1. Purpose
The purpose of this document is to provide management and technical personnel with requirements as well as guidance on the archiving, records management and disposal of data and information.
2. Scope and Applicability
This guideline is applicable to all manufacturing sites, functions departments and Marketing Companies undertaking work or providing support services, required to meet Good Laboratory Practice (GLP), Good Clinical Practice (GCP), Good Manufacturing Practice(GMP)and/or International Organization for Standardization(ISO) standards and is independent of the medium used (paper, electronic, etc.).
3. Definitions
3.1 Archives (1)
Records of the same provenance or origin accumulated by an organization or person in the course of conduct of business affairs, and preserved because of their enduring value.
3.2 Archives (2)
Physical space in which an organization or part of an organization manages the selection, acquisition, preservation and availability of one or more archive collections. Could also be known as Records Centre, Pre-Archive area or Short-term archive area.
3.3 Archiving – to Archive
To deposit a record into a storage medium and location which will ensure its storage for the appropriate retention period prior to disposal for long-term preservation.
3.4 Archivist
An individual who is responsible for appraising, acquiring, arranging, describing, preserving, and providing access to records of enduring value, according to the principles of provenance, original order, and collective control to protect the materials’ authenticity and context. The value the archivist gives to the organization concerning the intellectual, logical and physical control of the records is both scientific and administrative.
3.5 Archives Manager
An appropriately qualified person appointed by management to operate and/or manage an Archive. Job titles may differ from site to site.
3.6 Information Owner
The person responsible for records information content and accuracy submitted for archiving.
3.7 Records
Information created, received, and maintained as evidence and information by an organization in pursuance of legal obligations or in the transaction of business. Recorded information, regardless of medium or characteristics, made or received by an organization that is evidence of its operations, and has value requiring its retention for a specific period of time. For the purposes of this Guideline any reference to Records, includes Data, Metadata and Information unless otherwise stated.
3.8 Records Manager
Person responsible for managing the implementation and maintenance of the records retention schedule, for establishing and/or implementing standards and controls related to the indexing, storage and retrieval of active records, and for overseeing the disposition of inactive records.
3.9 Records Retention Schedule
A list of records and samples for which pre-determined disposition/destruction dates have been established. The schedule brings all information about records descriptions and retention periods together in a single report. It has three objectives: disposal of those records which have completed their retention period; storage of records which have to be kept temporarily after they are no longer needed for current business; and preservation of records which are of long-term or historic value.
3.10 Data
Representations of facts, concepts, or instructions in a manner suitable for communication, interpretation, or processing by humans or by automated means. Data may be considered records according to the Records Retention Schedule. Raw data are defined as any work sheets, records, memoranda or notes that are the result of original observations, findings, measurements or activities. Raw data maybe in the form of paper, computer readable media, magnetic media, photographs or film, microfilm or microfiche, wet tissue, wax blocks or slides. Raw data may be created through hand written notes, dictated observations, recorded data from instruments, data entered directly into a computer, either manually or through an instrument interface, data printed automatically from devices or through specimen preservation.
3.11 Metadata
Data describing context, content and structure of records and their management through time. With respect to electronic records, metadata is information about the data in computerized system that is not the data itself, e.g. audit trail, tabular definitions. Both the data and associated metadata are necessary for the trustworthiness and reliability of records.
3.12 Records life cycle
The records lifecycle is the life span of a record from creation or receipt to its final disposition.
4. Responsibilities
4.1 Archives Management
Organization or part of an organization responsible for the retention, safe storage, availability and scheduled disposal of records required for regulatory compliance, legal or other reasons.
4.2 Technical Personnel
Are individually and collectively responsible for the generation and control of high quality active records. This also includes Supervisors. They ensure records are identified, indexed and transferred safely to archival storage in accordance with the Policy and associated procedures/guidelines.
4.3 Archive Managers
Are appointed by Management, and manage the archives and take responsibility for the preparation of written standard operating procedures (SOPs) for records management and good housekeeping. These SOPs must provide for orderly storage, expedient retrieval and, when appropriate, disposal of records in accordance with the relevant Policy and the Retention and Disposal Schedule. It is a GLP requirement to have named person responsible for all aspects of the archive. In some functions, the Archives Manager has the title of Archivist.
4.4 Information Owner
The Information Owner must use the Records Retention Schedule, to determine retention or disposal of information, taking into account all potential business risks. The Information Owner must ensure that all necessary steps are taken in order that information is available furlong-term access as required by the Records Retention Schedule.
4.5 Quality Assurance
Management must implement suitable monitoring programs to assure management that the Records Retention Schedule and associated SOPs are being followed. Where
management of the Archives has been delegated to QA, then adherence to procedures must be independently assured by a third party.
4.6 Contractor Acceptors
Contractors undertaking work on behalf of the company must be expected to meet the minimum archive and retention requirements established internally under the Records Retention policy an and associated program. Contract acceptors must ensure that
processes for records management (local storage, or transfer to/from the sponsor) are described in SOPs and contractual agreements. Where such standards are not possible, then the company as sponsor must make provision to recover these records from the contractor and transfer these to suitable alternative archives.
5. Guideline
5.1 General
This guideline aims to cover all variables within the different business areas connected with Archiving, including the different roles and job titles. Local practices should be further explained in local SOPs/approved procedures for the business area it applies to. All records must be treated as corporate assets and satisfactorily managed throughout their complete lifecycle. Records associated with GXP must be appropriately retained, organized in a defined structure and expediently retrievable to meet corporate, legal, and regulatory requirements. The Information Owner is responsible for records information content and accuracy, and hence any compliance issues around the information itself. In accordance with this Guideline, each organizational unit working to GXP must describe its practices for the archiving, records management and disposal of all records associated with regulatory compliance in written SOPs/Approved procedures. Procedures should make allowance for the potential large volume of paper records that will accumulate over time, the inherent resource management implications and, wherever possible, look to more condensed forms of storage for long-term retention (i.e. electronic media, microfilm/fiche), in association with the implementation of defensible programs for records disposal. Whilst this Guideline has been written to help in the establishment of local procedures for regulatory compliance, management should also ensure that additional business requirements for intellectual property and patent law considerations are not compromised.
5.2 Retention Requirements
Each function, department and/or manufacturing site (or designee) must manage their own records so that they are accurate, protected, useful, and readily accessible whenever they are needed. With the exception of electronic records that are routinely backed-up, company should, as a general rule, archive only one official record. Any duplicates (including copies distributed or held by other functions, departments and/or manufacturing sites) should be destroyed as soon as the immediate need for them has expired. Exceptions are official copies, which are archived in lieu of an original. Wherever possible, records should be kept in their original form first defined in Sops. For full compliance, metadata associated with GXP electronic records, including audit trail information, must be archived with the records. When electronic records are to be archived all procedures must be thoroughly evaluated, tested and documented in collaboration with relevant Information Services organizations. The microfilming, scanning, or otherwise copying of original records for security reasons does not automatically allow for the subsequent destruction of the original (see Microfilming, 5.8). The only exception to the above statement arises when there is short-term life expectancy of the original record, e.g. fading of heat or light-sensitive instrument output, or the discontinuance of a computerized system holding the original records in electronic form. In such cases, it is acceptable to produce an alternative form of the original record and declare it an ‘official copy’. The reasons detailing the business need for making the ‘official copy’ and then subsequently destroying the original record must be archived, together with record of the date when the original was destroyed. Where ‘archiving’ is not a mandatory requirement, it is recommended that any records that need to be retained for a specified period of time be kept in a secure storage location, which may in fact be the local archive.
5.3 Inventories and Indexing of Records
Records provided for archiving must be arranged and indexed. Archivists, Archives Managers or Records Managers must conduct inventories of archived records and identify them according to the retention schedule. Records must be suitably managed and organized (e.g. classification, titling, indexing.) to enable lifecycle management and retrieval. Periodic inventory checks of records held in archives are recommended. Indexing systems for records can be manual or automated. If automated, the system must meet regulatory requirements for validation and electronic records compliance.
5.4 Segregation of Records for Information Protection
Where more than one copy or form of the same record is being retained (e.g. software programs, back-up tapes, or microfilm) then it is recommended that geographically separate archive/storage locations be used. Separation in this context should be by room, building or site. Where several components of a common record or data set exist (e.g. histopathology: written or electronically held diagnosis, microscope slide, wax block, wet tissue, etc.) then it is again recommended that some sensible. segregation of these occur, in order to minimize the overall potential loss of any data.
5.5 Loan of Records
It is recommended that Archive procedures prohibit or limit the loan of original records once archived. However, if such a stringent practice is adopted, then facilities should be available to provide a ‘copy’ as an exact image of the record required. This could be by means of photocopy, image scanning, microfilm/fiche review or loan, or access to a database (review and print only) record. Where loan of original records is necessary or unavoidable (e.g. Regulatory Authority inspection) then procedures must be introduced to ensure: Reason for loan is approved by line management and/or Archive management Loan is formally documented Tracking of loan to ensure return occurs and overdue loans are followed up
5.6 Electronic Data Management
Archives Managers must be consulted prior to any transmittal of records on removable storage media to Archives. Some Archives may refuse to accept records on removable storage media, such as CDs or DVDs, for archiving. It is not recommended that original records be sent for archival storage on removable storage media such as CDs or DVDs given that long –term preservation is not possible for these formats. Where no other option is available for electronic records storage, provisions must be made to ensure original records are not lost over time. Archive Managers should be consulted for recommendations and guidelines concerning the selection of media for electronic records storage, as well as for duplication of media and the frequency of regeneration. Depending on the electronic medium chosen, departmental procedures must be established by the record-generating group to periodically ensure that neither the integrity of the records, nor the ease of their recovery, is compromised.
5.7 Retention of QA Audit Reports
Any decision to archive records of Quality Assurance/Compliance audits within the designated archive should be managed in such a way as to ensure clear segregation. Whilst schedules of inspections and inspection specific details (who, when, etc.) may need to be kept long term, it is recommended that a single copy of the audit report and responses is archived in a separate archive and copies of audits are destroyed once any required actions are completed and the inspection has been ‘closed -out’ by the responsible audit function. QA audit reports must be retained for the minimum period described in the retention schedule, after which time they may be destroyed.
5.8 Microfilming
The production of microfilm/fiche is intended to duplicate the original record for security purposes in case of intended or accidental destruction of the original. Standard operating procedures must be in place to ensure the highest quality duplication is insured. Where regulatory practice or company policy make provision for the preparation and retention of microfilm as the intended replacement for the original records, the following recommendations are made: The microfilm record should contain an official statement or pro form certificate, dated and signed by the designated archives or records management staff and microfilm camera operator, which may or may not be the same person stating that it is a true and accurate image of the original The microfilm is indexed to enable identification and retrieval of the records, and that it is managed as the ‘original record’ for the purposes of access, security etc. A Certification of Destruction is completed to provide full details on the date(s) of disposal of the originals, the reasons for disposal, the personnel involved, and the appropriate signatory approval. This certificate should be microfilmed with the records The original records should only be intentionally destroyed after an inspection of the microfilm to ensure the accuracy and completeness of the images.
5.9 Image Scanning
Image scanning technology enables security of records by duplicating the original paper record and for the convenient retrieval of documents at employees’ workstations. The index database for scanned images should be carefully designed so that it contains sufficient information to locate required documents. Generally, only records that are part of a workflow process, high-value records based on the importance of their content, and records with high retrieval volume should be considered for scanning. The guidance for the disposal of original paper records after microfilming also applies to scanned original paper records (see section 5.8).
5.10 Environmental Conditions
Conditions of storage must minimize the likely deterioration of records in accordance with the required storage time and the type of media. As a general guide, the ideal environment will have controlled temperature and humidity, be relatively dust-free, be out of direct sunlight, free from magnetic interference, and be devoid of pests. The development of archival storage facilities must ensure proper environmental controls are established. Archived records must be protected from the consequences of smoke, fire or water damage (e.g. alarms/detectors, extinguishers, fire-proof cabinets, etc.).
5.11 Security and Access
Appropriate security measures must be introduced to prevent unauthorized access to archived records, e.g. locks, cardkeys, alarms etc. The line management in relevant organizations must control access to archives. Access to the Archive must be limited to authorized personnel. Where other personnel require access to the Archive, e.g. for Quality Assurance inspections, maintenance, etc., this may only be made with the permission and in the presence of authorized personnel. A record of the visit is retained and includes the date and duration of the visit, the name of the visitor and the reason for the visit.
5.12 Audits
Archives, including contract archive facilities, must be subject to periodic internal audits to assure management that policies and procedures for retention, retrieval, integrity on storage and disposal in association with security and access control measures are being followed. An effort should be made to coordinate the audits amongst various global Malfunctions to eliminate redundancy. For areas not regularly audited, a self-audit process can be established.
5.13 Disaster Prevention and Recovery Plan
The procedures to be followed in the event of a disaster befalling the archives must be detailed in an SOP. Whilst the facility design and location can help to minimize the risk of an occurrence, or the consequences of an actual event, a Disaster Prevention and Recovery Plan must be in place. Archived records must be protected from the consequences of smoke, fire or water damage (e.g. Alarms/detectors, extinguishers, fire -proof cabinets, etc.). Information owners or designee in coordination with relevant department personnel are responsible for determining the priority of the records in the event of a disaster. In the event of a disaster arising, procedures should be provided for: The safe removal of records to suitable alternative storage Prioritized removal of records relative to importance and time Documenting the records removed Salvage of records and damage assessment Recovery and restoration of records (air drying, copying etc.) Special procedures to salvage and restore electronic media and records or other types of records, e.g. photographic materials, reserve samples of test articles Documenting the records lost Notifying the applicable regulatory authority of loss Preparation of an internal report (to include reasons for disaster, consequences, future preventative measures etc.)