Merger, validation slips converge at Novartis.

Unvalidated adverse event tracking software was one factor that led to last December's warning letter (Doc. 7151W) issued to Novartis Pharma.

Investigator David Pulham of the Los Angeles District Office, Phoenix resident post, conducted the August 1998 audit of the firm's Basel operations in conjunction with Swiss authorities. He reported in the resulting 483 and EIR that the company had decided in 1996 to replace rather than revalidate the two systems inherited from the Ciba-Sandoz merger.

However, as of the inspection, the new system was not in place and the old systems remained unvalidated, according to the recently released FDA records.

The Sandoz Adverse Event System (SAVES) had not been validated and a retrospective revalidation of Ciba's Online System for the Collection of Adverse Reactions (OSCAR) revealed six bugs. The six deficiencies subsequently were released, but not corrected, the EIR said.

Novartis had no plans to validate either system before replacing them with its new Global Data Safety System (GDSS), the report continued. However, the firm had developed validation protocols for the GDSS.

In its response, the company explained the time lag between the decision to replace the software and the approval to do so as follows:

"The global...Computerized System Validation of Novartis foresees a procedure known as 'Intent to replace' which can be applied to systems which '...have documented evidence supporting the proper performance of the system and a formal plan in place to replace the system...'

"After significant enhancements were made to the SAVES system since the internal Sandoz audit of 1995, the management...decided at the [Clinical Research and Development IT] Board meeting in December 1997 that the conditions are fulfilled and approved the intent to replace procedure."

Regarding the uncorrected but released software deficiencies, Novartis acknowledged the deficiency of its software change control process and promised short-term measures pending release of its new "Novartis CD&RA IT-Guideline, Managing Change Requests," which was then in draft form.

These measures included reviewing and, if necessary, amending existing change management guidelines, amending the "Defect Form" with space for signatures to track new program code release, formal documentation of system change testing and sending a memo explaining these measures to "all involved parties."

This was not the only computer validation problem to haunt the firm. Last year, Novartis had to revalidate its entire computer system in Summit, NJ, because it did not comply with FDA's electronic records rule (21 CFR Part 11), according to sources.

Although its response to the Basel observations did not fend off a warning letter, the letter focused on adverse event reporting and complaint handling, rather than on the validation concerns raised regarding the software for tracking this data.

Novartis Pharma AG, Basel, Switzerland, 8/24-28/98, Doc. 108708M, $13.50 plus retrieval.

RELATED ARTICLE: The Checklist - Novartis, foreign audit

* Computer system validation for ADR reporting