Application Decommissioning in Regulated Industry

Transcription

1 Application Decommissioning in Regulated Industry

2 Abstract: As the IT industry is progressing, most of the manufacturing industries are planning to roll out with new strategies and technologies for running their day to day operations. As a result of new technologies driving in, organizations are facing a challenge in decommissioning the legacy applications by meeting the dynamic requirements of various regulatory guidelines. The process of implementing and decommissioning applications in the regulated industry needs defined, approved and proven methodologies. This paper talks about the decommissioning of applications, its benefits and how HCL has developed a methodology for a reputed Pharmaceutical giant by meeting all the regulatory requirements. What is Decommissioning? Decommissioning is the practice of removing an application, database and platform from its active use, at the same time retaining access to the business-critical data, if required. Examples of decommissioning include: Retiring an application Consolidation of one or more (in-house/cots) applications into a single enterprise solution (ERP, CRM, SFA etc.) Elimination of redundant applications from within the landscape In cases where the application to be decommissioned is impacted by compliance norms, the key aspect of Decommissioning would be to provide continuous access to the compliance critical data. All data from a decommissioned legacy system or application may or may not be migrated to a replacement system. This depends on the drivers for decommissioning, criticality of the system and the impact it will have on existing landscape and processes. However, per regulatory requirements, the company must retain access to the data to comply with data retention policies (as mandated by the regulatory authorities/internal policies). 2

3 Why Decommissioning? ATo reduce infrastructure costs and mitigate operational risks, companies opt typically for decommissioning systems or applications. Decommissioning is a useful strategy when there is: Process redundancy Cost optimization Supplier product/ service portfolio rationalization Portfolio simplification initiatives Functional redundancy Application which can replace a set of applications. What is Decommissioning? Decommissioning is the practice of removing an application, database and platform from its active use, at the same time retaining access to the business-critical data, if required. Examples of decommissioning include: Retiring an application Consolidation of one or more (in-house/cots) applications into a single enterprise solution (ERP, CRM, SFA etc.) Elimination of redundant applications from within the landscape Benefits of Decommissioning? Companies can achieve tangible benefits by decommissioning redundant, unnecessary or technologically obsolete systems, such as: Reducing or marginalizing operational risks Reduction in hardware, software, human resource and maintenance costs. Utilizing the under- utilized IT assets and resources for other business purposes Reduction in infrastructure expenditure. Shortening disaster recovery process. 3

4 Mature Decommissioning Methodology developed by HCL: The decommissioning methodology typically evolves 4 steps. 1. Portfolio Assessment 2. Impact Assessment 3. Solution Planning 4. Execution and realization. Step 1: Portfolio Assessment The objective of this step is to conduct a quick portfolio assessment and identify potential candidates for decommissioning. During portfolio assessment the applications are assessed for Strategic Fitness, Functional fitness and Technical fitness by using the pre-designed templates and guidelines. The templates are designed in such a way that when the data is filled, the result is populated in the respective columns. In this process interaction with Directors of Business users, IT Users and Corporate personnel is a must and identification of the potential candidates for decommissioning is essential. The final outcome in this processes results in the list of applications which are Potential candidates for decommissioning. Step 2: Impact Assessment The objective of this step is to assess the impact of decommissioning on various external and internal influence points for each application, which will become a final candidate for decommissioning. In this step, the potential decommissioning candidates identified under Portfolio assessment (Step 1) are considered for an in-depth assessment. The impact is assessed by considering the impact on various areas like on access, business, benefits etc., by using pre-designed templates for each impacted area. This activity is undertaken by involving the functional users and IT technical team. 4

5 Once the data is fed into the templates, the result is displayed as a scorecard, based on which the candidates are considered for decommissioning. The outcome of this step has resulted in the final list of applications which will be considered for decommissioning. Step 3: Solution Planning The objective of this step is to identify possible solutions for decommissioning the identified applications and choose the best solution and compiling a change request for executing the solution in the next step. The solution for decommissioning is prepared based on the parameters which are assessed with respect to post decommissioning like managing access to various users and partners, managing application interfaces to ensure landscape collaboration, managing the data exchanges, decision making for archive or dispose, managing infrastructure resources utilized by the application to be decommissioned, etc., This activity is undertaken by involving the Functional users, Technical users and the Database Administrators. After addressing these issues by using pre-designed templates, the outcome results in initiating a change request to decommission the application(s) and includes all components of the solution access, data, interfaces, process, application management, and infrastructure. Step 4: Execution and Realization The objective of this final step is to execute the identified solution for decommissioning and auditing the implemented solution for successful closure. In this step the decommissioning of the applications are executed as per the project plan prepared under Solution planning step and a report is generated as per the Quality system. The Pharma conglomerate s audit team then audits the report. 5

6 Team should typically comprise of: 1. Principal Consultant who has extensive experience in IT strategy and application portfolio optimization across various domains 2. Senior Consultant who has experience in areas of IT strategy & information management having worked on portfolio optimization initiatives for various customers. 3. Domain Consultant who has extensive Pharma experience and specializes in quality systems validation and regulatory norms and practices Real Life Scenario: Overview: Let us take an example of a leading Pharmaceutical manufacturer having global presence. The Pharma giant has 400+ applications (ranging from large, critical ones to small, transactional ones) which interface with few other applications and run at various geographic locations. The Pharma conglomerate has decided to roll out with SAP globally which will result in decommissioning of already existing applications. The applications which will result in decommissioning, are being used in the manufacturing process of the drugs (i.e., from Procurement, manufacturing and distribution) and are mandated by regulatory requirements like GMP, GCP, GLP, SOX, Data Privacy etc. The 400+ applications needs to be decommissioned by meeting the compliance requirements as mandated by various regulatory authorities and business requirements as per the company s internal policy. Since the company operates in the pharmaceutical domain, thus a large number of applications touch upon compliance norms (GxP, SOX etc.). The data used within these applications is extremely 6

7 critical from a compliance point of view and needed to be retained and managed to meet commitments. Challenges: People: Because of the legacy operating environment, change management was an issue since application decommissioning invokes emotional responses from the user community. Process: In absence of any process for application decommissioning, the challenge was to create the entire process from scratch and get the approval of various stakeholders. Ideal Approach by a team undertaking decommissioning: The team must conduct sessions with the sponsor and key decision makers to make them understand the benefits that can be gained by a structured approach towards decommissioning applications. Once the stakeholders get a hold of the potential risks that need to be tackled, it is easy to get a buy in. The team must also ensure complete buy in by validating the key expectations for each stakeholder and then merging it all together to validate the entire methodology. The team could also follow the 4 Step Decommissioning Methodology developed by HCL. Benefits of the 4 Step Decommissioning Methodology: HCL s decommissioning methodology is customized solution meeting all the requirements of a customer and is presented to the Customer in the form of a Blue book which acts as a guide for initiating Decommissioning of applications in a systematic way and thus enabling the solution to comply to the regulatory requirements. The methodology is able to reduce the total cost of ownership (TCO) by eliminating unwanted and redundant applications and thereby resulting in a lean IT organization with only the business value adding applications retained. 7

8 About the Speaker Vijay Kumar Mallavarapu Consultant in HCL s Life sciences practice helps The Pharma conglomerates in regulatory compliance. Vijay KM, an expert in Quality management systems brings with him rich experience of Pharmaceutical quality Management and lead teams to implement QMS. 8