System Name:

CAMAG winCATS planar Chromatography Manager

Version / Date:

1.3.0

Manufacturer:

CAMAG, Sonnenmattstrasse 11, CH-4132 Muttenz

Is the system supposed to be used as a closed or open system?

Closed system
Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.

Assessment done by:

CAMAG, November 2003

Subpart A‑Electronic Records - ¤11.10 Controls for closed systems.

¤ 11.10 (a)

Does the vendor have a Quality Management System which supports the qualification / validation of the computerized laboratory system?

CAMAG supports IQ/OQ Services for all parts of winCATS.Ê The system has been developed according to our certificated ISO 9000 requirements

Yes

¤ 11.10 (b)

Does the system support the generation of accurate and complete copies of records? This includes the viewing, printing and archiving of data such as:

 -        Methods

 -        Pre/Post-run macros

 -        Calibration and calculation tables

-        Physical parameters such as temperature, pressure, flow, speed, pH, rH, wavelengths, mV, mA, time, retention time, etc.)

-        Actual sample data (weight, volume, sample size)

-        Integration parameters leading to peak identification, peak areas, baseline definitions, etc

-        Sampling rates and signal filtering conditions

-        Spectra

-        Sequence of events, injection sequences, order of processing, including:

á        Start date & time

á        Stop date & time

á        Operator ID who started and / or stopped the macro / sequence.

-        Audit trails, including date & time stamp and operator ID

Rather than using a data base (e.g. Oracle) winCATS saves all data to analysis files using a private file format

All data are saved to .cme files.

winCATS does not use macros

All parameter input, raw data, calculated results and data automatically generated by the system finally building up an analysis are saved to .cna files

Separate audit trails for logging system events (open/save/delete file, user account changes etc.) and analysis changes (parameters, re-integration, images, etc) are created automatically.

Yes

¤ 11.10 (b)

(1)

Are the information associated with archiving occurrences available for viewing and printing (this includes in particular the filename, file size, date & time when the archive record was generated)?

Stored files can be reloaded and viewed at any time. As winCATS uses a file based data system the customer is responsible for file management outside of winCATS, using the operating system capabilities.

Yes

File access and archiving has to be covered by a customer SOP

¤ 11.10 (b)

Does the vendor provide user manuals which address the generation of electronic copies and the printout of electronic records?

Yes. Manual is part of the winCATS help file that also can be viewed outside of winCATS using the operating system capabilities.

Yes

¤ 11.10 (b)

Does the system support a file format that can be provided to regulators or is it able to export data to such a format?

CAMAG supplies foc demo SW as Îviewerâ and 3rd party printout wrappers such as Adobe pdf writer or NewGenesis can be used.

Yes

¤ 11.10 (c)

Is the system able to support archiving of data mentioned above (&11.10. (b))?

See 10.11(b)Ê (1)

Yes

¤ 11.10 (c)

Does the system have a mechanism to modify analytical output data (actual results / calculated values)? (It should not).

No. winCATS stores all data in a private file format and no measured or calculated data can be edit within winCATS.

Yes

¤ 11.10 (c)

Are files write protected before, during and after archival and does the system provide a mechanism that deletion cannot occur before archival?

This item does not really apply to a file based data system. See 11.10(b)Ê (1)

Yes

File access and archiving has to be covered by a customer SOP

¤ 11.10 (c)

Does the system verify the integrity of stored data through archiving of the associated "archiving information": Archive file names, file size, last saving date & time?

Archiving is not part of winCATS.

Yes

Archiving has to be covered by a customer SOP

¤ 11.10 (c)

Is the system able to restore archived data?

Archiving is not part of winCATS.

Yes

Archiving has to be covered by a customer SOP

¤ 11.10 (d)

(2)

Systems being accessed through workstations which can be operated by multiple users and which bear more then one controlled application:

Is the system designed to allow for functional access controls?

Does the application have it's own security layer (application specific User-ID / password versus workstation "power-up" user-ID / password only)?

Yes

Each user has a unique UserID / Password

Yes

¤ 11.10 (d)

Are raw data / process data files created with write access limited to the system only?

File based system, restrictions have to be solved by the operating system using the Account Security settings

Yes

Must be covered by a customer SOP describing the Account rights assignment. This document is required during IQOQ.

¤ 11.10 (d)

Is the system designed to allow for user confirmation and supervisory approval options?

Covered by E-Signature functionality

Yes

¤ 11.10 (d)

Does the system support password-aging processes (prompts for password renewal after x days) and enforce minimum password lengths (if possible with at least 8 alphanumeric characters)?

Part of Îpoliciesâ dialog.

Yes

This document is required during IQOQ.

¤ 11.10 (d)

Does the system lock out users after a predefined number of login failures?

Part of Îpoliciesâ dialog.

Yes

This document is required during IQOQ.

¤ 11.10 (d)

(3)

Does the system provide a mechanism to log out / interrupt access of any user after a configurable period of non- attendance?

Supported by using operating system feature ( screensaver )

Yes

¤ 11.10 (d)

Does the system provide security audit logs, including audit trails for changes of user privileges?

All interactions by the winCATS Administrator are part of the winCATS system log. Changes to the operating system account manager can be logged by the operating system

Yes

¤ 11.10 (e)

Do changes to data not obscure or destroy original data and are they audit trailed?

Where comments can be added to existing records:

Are these comments audit trailed?

It is not possible to obscure or destroy any raw data

All changes to parameters are audit trailed.

Yes

¤ 11.10 (e)

Is the audit trail information modifiable (It must not)

No

Yes

¤ 11.10 (e)

Is the audit trail data archived as described above under ¤11.10 (c)?

Audit trail data are part of the analysis file and archived with it. winCATS system log data are stored / archived separately.

Yes

¤ 11.10 (e)

Does the laboratory system provide a mechanism whereby users can alter audit trails with standard security access? (It should not)

No

Yes

¤ 11.10 (e)

Is the system able to print out the audit trail in a human readable format?

Both analysis and system log information can be printed.

Yes

¤ 11.10 (e)

Is the audit trail information available in an electronic format that can be provided to regulators?

CAMAG supplies foc demo SW as Îviewerâ and 3rd party printout wrappers such as Adobe pdf writer or NewGenesis can be used.

Yes

¤ 11.10 (e)

Does the audit trail include the following information:

á        Start / hold / stop / resume programs

á        Change of any parameter, including selection of modes of operation, settings, etc.

á        Auto-calibration / simulation of inputs and outputs

á        Analyst acknowledgement of messages

á         Event messages / alarms?

Yes to all

Yes

¤ 11.10 (f)

Does the laboratory system support the logical execution of sequences such as:

á           Initialization / stabilization phase,

á           Setting / selection of key parameters,

á           Calibration / auto-calibration / reference measurements,

á           Sample measurement (execution of analysis),

á           Data acquisition and exploitation of results,

á           Stand-by steps, stop routines?

Yes.

winCATS supports logical workflow according to planar chromatography requirements.

All used TLC steps can be added to the analysis. Running the analysis starts at the 1st step and proceeds to the next after the previous step has been completed

Yes

¤ 11.10 (g)

Is the system designed to allow for functional access controls?

See 11.10(d) (2)

Yes

¤ 11.10 (g)

Where multiple users can access an application from one workstation:

Does the data entry screen display the name or unique User ID of the individual who enters data into a system?

Name and UserID are displayed on screen.

Yes

¤ 11.10 (g)

When electronic signatures are executed:

Does the system apply security checks to ensure validity and integrity of the signatures?

All E-Signature related data is (hashed) part of the analysis file it belongs to.

Yes

¤ 11.10 (g)

Does the system store passwords in encrypted form? Or is the access to files, which include passwords secure and is their access strictly controlled?

When password entry fields are shown on the screen:

Are the passwords hidden (e.g. "********")?

Passwords, UserIDs etc. are always saved in encrypted form.

Yes

Yes

¤ 11.10 (h)

In cases where the physical identity of an input (or output) device is relevant:

Does the system check the identity of this device? (This may apply to devices such as: specific workstations on the network, barcode readers, devices communicating through modems, radio frequency terminals, etc.)

Covered by use of private device handlers and or private communication protocol

Yes

¤ 11.10 (i)

Does the vendorâs personnel, who develop and maintain IT systems, have an adequate level of education and have they been trained appropriately?

Is the training documented?

CAMAG is ISO 9001 certified since 1994 and we just recently passed the recertification according to ISO9001/2000

Yes

Yes

Our certificate can be downloaded from www.camag.com

¤ 11.10 (k)

Does the vendor provide accurate and updated documentation for system operation and maintenance?

CAMAG supplies a complete set of user manual/help files, service manuals and IQ/OQ Services

Yes

Subpart B‑Electronic Records - ¤11.30 Controls for open systems

¤11.30

If the system invokes Internet or uses transfer protocols such as FTP over the Internet:

Are the files transferred encrypted?

Not applicable

Subpart C - ¤11.50 Signature manifestations

¤11.50 (a)