USP <1058> Analytical Instrument Qualification and its Impact on the Chromatography Laboratory

USP <1058> originated at a conference organized by the American Association of Pharmaceutical Scientists (AAPS) in 2003 called Analytical Instrument Validation. The first thing to bite the dust was 'validation' as the attendees agreed that instruments are qualified and processes, methods and computer systems are validated. Thus analytical instrument qualification (AIQ) was born, prior to this it had humble beginnings as simply equipment qualification (EQ). The debate about EQ versus AIQ should be reserved for a bar with copious amounts of alcohol as you will be arguing about the same process except the name has changed. Either term means that any instrument is fit for its intended use — nothing more and nothing less.

AAPS published a white paper of the conference in 2004,² incorporation as a potential USP general chapter followed in 2005 and review cycles followed until it was finally adopted. It is worth remembering at this point that USP general chapters between <1> and <999> are requirements (you must comply or your product may be deemed to be adulterated) and those between <1000> and <1999> are informational in nature (alternative approaches are OK if they are justified).

Take care, however, although <1058> is informational it implicitly refers to other USP requirements pertinent to specific techniques for example, <21> Thermometers or <41> Weights and Balances that are requirements. Therefore, be warned and careful in your overall approach to qualification.

Potential Problems with USP <1058>

At first sight USP <1058> seems fine: it appears to be a logical and practical approach to qualification of equipment and instrumentation. It is only when you dig into the details and explore the implications that you find that there are potential problems that could catch you out if you don't think things through and interpret the general chapter sensibly. As we go through this column I will point out areas that will need special care in your interpretation and approach for chromatography and associated equipment, instruments and systems.

Positioning AIQ Versus Other Laboratory Quality Checks

A common debate with analysts who do not understand the problem that if we validate an analytical method it does not matter which instrument we run it on: a chromatograph is a chromatograph isn't it? Unfortunately, this is not the case and a hierarchy of quality checks is described succinctly in <1058>.

• The foundation of all quality analytical work is the qualification of the instrument: so you do undertake AIQ first (ideally during the purchase and installation and before you use the instrument, rather than after you have bought it and have been caught by Quality Assurance using it). This establishes that the instrument is fit for use around the operating parameters that you test against. Some examples are the maximum and minimum pump flow-rates and the wavelength range for the detector.

• Similar to building a house, the next stage is to develop and validate analytical methods for your work within the parameters you have qualified — don't exceed them as your chromatograph is not qualified. Again as an example, if the analyte you are developing a method for has a λ_max outside of the wavelength range you have just qualified then you will exceed the qualified detectors working range and should requalify the detector.

• Next, when you apply the method you'll check that the instrument works before you commit samples for analysis. This could be a balance check versus a known calibrated weight to see correct operation or a system suitability test (SST) to ensure that the chromatograph and the method work on the day before you have committed the samples for analysis.

• Finally, you may include quality control (QC) and perhaps blank samples to check that the chromatographic analysis results are OK and give you further confidence in the method's operation on the day.

This is shown diagrammatically in the USP chapter as a triangle with AIQ at the base and QC samples at the apex. Note that the only instrument layer is the instrument qualification (first stage), which should be performed with measurement instruments such as flow meters that are calibrated to national or international standards. The remaining three levels of checks are method-specific checks which assume that the chromatography or instrument is working correctly.

So the bottom line is if you don't qualify the instrument, or do it incorrectly, all the other work you do is potentially wasted. So that's the easy bit. However, the problem with <1058> is that it is written from the perspective of the laboratory, but do you develop and manufacture your own chromatograph instruments? Probably not, so let's look in more detail at the basics of the instrument qualification process described in <1058> and in doing so we'll revisit the hierarchy of the quality checks again, but in an expanded form.

Instrument Qualification Process

The process for instrument qualification follows the 4Qs model for the specification, installation check and monitoring of on-going instrument performance:

• Design Qualification (DQ): Defining the functional and operational specifications of the instrument and any associated software for the intended purpose. This is performed before purchasing a new instrument. It is this part of the process that is typically performed poorly or not done at all and leads to chromatographers buying instruments that will not work as expected.

• Installation Qualification (IQ): Establishing that an instrument is delivered as designed and specified, and it is properly installed in the selected environment. USP <1058> states that this is to be performed at the installation of the system on new and also on old or existing systems (please see my comments below).

• Operational Qualification (OQ): Documenting that the instrument will function according to its operational specification in the selected environment. However, the terminology forgets the intended purpose of the instrument — this is a key omission and you must remember to include this in your qualification at this stage.

• Performance Qualification (PQ): Documenting the activities necessary to demonstrate that the instrument consistently performs according to specification and intended use. I will not discuss PQ further in this column, but this will use system suitability tests as a means of checking and those will be the subject of a Questions of Quality column later this year.

However, there are a few little problems with this simplistic approach.

I'm Lazy — Let's Get the Vendor to do the DQ

This is one of the major causes of trouble with this approach. Under DQ the chapter states that "DQ may be performed not only by the instrument developer or manufacturer but may also be performed by the user." Wrong! Wrong!! Wrong!!! Manufacturer's specifications have a number of purposes such as to show that their chromatograph is better than the competition, limit the vendor's liability and be the benchmark to compare against when the instrument is installed. Furthermore, in some cases manufacturer's specifications may be totally irrelevant and meaningless to your intended use. As a specific example, a benchtop centrifuge had a rotor-speed specification of 3500±1, however, on further investigation this was measured without a rotor. Therefore, the manufacturer's instrument specifications are not always useful for defining your intended use specification or be the sole component of an instrument's DQ. This is the total abrogation of the user's responsibility.

YOU, the laboratory user are responsible in law under the GMPs to define the intended purpose for your instruments. Furthermore, YOU, the laboratory user are responsible to your company to purchase instruments that meet your business need. Never rely on a manufacturer's specification to specify your requirements. However, it can be used to enhance or change your specification.

More Detail of the Quality Checks Hierarchy

The <1058> triangle that I mentioned earlier now needs to be modified and expanded so that you can have a better understanding of my approach to the 4Qs model. My take on this is shown in Figure 1 and it is shown as a time sequence running from left to right. The elements of data quality described in <1058> are shown as the top four layers. I have expanded the AIQ layer to show how it relates to the instrument vendor's processes and, therefore, it is these bottom two layers that we will concentrate on in more detail.

Figure 1

In the beginning was an instrument that was specified, designed, manufactured and supported by a manufacturer to perform one or a series of analytical tasks. This instrument sits at the vendor's facility until a sales person visits, or you flick through an issue of LCGC Europe, visit an instrument exhibition or you decide to purchase a chromatograph to do a specific task.

STOP! Do not pass go and do not collect £/€200. Also do not get seduced by the salesperson slithering over the floor towards you. Here is where you have to do some work and define what do you want the instrument to do, especially if it is a new technique for your laboratory. Do some leg work and research and define the following:

• Key operating parameters.

• Sample presentation to the instrument: liquid, solid, semi-solid?

• Numbers of samples you expect: do you need an autosampler?

• Bench space available.

• Services: power supply required and any other services?

• Environment: will you be analysing toxic substances or can the system sit in an open laboratory?

Now write it down: this is your specification. Then approve it, refine it and update it as it's a living document.

GO! Now check your specification versus the instrument from a vendor as you have the basis on which you can make the decision: your specification. This is why <1058> is wrong to suggest that the bulk of the work is a vendor's; it is not. Only a user can undertake a full DQ, a vendor may supply their specification but that is only to compare with yours. Ignoring YOUR specification is a high business risk, but you have never bought an instrument that did not work have you?

Look outside the pharmaceutical industry for a moment to other quality standards; ISO 17025 has a footnote to laboratory equipment that most people gloss over but it is very important in this context. The footnote states that laboratory and manufacturer's specifications may be different, you may want the system to do something that a manufacturer has not considered or you work in a very narrow range of the operating parameters that the instrument is capable of. Hence the need to define your instrument and system requirements, otherwise you will have problems in that the purchased system may not meet your needs. The message for the DQ phase of AIQ is for the user to ask what they want the instrument or system to do and document it, regardless of the statements in USP <1058> that are designed to dump the responsibility on the vendor and not the user.

The section of USP <1058> on installation qualification mentions that IQ also applies to "any instrument that exists on site but has not been previously qualified". I disagree. What this means is that you take your functioning system apart and rebuild it and carry out an IQ at the same time? Now that's an added-value activity that will impress your boss at performance appraisal time. Consider the following approach as an alternative: what you need to do is establish control over the existing instrument and all its constituent components and demonstrate that it works as intended.

• First, list all the major components of the system, take model and serial number of the instruments and details of any computers and software (application, database and operating systems and the respective service packs). Of course, you may already have this information in a log book, in which case check that the items are correct and update anything that needs it.

• Second, collate all documentation associated with the system: installation and service records and establish, if you have not done so, an instrument/system log book.

• Third, put the system under change control and do not change or update any component unless you have gone through a change request.

• Fourth, document the fact that no retrospective IQ will be performed as you will be taking the working system to pieces and rebuilding it.

• Fifth, perform a full operational qualification to demonstrate that it performs its intended purpose against your specification.

Now having discussed the problems of the <1058> 4Qs model, let us look at the classification of chromatographs and equipment.

USP <1058> Instrument Classification

The problem is that when we look around the laboratory we see equipment and instruments that vary from a vortex mixer to a complex and sophisticated quaternary gradient chromatograph with diode array detector (typically purchased by R&D!). One question that is often raised is should we apply the same qualification approach to all equipment and instruments in our laboratories? The answer is no and the USP <1058> answer to this is a relatively simple and straightforward classification scheme for all equipment, instruments or systems into one of three categories:

• Group A

• Group B

• Group C

Table 1 shows the criteria for classification and how each are qualified together with some typical examples in each group. There is a built-in risk assessment as Group A equipment is the lowest risk requiring the smallest amount of work and Group C systems represent the greatest risk and hence the most work.

Table 1: USP Instrument Group Classification and Qualification Approach.

You'll see from the table that chromatographs typically fall into Group C as they are complex instruments and are typically operated via a PC with a chromatography data system (CDS) that is either standalone or networked.

It's Only a Sonic Bath

Now let's take an example from the list of instruments and equipment in the right hand column, say a humble sonic bath and walk through the classification process and look at the impact. According to <1058> the bath falls into category A as its standard equipment and conformance with requirements can be verified by observation of the operation.

This approach is OK isn't it? Well let's look at the small print here. In Table 1 it says "Conformance with requirements verified and documented by observation of operation." Note the word 'requirements'. This is your specification (written during the DQ phase that most people typically don't do...) and, therefore, the classification of the sonic bath as a Group A instrument depends entirely on what you want to use the instrument for. So if all you are using the sonic bath for is simply dissolving material in volumetric flasks and you will use observation as the way to determine if the compound has dissolved, this is OK. If there is material still undissolved, then all you do would be to replace the flask in the bath and turn on the power for another minute or so. So if the sonic bath is used in this way it falls into Group A and can be qualified as outlined in Table 1.

However, if the method calls for a specific amount of sonic energy and/or temperature and the flasks may also be placed in specific locations in the bath, then this is a different intended use and now takes the not so humble sonic bath into Group B. Here we need to consider calibration of the bath for sonic energy and temperature, mapping the sonic energy levels to identify where to place the flasks and also IQ/OQ to see that the installed unit meets our specification, which of course we will have documented before we bought the bath.

OK, let's take a slightly different tack now and consider our sonic bath again but from a different perspective. What would be the situation when it is used not as a standalone item of equipment but integrated and used within a robotic system. OK, so what do we do now? We need to consider qualification from two perspectives: first, the bath as a standalone item and second, integrated within the robotic system. Again how the bath will be used in the robotic system will determine the approach but there will be two qualification passes: a first pass to install and check out the bath itself and a second pass where the bath will be qualified as part of the operation of the whole robotic system. So the sonic bath would be Group A or B (as discussed above) for the first pass qualification and Group C as the second pass qualification within the overall system.

The Importance of YOUR Requirements

So please do not look at the list of equipment and systems in Table 1 and in <1058> itself and think because a particular item falls into a specific category that it is a definitive statement. Think about how you will use this and look at your requirements. The one point that all three sonic bath scenarios make is that if you have not defined what it will do, you will be non-compliant with 21 CFR 211.63:

Equipment used in the manufacture, processing, packing, or holding of a drug product shall be of appropriate design, adequate size and suitably located to facilitate operations for its intended use and for its cleaning and maintenance.³

Writing the specification for laboratory systems, instruments and systems is the area where most organizations fail because the entire qualification approach is the 3Qs model of IQ, OQ and PQ. There is zero consideration of DQ until the users have realised they have bought the wrong instrument!

Don't Validate Software According to USP <1058>

Virtually all instruments have software varying from firmware for the basic instrument operation of some Group B instruments to a separate data system running on a PC to cover instrument control, data acquisition, analysis and reporting for the Group C instruments. The <1058> approach for Group B instruments is to implicitly test the firmware as part of the IQ and OQ phases of the qualification — this is a good and pragmatic approach that I fully agree with. However, it contrasts with the latest version of the GAMP Guide⁴ and we will discuss this subject in more detail in another Questions of Quality column.

Group C instruments are where I have a difference of opinion with USP <1058> and its approach to software validation. To say that the CSV approach advocated by <1058> is too simplistic and naïve is the politest thing that I can say before the editor reaches for the delete key. For instrument control, acquisition and processing software the rationale is to leave the whole job to the vendor and implicitly test during instrument qualification. To quote <1058>: The manufacturer should perform DQ, validate this software and provide users with a summary of the validation.¹ Dream on dear reader! At the user site, holistic qualification, which involves the entire instrument and software system, is more efficient than modular validation of the software alone. Thus, the user qualifies the instrument control, data acquisition and processing software by qualifying the instrument according to the AIQ process.¹

Let's start looking this approach for Group C instruments in more detail.

• The vendor will validate the software. This contrasts with the EU and US GMP or GLP regulations that put the responsibility for software validation onto the user. The key to the problem is that does your use of the system match that of the vendor?

• The vendor's software development materials are proprietary and can only be seen when you conduct a vendor audit at the company facilities.

• Compare the marketing literature with the software warranty. The marketing literature says the software will do the job but the warranty states that if anything does wrong the vendor is not responsible as the software is used "as is" and the user takes full responsibility for malfunctions. Try telling an inspector this one!

• The assumption is that the software will be used as installed and without modification. For non-configured or non-customised products this is may be true but has the vendor validated system software on your computer hardware, software and network? For many applications, for example, chromatography data systems, this is not the case as the software will be modified or adapted by the users⁵ and LIMS. In this latter case, the <1058> approach is totally inadequate and deficient for complex systems as it omits the following critical items of software validation:

– Configuration of security and access control for the user community.

– Configuration or customization of the software to match your ways of working.

– Definition and testing 21 CFR 11 (electronic records; electronic signatures final rule) functions as used in your laboratory.

– Implementation of custom reports.

– Implementation of custom calculations.

– Macros defined and written by the users.

– Interfaces to other computer systems and transfer of data and information between them.

For Group 3 instruments with data systems you will leave yourself exposed if you follow the computer validation approach in USP <1058>.

There is also reference to the FDA guidance for General Principles of Software Validation⁶ for the validation of LIMS. While this guidance is probably the best that the FDA has written on software validation you have to remember that the originating centre is the Centre for Devices and Radiological Health (CDRH). It is also written primarily from the perspective of developing software for a registered medical device and as such avoids the use of IQ, OQ and PQ, which will make the mapping of <1058> to the approach outlined in the guidance much more difficult.

Summary

I have reviewed key parts of USP <1058> on Analytical Instrument Qualification (AIQ) to highlight areas in the general chapter where care will need to be taken to prevent too literal an interpretation that could result in regulatory non-compliance.

Bob McDowall, PhD, is principal at McDowall Consulting, Bromley, Kent, UK. He is also a member of the Editorial Advisory Board for LCGC Europe.

References

1. United States Pharmacopeia, General Chapter <1058> Analytical Instrument Qualification, First Supplement to USP XXX1 p3587 (2008).

2. AAPS, AAPS White Paper on Analytical Instrument Qualification (2004).

3. FDA 21 CFR 211: Current Good Manufacturing Practice Regulations.

4. International Society for Pharmaceutical Manufacturing (ISPE). Good Automated Manufacturing Practice guidelines, version 5, Tampa, Florida, USA (2008).

5. R.D. McDowall, Validation of Chromatography Data Systems: Meeting Business and regulatory Requirements, Royal Society of Chemistry, Cambridge (2005).

6. FDA Guidance for Industry, General Principles of Software Validation (2002).