Application validation

Mikael Sandberg

So, as a FDA regulated company we have to validate off-the-shelf software that we use, with some exceptions. We recently went through an audit and is was brought up that the validation of Jira (written as a OQ/PQ validation) did not have requirements for backup and data retention. My argument is that this should not be part of the validation, since you are validating it based on you expected behavior and that it performs in accordance to our issue management process. In my previous life, backup and data retention was mentioned in the validation plan that it followed the process used by your IT department and it was tested as part of the initial Installation Qualification. The intention was that you could give the test plan to anyone to run, without giving them access to backup locations, admin rights in the tool etc.

So my question is, in your OQ/PQ validations do you have requirements and test cases for backup and data retention?

Tom Lister_fo1j4e

Hi @Mikael Sandberg 

I’ve worked a lot in finance and had similar strict audits. For backups, it is down to our ops teams & dbas to provide a backup strategy that matches the retention and sla’s we set. Its not usually part of the product itself as far we were concerned - other than verifying a restore from back up is feasible.

Jira has its own Xml backup cycles but its not recommended to relybon that for large/critical installations. There should also be database and file system backup processes in place. And as you mention, we would normally state ‘uses IT standard backup plans’.