Jira seems to be installed everywhere now. Typically, it begins with a grassroots initiative then its usage spreads almost virally, until a mid-level or senior executive realises that it has become essential to the running of the business. This post provides key pointers for Jira validation in life science organizations.
In life science organisations, this is often the point when the quality assurance (QA) manager catches on too. They are then faced with the challenge of understanding whether the use of Jira should be regulated and, if so, how.
This reminds me a lot of what happened with Microsoft Excel. It became the most widely used software within pharmaceutical and medical device manufacturing environments long before the need for validation and control became common knowledge, when there was no best practice model for validating it.
Happily, validation practices for Excel have since become established and there is now significant knowhow available around the validation of software used within life sciences.
Key pointers for Jira validation
The purpose of this post is not to cover Jira validation in any comprehensive way, but rather to provide a few helpful pointers for getting started. As you will see, there are several parallels with the way Excel became established within the same context.
- Jira is an off-the-shelf software package. At the time of writing, the company behind it, Atlassian, is not ISO certified and doesn’t support third party audits. The same issues didn’t hold anyone back from using Excel, so they should not deter you from using Jira.
- There are several arguments to justify the assumption that Jira is sufficiently reliable to use in a life sciences environment, despite Atlassian not being a controlled supplier. Here are two of the key ones:
- Its ubiquity – Jira is currently being used within more than 45,000 organisations worldwide.
- Detailed release notes and documentation are publicly available, including a transparent and up-to-date bug list.
- In the case of Excel, it’s the formulas and worksheet configurations you actually use that need to be validated. The same applies to Jira, where the focus of validation should be on your particular setup – the specific configurations and customisation needed to support your processes.
Very often the actual business processes Jira supports are described in a standard operating procedure (SOP) or work instruction. The aim of any validation should be to establish that the way Jira is set up reflects and supports the SOP or work instruction. Narrowing the focus in this way helps to significantly reduce the validation efforts required and will ensure resources are applied as efficiently as possible. Using a risk-based approach, such as GAMP 5, will help you work out where to focus your efforts.
- You should organise the infrastructure around your Jira installation to support the electronic records and electronic signatures (ERES) requirements outlined in FDA CFR 21 part 11 or European Commission Annex 11. If this is not the first such system you have deployed, you may be able to apply procedures you developed previously. If this is the first time, the good news is that the requirements are well aligned with best practice for IT security. Also, the structure you develop can be reused to support other systems you deploy in the future.
- Good configuration control practices are key to keeping your Jira environment validated. At the most basic level, it’s best to have two separate environments – test and production. It’s also important to maintain clear instructions to guide staff on points including how changes to the production environment should be introduced.
- You should keep a record of your activities, building up a validation dossier. This will stand you in good stead for any future inspection.
It makes sense to use Jira itself to plan, track and report on your validation efforts. Your SOP or work instruction should be adequate proof of your user requirements and functional specifications.
I hope these tips have helped to reassure you that there is a clear path to validating your Jira deployment.
If you have any specific questions or need help, please do get in touch.
Some further reading
- FDA’s short and simple description document checklist
- Essential reading in the FDA’s guidance on general principals of software validation can be found.
- GAMP-5 is a key approach used in software validation. You can buy the Gamp-5 official guide here. You’ll also find various overviews online.
