Does each workflow on our computer system need to be validated?
Yes, a workflow, such as creation of an electronic master production and control record (MPCR), is an intended use of a computer system to be checked through validation (see 160 §§ 211.63, 211.68(b), and 211.110(a)). If you validate the computer system, but you do not validate it for its intended use, you cannot know if your workflow runs correctly.
6 For example, qualifying the Manufacturing Execution System (MES) platform, a computer system, ensures that it meets specifications; however, it does not demonstrate that a given MPCR generated by the MES contains the correct calculations. In this example, validating the workflow ensures that the intended steps, specifications, and calculations in the MPCR are accurate. This is similar to reviewing a paper MPCR and ensuring all supporting procedures are in place before the MPCR is implemented in production (see 168 §§ 211.100, 211.186, and 212.50(b), and the guidance for industry PET Drugs — Current 169 Good Manufacturing Practice (CGMP))
FDA recommends you implement appropriate controls to manage risks associated with each element of the system. Controls that are appropriately designed to validate a system for its intended use address software, hardware, personnel, and documentation.