• IT Infrastructure Qualification and System Validation: IT Vendor Perspectives- by Siddhartha Gigoo.
• An Approach to IT Infrastructure Qualification- David Stephenson
• IT Infrastructure Qualification Planning-by  Carolyn Stockdale
• Computer Network and Infrastructure Qualification and Validation of Associated IT Applications: A Case Study- by Jeremy Benson and Martyn Smith, David Mole and R.D. McDowall
• IT Infrastructure Qualification in Practice -by Juergen Schmitz
• Network Infrastructure Qualification- by Agilent Technologies

It will be interesting to see the results of the evaluation as to what was the impact of the new guidelines.  Did we change our approach to Part 11 after the new guidance was issued?

“The IT department is responsible for data security and data integrity. An underlying network must be qualified in order to ensure the security and integrity of the data that resides on it. In addition to the network, the applications and networked applications must be validated as well. A recent Warning Letter to Genzyme cited the following: “ Your firm failed to maintain computerized systems in a validated state”4 Some key areas to focus your attention are the validation of regulated applications as well as the maintenance and qualification state of the network. Standard operating procedures an auditor should be checking are: change control for both software and hardware, configuration management for the network, computer system validation lifecycle, network qualification, backup restore, disaster recovery, and security. Some questions you should ask as an auditor are: Does your data get backed up regularly? If so,where are the backup tapes stored? Offsite? Do you exercise a Disaster Recovery Plan? Is there physical security for the Data Centers? Can I see your change log for both software and hardware? Can I see a recent example of a computer system validation of a system? These are all good questions to ask when auditing the IT area. Training records for SOPs should also be checked to ensure employees, contractors, and consultants are trained on the procedures they are carrying out. Next, we turn to Manufacturing.”

Most of the testing performed in the FDA regulated industry is done on Commercial Off-The-Shelf Systems (COTS) and  negative testing is usually performed  by the COTS software vendor which is usually verified through software vendor audits.  At the same time, there are cases where is justified to perform negative testing as part of the Operational Qualification (OQ) of the system.

In summary, Henderson makes a very good point that we should always keep in mind during the evaluation of the testing strategy of the particular application.

1. A Risk-Based Approach to Auditing Laboratory Processes That Includes Electronic Systems
2. Electronic Records – Perspectives from FDA and Industry
3. Building an Effective Computer Systems Audit Program
4. Implementing Agile Software Development Methodology for Regulated Computerized Systems

Abstracts to these articles can be found here.

• Google Pagerank,
• Alexa Popularity,
• Technorati Authority,
• number of comments and
• number of sites linking to it

You can argue and challenge the way the list is ranked.  However, the important aspect is the fact that the list includes very good resources in the software testing arena.  Who is first?, Who came in last? , is not important.

Here you can read the list of software testing blogs.

1. Installation
   • Restricted privileges
   • Qualify
     • Physical
     • Functional
2. Maintenance
   • Revision controls (audit trials)
   • Updates (vendor)