What is Business Continuity Plan?
Before starting to think about Business Continuity Plan for computerized systems, let's clarify the difference between BCP and Disaster Recovery Plan (DRP).
The DRP's purpose is to prove that we able to retrieve the GMP electronic records, when a system crashes. In other words, this is the backup-restore test focusing on the availability of all records supporting the release decision.
However, BCP's purpose to have backup-process for the business when the computerized system is down.
And now, what do the laws tell us about BCP?
This section is from EU GMP Annex 11:
'For the availability of computerised systems supporting critical processes, provisions should be made to ensure continuity of support for those processes in the event of a system breakdown (e.g. a manual or alternative system). The time required to bring the alternative arrangements into use should be based on risk and appropriate for a particular system and the business process it supports. These arrangements should be adequately documented and tested. '
Let's have an example to understand our possibilities when planning business continuity: a UV spetrophotometer used for QC identification tests.
What's the most obvious BCP solution? To have not one, but two individual systems. Naturally, this has an increased investment and maintenance cost, but it can be useful when you receive higher amount of samples, you have higher flexibility to organize the tests.
Another method to solve this is to have a contract laboratory. This also has some costs (maintaining quality agreements, organizing audits, etc.), but this is a fearly feasible solution.
But is there any other way? This is where you might use some creativity. You can prepare your specifications to have alternative methods - some of pharmacopoeial monographs already provide this option. As an example, instead of UV, you may apply LC indentity and IR. Or instead of PSD by sieves, you may use laser granulometer or microscope.
Think it through your control strategy on your product, and you might find some really smart BCP.
BCP for complex systems
So now we know what to do in case of smaller systems. But what are our options for (much) more complex systems, like ERP, LIMS or DMS?
In short, nothing :)
But really, in 2023, it's simply not realistic to try and maintain paper-based processes for all your electronic processes. Don't even try to do it, be brave and declare you don't have any BCP for these systems.
How can you comply with the requirement of Annex 11, though? As I see, you don't have any choice but to push IT to build redundant infrastructure at every possible point. The investment and maintenance cost might be high, but you should compare that with the cost of not being able to manufacture or test for a day or two...