, DCS) that may affect product quality and there is no system for independent verification of control system performance in place？                                       
7        Q7:该计算机/控制系统参与用于生产、加工、包装、保存或分发我们的产品的厂房设施的环境控制？Is the computer/control system involved in the environmental control processes of facilities used for the manufacture, processing, packaging, holding or distribution of our products?                                       
8        Q8:该控制系统或电脑是否属于易于外部审计单位或法规部门检查的流程的一部分？Is the computer/control system part of a process liable to external audits or inspections by regulators (e.g. FDA, EMEA, MHRA, or any other national health authority)                                       
9        Q9: 设备是否支持直接影响设备，或直接影响EHS要求的设备？Does the equipment support Direct Impact equipment, or directly impact on the EHS-required equipment?                                       
21 CFR Part 11 Assessment 电子数据及电子签名评估                                               
1        "Does the computer system create, modify, maintain, archive, retrieve, or transmit electronic records?
计算机化系统是否创建、更改、维护、归档、检索或者发送电子记录？
If Yes, go to Question #2; If No, stop assessment ERES is not applicable No action is required
如果是肯定的回答，继续问题2,如果是否定的回答，停止评估ERES部分不适用"                                       
2        "Do predicate rules  or Novartis policies or procedures require the record(s) to be maintained regardless of whether the record is electronic or paper? 法规、诺华的政策或者规程是否要求必须维护该记录（无论是电子的或还是纸质的）？
If Yes, go to Question #3,If No, stop assessment ERES No action is required 如果是，继续问题3,如果是否，停止评估ERES"                                       
3        "Are one or more electronic signatures applied to the electronic record(s)?  有一个或多个电子签名应用于电子记录吗？
If Yes, stop assessment, Part 11 is applicable;  If No, go to Question #4    如果是，应遵循part 11,如果否，继续问题4"                                       
4        "Is the electronic record used in place of, or in addition to, the paper format in order to satisfy the requirements of the predicate rules or Novartis' policies or procedures? 为满足法规、诺华的政策或者规程，电子记录是否需要替代纸质文件或者是作为纸质文件的补充？
If Yes, stop assessment, Part 11 is applicable  ,If No, go to Question #5如果是，应遵循part 11,如果否，继续问题5"                                       
5        "Is the electronic record relied upon to perform regulated activities? 电子记录是否用于进行受法规监管的活动？
If Yes, stop assessment, Part 11 is applicable,If No, stop assessment ERES No action is required 如果是，应遵循part 11,如果否，停止评估ERES"                                       
6        "Is the record submitted to the regulatory agency under predicate rules in electronic format? 记录是否需要按照法规以电子格式提交给FDA
If No, stop assessment,If Yes, Part 11 is applicable如果是肯定的回答，应遵循part 11 ,如果是否定的回答，停止评估"                                       
GAMP category GAMP 分类                                               
1        Category 1: Infrastructure Software 基础软件，Like Layered software分层式软件,Software used to manage the operating environment用于管理操作环境的软件, example OS，SQL或Microsoft office                                       
3        "Category 3:Non-Configured, Runtime parameters maybe entered and stored, but the software cannot be configured to suit the business process, example PLC controller of autoclave.
不可配置软件可以输入并储存运行参 数，但是并不能对软件进 行配置以适合业务流程（如灭菌柜的控制系统）"                                       
4        "Category 4. Configured, Software, often very complex, that can be configured by the user to meet the specific needs of the user’s business process. Software code is not altered
这种软件通常非 常复杂，可以由 用户来进行配置（组态） 以满足用户具体 业务流程的特殊 ,编码不能修改(如ERP,LIMS系统）"                                       
5        "Category 5:Custom Applications (Software custom designed and coded, e.g. application developed with Excel)
订制软件（如由自己开发的Excel 应用程序）"                                       

逍遥黑熊

以HPLC为例：