What Has Changed with the 2017 Version of USP <1058>?
US Pharmacopeia (USP) general chapter <1058> on Analytical Instrument qualification (AIQ) was first implemented in 2008 and remained unchanged for nine years. During 2017, the USP implemented two updates to <1058> (in August and December). These updates have a significant impact on AIQ, and as the only major pharmacopeia with a chapter dedicated to AIQ, changes to USP <1058> are of global significance.
To help regulated laboratories fully comply with 2017 <1058> requirements, Agilent has produced four White Papers with compliance consultant Bob McDowall, who has been closely involved with the development of <1058>. The series includes:
- What Has Changed with the 2017 Version of USP <1058>?1
- How to Comply with the 2017 Version of USP <1058>2
- The Role of Analytical Instrument Qualification in Data Integrity with the 2017 Version of USP <1058>3
- What Does Performance Qualification Really Mean with the 2017 Version of USP <1058>?4
This White Paper is the first in the series, and provides information to help laboratories understand the significance of the changes associated with the August5 and December6 updates to <1058>, and compares USP requirements between the 2017 and 2008 versions of <1058>6.
A high-level flowchart showing the sections contained within 2017 USP <1058> is included in the Appendix, along with a detailed comparison of the 2008 and 2017 versions, which is discussed in this White Paper.
Dr. R. D. McDowall
R. D. McDowall Limited, UK
P. A. Smith
Agilent Technologies, Inc.
A brief history of USP <1058>
First implemented in 2008, USP <1058> originated from an American Association of Pharmaceutical Scientists (AAPS) meeting held in 2003. The resulting White Paper7 was the basis for USP <1058> and, after public review, it was incorporated into the USP in 2008.
A round table discussion of <1058> was held in 2010, at the AAPS Meeting8. Paul Smith was co-chair of this meeting, which included brief presentations followed by an open forum panel Q&A session with invited speakers Bob McDowall (representing a European perspective), Horacio Pappa (representing USP), and Cindy Buhse (representing FDA). Over 250 people attended the two-hour event, which initiated discussions about updating <1058>. The update started in 2012 with the publication of a stimulus to the revision process by Burgess and McDowall, in Pharmacopeial Forum9. The stimulus paper proposed an integrated approach to AIQ and computerized system validation (CSV). Proposed updates to <1058> were published in Pharmacopeial Forum in 2015 and 2016 for public comment. The 2017 version of <1058> became effective on 1 August 20175, and most of the changes were implemented. The December update6 included an amendment to clarify wording of the Operational Qualification (OQ) section—a small but significant change.
We now address what has changed in the new version of USP <1058>, and how this impacts laboratories and their approach to AIQ.
The global role of USP <1058>
The USP is the only major pharmacopoeia to have a general chapter on AIQ, so many companies use the approach as a basis for qualifying their analytical instruments. USP <1058> is an important document as it is the only risk-based regulatory guidance on the subject.
USP <1058> is an informational general chapter (providing strong guidance) outlining a scientific and risk-based approach to AIQ, but it does not define the acceptance criteria for specific instrument types, stating6:
“Detailed instrument operating parameters to be qualified are found in the respective general chapters for specific instrument types.”
The amended update, published in December 20176, related to changing the wording of the OQ section to explicitly state:
“OQ demonstrates fitness for the selected use, and should reflect URS”.
Recap of USP <1058> Groups A, B, and C
Two of the most useful features of the 2008 <1058> for AIQ were the provision of the Data Quality Triangle (in the Components of Data Quality section) and the classification of instruments into Groups A, B, and C. Both of these features are retained in the 2017 <1058> update, contributing to the familiarity of the general chapter. Separating instruments into groups is an example of risk-based thinking by classification, and is one of the many areas of similarity between USP <1058> and the GAMP good practice guide10.
Groups A, B, and C are retained in the 2017 <1058>, and the classification is similar (although the wording has been refined):
- Group A: Includes the least complex, standard instruments that are used without measurement capability or user requirement for calibration, such as a magnetic stirrer or vortex mixer. Proper function is ensured by observation, and no further qualification activities are needed for this group.
- Group B: Includes instruments that may provide a measurement or an experimental condition that can affect a measurement. Examples include a pH meter or an oven. Proper function of instruments in this group may require only routine calibration, maintenance, or performance checks. The extent of activities may depend on the criticality of the application. Generally, these instruments may have firmware, but not software, that is updated by the user.
- Group C: Comprises analytical instruments with a significant degree of computerization and complexity, such as high-pressure liquid chromatographs and mass spectrometers. All elements of qualification, including software validation, must be considered to ensure proper functioning of instruments in this group.
The general compliance strategy for each of the three instrument groups can be represented as shown in Figure 1.
The role of AIQ in data integrity
Data integrity in regulated laboratories is the focal point in the pharmaceutical industry. It is important to realize the significant contribution that AIQ makes to data integrity. This is best demonstrated by a four layered Data Integrity Model11. Figure 2 shows the analytical portion. The four-layer approach can be compared to building a house:
- Foundation: Data governance, management leadership, policies and procedures, training, culture, and ethos.
- Level 1: Right Instrument and System for the job: Instrument qualification and computer system validation.
- Level 2: Right analytical method for the job: Development and validation of analytical procedures.
- Level 3: Right analysis for the right reportable result: Analysis from sampling to reporting the result.
The foundation level of this four-layer model consists of the data governance elements, for example, management leadership, policies, procedures and training for data integrity, and an open culture. If these elements are not securely in place in an organization, work in other layers may fail due to data integrity breaches.
Following the foundation, if the analytical instrument, software, or computer system (Level 1) is not “fit for intended use”, the “analytical levels” 2 and 3 will fail. USP <1058> states the following about AIQ:
“AIQ forms the base for generating quality data”
In the four-layer data integrity model shown in Figure 2, all levels must be in place for secure analytical results. The role of AIQ in data integrity is discussed in more detail in the third White Paper in this series: The Role of Analytical Instrument Qualification in Data Integrity with the 2017 Version of USP <1058>3.
Why do we need a new version of USP <1058>?
These are the main limitations with the 2008 version of <1058>:
- User requirements are not defined: This means that virtually any OQ protocol could be used to qualify an instrument, even if it did not cover the whole operating range of the instrument.
- Users are responsible for DQ: 2008 <1058> places great emphasis on the fact that the design qualification stage is the responsibility of the supplier, but only a user can define their intended use of the instrument to comply with GMP regulations (§211.63).
- The true role of the supplier is missing: The supplier is responsible for the instrument specification, detailed design, and manufacture of the instrument, but this is not mentioned in 2008 <1058>.
- Poor software validation guidance: Verification of embedded calculations is required by 211.68(b), and users have inadequate responsibility for verification of user‑defined programs and validation of instrument application software.
- PQ requirements were ambiguous: Differences associated with the role of OQ and PQ testing of instruments was not clear.
One of the major benefits of 2008 <1058> was the introduction of a simple regulatory-aligned, risk-based approach to AIQ, which simplified the requirements for instruments in categories A and B. Before implementation of <1058>, there was an over-reliance on documentation7. The 2017 version of <1058> integrates Analytical Instrument Qualification and computerized system validation requirements. This retains all the original benefits while overcoming limitations, and extends the simplification of AIQ into some Group C categories.
What has changed in 2017 <1058>?
In the 2017 version of <1058>, limitations with the original version (outlined above) have been addressed and an integrated approach to AIQ and computerized system validation has been implemented. This integrated approach aligns USP <1058> with GAMP more closely than previous comparisons10.
Table 2, in the Appendix, shows the main changes between the original 2008 version of USP <1058> and the 2017 version of <1058>. Some of the main changes discussed here are:
- Example instruments in Groups A, B, and C are deleted: The 2017 version does not contain a list of example instruments for Groups A, B, or C, as the list was misleading; “fixed” category examples are not aligned with risk-based thinking. The classification is based on the intended use, and <1058> now states: “the same type of instrument can fit into one or more categories, depending on its intended use”.
- User requirements must be documented: Without user requirements, it is not possible to test the system to demonstrate that it is suitable for intended use. This now harmonizes <1058> with 21 CFR 211.63 for users to define their intended use. User requirements are essential for AIQ.
- Risk assessment: Needs to be performed to determine the correct approach to qualifying an instrument (and to which group the instrument is to be assigned).
- Qualification documents can be combined: For example, IQ and OQ, or other appropriate qualification phases, could be combined. This harmonizes <1058> with section 2.5 of EU GMP Annex 15 on qualification and validation.
- Software needs to be specified: As software is pervasive throughout Groups B and C, it needs to be specified along with the intended use of an instrument.
- Operational qualification: Must be linked to User Requirements.
- Performance qualification: Differences between the functions of an instrument OQ and PQ are clarified (and the need to perform both).
Protocol documentation option—merging qualification documents
Both the 2017 USP <1058> and clause 2.5 of EU GMP Annex 11 note that, where appropriate, it is acceptable that some documents (for example, IQ and OQ protocols) could be merged into a single document. Note the use of “where acceptable”. For a single instrument, this means that both IQ and OQ can be executed under a single set of pre- and post-execution signatures, which can save time compared with executing separate IQ and OQ documents for the same instrument. However, this requires a note of caution, stating that merging a multi-instrument installation into a single document would not be advisable or practicable, as it would prevent parallel execution by two or more service engineers.
Merging AIQ stages such as IQ and OQ into a single document, does not obviate the role of the laboratory user to review and approve the work from the perspectives of scientific soundness and regulatory compliance. For practical reasons, decisions about merging documents are also influenced by the size of the documents.
Impact of changes on the 4Qs model
The impact of the 2017 <1058> changes to the 4Qs model are significant, and are depicted in Figure 3. Software-based V models, such as those based on GAMP, do not translate well to AIQ (unless the instrument AIQ is directly associated with validation of the instrument control software such as CDS). Most instrument‑specific qualification diagrams typically present the 4Qs model as a linear process, but in Figure 3, the true V model relationship between key instrument qualification stages are shown.
Two of the changes that have most impact on a laboratory are the need to write a User Requirements Specification (URS) and perform a risk assessment (RA) to determine the group classification. This is shown on the left side of the instrument qualification V model. The consequence of this approach is that the OQ must test the range of use defined in the user requirements, as shown on the right side of the V model.
There is a further impact: does the OQ protocol test the laboratory’s actual requirements as defined in the URS, or is a one-size-fits-all qualification used? If it is one-size-fits-all, there is the issue of coverage against the user requirements. We discuss this in the next section.
Impact of change on a qualified instrument
Analytical instruments used in regulated laboratories (for example, Pharmaceutical GxP analysis) must be subject to appropriate change control processes so that the potential impact of the change can be evaluated and approved before being implemented. This must be managed through change control procedures.
Some of the key types of instrument changes that need to be managed are:
- Change of use
- Change to components
- Change of location
- Change of compliance status
Change of instrument use and impact on AIQ
One key change in the 2017 <1058> is that many of the AIQ stages are dynamic and not fixed. For example, if the use of an instrument changes, this may have an impact on AIQ requirements and, hence, compliance status. It is important for the person responsible for an instrument to know the user requirements, so that when there is a change of use, they can assess if the instrument qualification and associated documentation need to be updated. The feedback loop in Figure 3 represents this. For example, consider that there is a specification for the flow rate of an HPLC pump to be between 0.5 and 2.1 mL/min, as shown in Table 1. If a new method is implemented with a flow rate of 1.0 mL/min, there is no issue, as the change is within the limits qualified. However, if a new method that has a flow rate of 2.5 mL/min is used, this has a direct impact on the instrument because it is outside of qualified limits and intended use specification (for example, the URS). The principles of this apply to all instrument functions specified and tested during the AIQ.
Therefore, for this example of change of use (new method with flow rate of 2.5 mL/min), the following needs to happen:
- URS must be updated
- DQ must be updated (if in a separate document)
- Risk assessment reviewed to see if any changes need to me made
- OQ protocol needs to be updated, approved, tested pre-execution, and reviewed post execution. The extent of testing may just be the pump module or may also include a holistic check of the whole chromatograph—depending on local procedures within the laboratory
- Release for use with the new limits
Change of components
Where there is appropriate information to support the equivalency of components, their replacement does not represent a change to the instrument. Some components are classified as consumables and user-replaceable, while others are typically changed by a certified engineer (or equivalently trained person). The level of testing and certification performed on component parts can vary between companies. Use of lower-cost parts to reduce costs, such as HPLC lamps with no lifetime guarantee, can result in instrument failure and higher overall laboratory costs12.
Where firmware needs to be updated (for example, standardized for compatibility), this represents a change that needs to be approved through change control. Information released with the instrument firmware can help support the change control process, which needs to define how the change in firmware will be documented and tested.
“I’m just moving this qualified instrument”.
The statement sounds innocuous, but the alarm bells should be triggered in the Quality Assurance department. Changing the location of an instrument (moving, relocating, and so on) typically follows a change control process, unless the instrument is classified as portable (for example, designed to be moved or handheld). When contemplating moving an instrument, stop to think about what may be required from a qualification perspective for:
- A small move along a bench
- Between rooms
- Between buildings
- Between sites
- Between countries
In addition to the need to follow a change control process, with any instrument move, a risk assessment should be undertaken to determine what level of qualification must be performed (for example, how much of the life cycle must be carried out). You should also consider what testing needs to be performed before the instrument is dismantled before shipping. If no premove tests are performed, and the instrument qualification fails at the new location, it may not be clear if the failure occurred during shipping or was present, but undetected, before moving. This will lead to questions about the instrument results before the move, and will require an impact assessment. It is much better to standardize the premove and postmove testing for each instrument type, so that the instrument is tested before the move (safeguarding premove use), and these tests are repeated at the new location. Typically, premove and postmove testing is in addition to any IQ/OQ/PQ performed at the new location.
Change of compliance status
One question regulated laboratories need to address is the level of requalification required after an instrument repair. If an instrument is repaired, it cannot be put back into use until the performance of the instrument has been tested. For example, if the pump seals on an HPLC pump are changed, the only tests that need to be performed are those specific to the repair (for example, pump flow accuracy and precision). However, this needs to be documented in an appropriate framework to support the decision, otherwise an auditor may expect a full qualification to be performed for every repair, however small. Suppliers and service providers may be able to offer support in the development of such Repair Qualification frameworks, if the laboratory lacks the necessary expertise in this area.
Information associated with the repair can be helpful for the laboratory to evaluate the potential impact of the instrument failure on analytical results. Some laboratories may swap out modules of a system to keep the instrument running. When a prequalified module is inserted into a system, an appropriate level of testing on the system needs to be performed. Without instrument repair information, it can be harder to perform an impact assessment.
From principles to practice
To provide an illustrated example of the thinking necessary to identify user requirements, Table 1 lists example components of a chromatography instrument. The 2017 <1058> says that user requirements for commercial instruments should be minimal, but what does this mean in practice?
When comparing user requirements and instrument specifications with qualification processes, there are many key points to consider:
- Instrument life cycle documents: Life cycle information associated with instrument manufacture, such as the design documentation, manufacturing details, firmware testing, and specification testing performed during the manufacturing process and before shipment is detailed. This information is commercially sensitive, and may only be available through supplier audit or confidential disclosure agreement.
- Manufacturer’s specifications: Instrument specifications are not always defined in the same manner between instrument manufacturers, requiring care when comparing specifications.
- Qualification limits: Instrument specifications can be significantly tighter than regulatory requirements defined in sources such as the USP, Ph. Eur., or other pharmacopoeia, which can cause confusion over the limits that should be used during qualification. Generally, the acceptance criteria applied during AIQ should align with the regulatory requirements, as these are what might be challenged during a regulatory audit. Applying limits that are tighter than regulatory requirements can increase the risk that an instrument fails the AIQ. This makes defining the user requirements a critical stage.
- User requirements: Historically, some companies may have copied the instrument manufacturer’s specifications when defining their user requirements for an instrument. An instrument specification plays a key role in the instrument selection process.
- Group A: URS not required.
- Group B: For simple commercial instruments that are classified as Group B through a risk assessment (for example, a pH meter), it may be permissible to reference the manufacturer’s specification in the URS.
- Group C: For complex commercial instruments that are classified as Group C through a risk assessment (for example, HPLC system), copying the instrument specification in the URS should be avoided.
- System configuration: The specific components/modules included in the system influence the specification and OQ testing (for instance, the detector type).
- Detailed specifications: A full instrument specification for a complex system, such as an UHPLC (for example, an Agilent Infinity II System), exceeds 100 pages when all the module options are considered13.
The first column of Table 1 contains example analytical methods A, B, and C with which the instrument will be used. Instrument settings associated with these methods are listed for the relevant system components in Table 1. These form the basis for the intended use and, hence, user requirements for the system. In practice, laboratories will have more than three methods, but the principles remain the same.
For example, the HPLC flow rate for the three methods listed ranges from 0.5 to 2.1 mL/min. The instrument specification for the pump is 0.001 to 10 mL/min, so the pump flow requirements for the intended use are within the specification range of the instrument. The pump flow measurements in the OQ need to cover the intended range of use (0.5 to 2.1 mL/min), but it would be meaningless to test the full flow specification for the instrument. Similarly, one of the intended methods is isocratic, but two are gradient HPLC methods with a combined gradient proportioning range of 25 to 75 %B (for simplicity, binary mixing is assumed for this example). The OQ needs to demonstrate the performance of the gradient pump across the intended mixing range. If the OQ performed by the service provider or supplier does not test the intended range of use, the laboratory will have to perform this instrument OQ testing.
For some instrument parameters, the ability to test the range of use is limited to the availability of reference materials. For example, the wavelength specification for the HPLC UV-Visible detector is typically 190 to 600 nm. However, there are no suitable reference materials available for HPLC UV-Visible detectors below the 205 nm caffeine peak. The detector cannot be tested below 205 nm using caffeine (or any other chemical reference material). Any use of the detector below 205 nm would need to be justified by the laboratory. One of the methods uses a wavelength of 281 nm, which is above the 273 nm peak of caffeine, so extra reference material would need to be used, such as holmium oxide in perchloric acid to ensure that the wavelength range of use (205 to 281 nm in this case) is tested within the OQ.
For temperature-controlled analytical methods, temperature stability of the temperature-controlled instrument component needs to be evaluated, ideally by direct metrology measurement using a suitable calibrated device.
Roles and responsibilities of key players in AIQ
The introduction section of 2017 <1058> includes the clarifying statement:
“The instrument owners/users and their management are responsible for assuring their instruments are suitably qualified.”
The following supplementary guidance is provided within the OQ section of 2017 <1058>:
“For OQ test packages purchased from a service provider or supplier, the user must review the material to ensure themselves of the scientific soundness of the tests and compliance with applicable regulations.”
The qualification protocol must be approved before it is executed, and the OQ work must be reviewed and approved when complete.
Changes in the Roles and Responsibilities section include:
- Users: Users are ultimately responsible for specifying their needs, and ensuring that a selected instrument meets them and that data quality and integrity are maintained.
- Manufacturers: Manufacturers are responsible for the design and manufacture of the instruments, and ensuring the quality of the processes used, and for developing meaningful specifications and the conditions under which they are measured for users to ensure that laboratory requirements can be met.
- Manufacturing section: Includes suppliers, service agents, and consultants.
- Technical agreement: A technical or quality agreement should be in place between the user organization and the manufacturer/service provider that defines the scope of work and responsibilities between the two organizations for any Group B instrument and Group C system.
Merging AIQ and CSV
Before the 2017 version of USP <1058>, AIQ and CSV were considered independent activities by many people. However, with the 2017 edition of USP <1058>, there is an integrated AIQ‑CSV approach designed to save time and effort. This integration effort started with the second edition of the GAMP Good Practice Guide for A Risk‑Based Approach to GxP Compliant Laboratory Computerized Systems14 in 2012 (ISBN: 978-1-936379-49-1). A paper by Vuolo‑Schuessler; et al. mapping the new subdivisions of software shown in Figure 4 was published in 2014. It showed great similarity of GAMP software categories with the 2017 subdivisions of Group B and C software10.
As part of defining an integrated AIQ‑CSV approach, the scope of the 2017 <1058> has been expanded, and the sections under software validation have been reworded. Software-specific sections have also been added to the OQ phase of AIQ:
- Software functions: This section specifies a requirement to test critical elements of the configured application software.
- Secure data storage, backup, and archiving: This section specifies a requirement to test data handling, storage, backup, and archiving.
- Software configuration and/or customization: This section specifies that the OQ should be performed using the software that will be used for routine analysis. It also specifies that any software configuration or customization should be performed (and document the settings) before an OQ is performed (otherwise some testing may need to be repeated).
To comply with the 2017 requirements, an instrument must be controlled during the OQ using the operating software routinely used with the instrument. For chromatography instruments, for example, the Chromatography Data System (CDS) routinely used with the instruments needs to be used during the qualification work. This approach enhances the data integrity of the qualification work.
However, for software OQ work, unless the application is well understood (for example, a copy is already installed and configured/used within the regulated laboratory), it is unlikely that the software will be configured, as it will be routinely used before the software OQ is performed by the vendor during installation. The laboratory may not have clarified the workflow, user roles, or software functional permissions associated with each role of the intended use at the time of initial installation.
The essential role of software in ensuring data integrity is discussed in the third White Paper in this series: The Role of Analytical Instrument Qualification in Data Integrity with the 2017 Version of USP <1058>3.
After an initial review, the similarity between the 2017 version of USP <1058> and the obsolete 2008 version may mean that laboratories do not review the USP <1058> changes in sufficient detail. By producing a White Paper dedicated to explaining these changes, this risk should be reduced. After reading this White Paper and considering the changes in the 2017 USP <1058>, current procedures and processes for AIQ and CSV may not fully comply with USP requirements. The first action should be to review your procedures and compare them to the 2017 <1058> requirements. It may be that your SOPs and qualification approaches need to be changed to be fully compliant.
The second White Paper in this series, How to Comply with the 2017 Version of USP <1058>, provides deeper insights into the significance of the changes, and offers practical information about compliance.
- What Has Changed with the 2017 Version of USP <1058>, Agilent Technologies White Paper, publication number 5991-9418EN, 2018.
- How to Comply with the 2017 Version of USP <1058>. Agilent Technologies White Paper, publication number 5991-9419EN, 2018.
- The Role of Analytical Instrument Qualification in Data Integrity with the 2017 Version of USP <1058>, Agilent Technologies White Paper, publication number 5991-9420EN, 2018.
- What Does Performance Qualification Really Mean with the 2017 Version of USP <1058>? Agilent Technologies White Paper, publication number 5991-9421EN, 2018.
- USP General Chapter <1058>, Analytical Instrument Qualification, USP 40-NF 35, 1 Supplement, 1 August 2017.
- USP General Chapter <1058>, Analytical Instrument Qualification, USP 40-NF 35, 2 Supplement, 1 December 2017.
- Bansal; et al. Qualification of Analytical Instruments for Use in the Pharmaceutical Industry: A Scientific Approach, AAPS PharmSciTech 2004, 5(1).
- Analytical Instrument Qualification: Towards Globalisation, Roundtable Discussion, Analysis and Pharmaceutical Quality (APQ), AAPS Conference, New Orleans, 15 November 2010.
- Burgess, C.; McDowall, R. D. An Integrated and Harmonized Approach to Analytical Instrument Qualification (AIQ) and Computerized System Validation (CSV) – A Proposal for an Extension of USP <1058>, Pharmacopeial Forum 2012, 38(1).
- Vuolo-Schuessler; et al. Harmonizing USP <1058> and GAMP for Analytical Instrument Qualification, Pharmaceutical Engineering, January/February 2014.
- McDowall, R. D. Validation of Chromatography Data Systems, Ensuring Data Integrity, Meeting Business and Regulatory Requirements, 2nd Edition, Royal Society of Chemistry, ISBN 978-1-84973-662-6, 2017.
- Illuminating the Need for Quality when Replacing HPLC Detector Lamps, Agilent Chromnews, April 7, 2017.
- Agilent InfinityLab, Specification Compendium, Agilent Manual 01200‑90062.
- ISPE GAMP® Good Practice Guide: A Risk-Based Approach to GxP Compliant Laboratory Computerized Systems, Second Edition, October 2012.
Sign up for the monthly GSS Resources Newsletter, a curated eNewsletter that delivers new technology relevant to your lab type and industry straight to your inbox.