Compliance & Validation Validation of Software-as-a-Service (SaaS Solutions)

Transcription

1 A White Paper Presented By ArisGlobal Compliance & Validation Validation of Software-as-a-Service (SaaS Solutions) ARIS GLOBAL CORPORATE HEADQUARTERS ArisGlobal, 1266 East Main Street, Stamford, CT 06902, USA Tel: Fax: info@arisglobal.com

2 Overview Conflicting and, in some cases, minimal details and insight from the FDA have caused confusion within the industry with regard to Computer System Validation. Industry standards such as GAMP 5 have emerged, but questions regarding validation continue. What about validation of Software as a Service (SaaS) solutions? What is the concept of solutions that are indicated as pre-validated by a vendor? These and similar questions occur frequently during compliance conversations within the industry This white paper will define the most efficient validation strategy for SaaS solutions and try to answer frequent questions raised around the topic. What is Validation Computer Systems Validation (CSV) is an activity that presents complex challenges to the life sciences community. Title 21 CFR Part 11 requires: Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. Validation is confirmation by examination and provision of objective (documented) evidence that computer systems conform to user needs and intended uses, requirements are consistently fulfilled, and applicable regulatory requirements (such as 21 CFR Part 210/211, 21 CFR Part 820, etc.) are satisfied. Validation, at its most basic level, is the process of ensuring that applications, systems, solutions, and/or environments satisfy intended functionality in a consistent and reliable manner. Primarily, validation is accomplished via software testing the process of executing a predefined sequence of steps, emulating typical user scenarios and data, to determine if the application, system, solution, and/or environment under evaluation performs as intended. Validation includes verifying: 1. Requirements of the system are met (both regulatory and business) 2. System performance (speed and accessibility) is acceptable 3. Data integrity is properly maintained (not lost, improperly modified, etc. The primary benefit of validation is a level of assurance that the system will perform as required and intended during operation. A validated system should be more cost effective to maintain, yield greater Return on Investment (ROI), and result in reduced risk of data loss and issues with regulatory requirements. 2

3 SaaS Considerations SaaS solutions are becoming more prevalent in the industry today. These solutions which may support multiple customers/tenants, may be subject to more frequent functionality changes, may include robust tool sets that allow customers to configure aspects of their applications on the go, etc. present additional challenges to ensuring that the system at all times stays fully validated. SaaS solutions should still be validated by the vendor, the customer, or an outside firm. Evidence of validation testing coverage to confirm appropriate segmentation of multiple customers data sets (if applicable) should be included. In addition, periodic validation of the SaaS solution (revalidation) should occur as baseline software changes are made particularly when regulated areas are impacted. Lastly, if tools are available within the SaaS solution that allow the customer or others to change application functionally particularly in regulated areas the tools themselves should also be included in the validation testing scope. In addition, appropriate warnings either in the application itself or in outside documentation should be available to the users of the tools that will warn them or prevent them from changing functionality that will take the solution out of a validated status. Computer System validation at agondemand SaaS Solution of ArisGlobal On the hosted platform - agondemand, we ensure the processing integrity of the hosted application provided to our customers by performing the activities of Computer System Validation as mandated by the FDA and other global healthcare regulatory authorities. As defined by the regulatory agencies, CSV involves establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality attributes. Based on these requirements, we have defined a Quality Management System which ensures that our activities are compliant with the regulations. The product implementation on the hosted platform is governed by the validation process.our validation process is divided in to two phases 1. Pre-Validation: In an effort to implement the application for customers with zero defects and in the least possible timeframe, ArisGlobal uses a pre-validation approach for validating the system on the hosted platform As part of the pre-validation phase, the application is validated for the standard functionality, workflows etc. in an environment independent of any customers A full kit of validation deliverables is made available including the validation plan, risk assessment, requirements document, IQ/OQ/PQ protocols, IQ/OQ/PQ test scripts, IOQ/OQ/PQ test reports, traceability matrix and the validation summary report. The graphic below illustrates the process that will be used for the pre-validation 3

4 2.Customer Implementation: We make a copy of the pre-validated environments and these are designated as the customer environments. The changes made as per customer specific requirements are then validated in the customer environment A new Validation Plan will be created that will be used to drive the validation process for the customer implementation phase Customer-specific customizations and changes related to the configuration will be implemented/configured in the system and will be functionally tested The customer will then be requested to perform a User Acceptance test to ensure the system functions as intended. All these activities will be documented in the summary reports that will be generated as part of the implementation phase. The below graphic illustrates this process. 4

5 Business requirements: The size of the business, the application, sensitivity of the data, and the regulations surrounding the business and above all the customer security needs pertaining especially to healthcare industry like PHI, data privacy, After go-live, all changes to the customer environment will be driven by the Change Management process. This process ensures that all changes to the customer environment are clearly documented in a Request for Change (RFC) document. The RFC document will contain the technical, functional, validation & data security assessments as well as the implementation plan, etc. This RFC document will then be approved by relevant stakeholders (both from customer and ArisGlobal). The changes are then first implemented in the customer validation environment and tested. The test documentation is then shared with the customer and the customer is then asked to perform a UAT. Once we have a confirmation from the customer that the change works fine, it is implemented in the customer production environment. 5

6 List of Documents involved with the CSV Process 1. Validation Plan Validation Plan acts as a base document that summarizes the Scope, validation approach, and validation deliverables in order to ensure the application meets the regulatory and business requirement. This document acts as reference document throughout the validation life cycle 2. User Requirements / Risk Assessment Document (URD) The URD defines the user requirements based on which the application is developed. This is the base document for Validation process The Risk Analysis document assesses each requirement stated in URD against the potential risks and identifies the validation scope. 3. Functional / System Requirements Functional Requirement describes the requested behavior of the system. The documentation typically describes what is needed by the system user as well as requested properties of inputs and outputs 4. Interface Requirements The Interface Requirements specifies the requirements imposed on one or more systems, subsystems, Hardware Configuration Items (HWCIs), Computer Software Configuration Items (CSCIs), manual operations, or other system components to achieve one or more interfaces among these entities 5. System / Interface Design The System /Interface Design Document describes the system requirements, operating environment, system and subsystem architecture, files and database design, input formats, output layouts, human-machine interfaces, detailed design, processing logic, and external interfaces 6. Design Review Design Review is a mechanism for ensuring design standards, alignment, and diligence throughout the course of the product design process 7. Requirements Traceability Requirement Traceability Matrix establishes the relationship between the system requirements and design stated in requirements/design documents to the respective test scripts 8. IQ/OQ/PQ Test Plans The IQ/OQ/PQ test plans contain detailed information of the tests to be performed on the system in the context of the Installation Qualification, Operational Qualification & Performance Qualification 9. IQ/OQ/PQ Test Scripts The test scripts that will be executed on the system in the context of the Installation Qualification, Operational Qualification & Performance Qualification 6

7 10. IQ/OQ/PQ Test Reports After completion of the IQ/OQ/PQ test execution, the results are summarized, evaluated and compiled in the IQ/OQ/PQ Test Reports. All deviations, as well as measures taken to eliminate these, are documented 11. User / Admin Work Instructions The User / Admin Work Instructions are documents containing detailed instructions that specify exactly what steps to follow to use or carry out administrative activities on the system 12. Validation Summary Report On successful completion of all validation activities, Validation Summary Report is prepared. Validation Summary Report summarizes the results of all the validation activity and acts as a single location with information and references to information that demonstrates the system is completely validated 13. Change Control Change control is a systematic approach to managing all changes made to a product or system. The purpose is to ensure that no unnecessary changes are made, that all changes are documented, that services are not unnecessarily disrupted and that resources are used efficiently 14. Periodic Evaluation An evaluation performed at a pre-defined frequency to ensure that the validated state of the system is maintained. The evaluation would consist of evaluating the validation and production environments to ensure they are in sync Business Benefits of CSV Better Quality Control Increased quality control in product development / manufacturing Improved Efficiency Search and find documents in a fraction of the time Risk Avoidance Be prepared for FDA inspections and minimize human error Faster Time to Market Reduce the costly time delays associated with lengthy approval cycles Security Secure Communications, Transactions and Data Exchange Business Benefits of CSV Validation is a critical activity that should be pursued and formally documented for all systems with regulatory implications. Validation activities provide the controlled testing conditions necessary to ensure proactive identification and resolution of operational, fiscal, and regulatory issues. Validation can be a complex challenge for an organization; however, a clear consistent approach to achieving validated systems can ensure significant ROI for the system under test and can ensure regulatory compliance is consistently maintained. The FDA expects the final, deployed version of the solution to be validated (meaning any custom changes in regulated areas likely will require further validation), and the FDA will not take stock in a vendor s claim of validavtion alone the FDA expects the acquirer to confirm that the solution is in fact validated. A confirmation of suitability of the pre-validation process should be formally accomplished and documented by the organization acquiring the system or solution. 7

8 Annexure Glossary Federal Privacy Act The Federal Privacy Act was put into place to protect the U.S. citizens sensitive information that is collected by government agencies. It states that any data collected must be done in a fair and lawful manner. The data is to be used only for the purposes for which it was collected and held only for a reasonable amount of time. If an agency collects data on a person, that person has the right to receive a report outlining data collected about him if it is requested. 21 CFR Part 11: 21 CFR 11 (Part 11) is the regulation that sets forth the criteria under which the FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper. Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted in compliance to any records requirements set forth in FDA regulations. Part 11 also applies to electronic records submitted to the FDA under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if such records are not specifically identified in agency regulations. So, it is mandatory that all applications generating electronic records or using electronic signatures and the environment in which they are hosted comply with 21 CFR 11 (Part 11) regulations. Annexure 11: The European Medicines Agency (EMA) is a decentralized agency of the European Union. EMA is responsible for the scientific evaluation of medicines developed by pharmaceutical companies for use in the European Union. Volume 4 of The rules governing medicinal products in the European Union contains guidance for the interpretation of the principles and guidelines of good manufacturing practices for medicinal products for human and veterinary use laid down in Commission Directives 91/356/EEC, as amended by Directive 2003/94/EC, and 91/412/EEC respectively. Annex 11 of Volume 4 applies to all forms of computerized systems used as part of a Good Manufacturing Practice (GMP) regulated activities. It mandates that the application should be validated and IT infrastructure should be qualified. About ArisGlobal ArisGlobal is the leading provider of integrated solutions for pharmacovigilance and safety, regulatory affairs, clinical research and quality and compliance for medical inquiries. Life science companies using ArisGlobal s solutions can better build and maintain the trust they need with their customers, medical practitioners and regulatory bodies around the world ArisGlobal LLC. All rights reserved. aginquirer, agtracker, agresponder, agbiblio, and the ArisGlobal logo are trademarks or registered trademarks of ArisGlobal in the US Patent and Trademark Office and other jurisdictions. Other marks may be trademarks or registered trademarks of their respective owners and are acknowledged as such. The information you see, hear or read on the pages within this presentation, as well as the presentation s form and substance, are subject to copyright protection. In no event, may you use, distribute, copy, reproduce, modify, distort, or transmit the information or any of its elements, such as text, images or concepts, without the prior written permission of ArisGlobal. Trademarks, service marks, and logos (collectively the trademarks ) displayed on the pages within this booklet, are the property of their respective owner. No license or right pertaining to any of these trademarks shall be granted without the written permission of ArisGlobal, LLC (and any of its global offices and/or affiliates). ArisGlobal reserves the right to legally enforce any infringement of its intellectual property, copyright and trademark rights 8