RE: 21 CFR Part 11

Maybe we should put this discussion on a more solid footing, so here are some more thoughts: No software is 21 CFR part 11 compliant per se - not even SAS. What matters is that you can show what you did in full detail and reproduce it - even 10 years later. So you need to keep (and keep track of) all data files, control streams, output files, modifications, and whatever it takes to reproduce results. Call it the audit trail. When it comes to nonmem, in some extreme cases the results vary on different hardware or operating systems, sometimes even on the same computer using different compilers. So in the very least you need to be able to tell what compiler and version on what operating system and hardware you used, keeping log file and all other output in its original form. Simple example: it is not good if the date stamp on your nonmem control stream is newer than the date stamp of the log file. Validation does not mean that you get "correct results" (whatever that means), just that your results and the steps you took are reproducible. Defining up front what you are going to do is not required (as seems to be suggested below). On the other hand, being 21 CFR part 11 compliant is mostly relevant for submissions, and that frequently means population PK or other analyses defined up-front. One of the problems with nonmem is that software validation includes an assessment of how the software was developed and what quality control checks were employed. Often includes a developer and vendor audit. Usually you have 3 categories towards a full validation, software validation, installation qualification, and operational qualification. See also http://www.validation-online.net/ Validation can be done, and I once helped getting it done. It is mostly paperwork and getting a system in place that everyone uses consistently - or that forces people to be compliant. There are large systems in place that keep track of everything. These systems can be software solutions, operating system-based solutions, or databases like PKS where nonmem control streams and output are stored where the data sits anyway. We are sometimes concerned with nonmem validation, and it is certainly a topic when it comes to submissions. So I hope this sheds more light on the topic. Andreas ----- Andreas Krause, PhD Pharsight Corporation Strategic Consulting Services http://www.pharsight.com/