Quality and Compliance: The Core of the Life Science Learning System

Transcription

1 Quality and Compliance: The Core of the Life Science Learning System By Rob Sims, Director, Life Science, UL EduNeering

2 Executive Summary: Quality and Compliance The Core of the Life Science Learning System By Rob Sims, Director, Life Science, UL EduNeering Within today s Life Science organizations, learning needs span a wide range of departments and functions. A short list of these departments includes Corporate Compliance, Human Resources, Leadership Development, Sales and Marketing, Product Development, Manufacturing and Quality Assurance (QA). This paper focuses on the QA team, who is responsible for meeting global regulatory requirements and assuring that individuals have been trained and are qualified for their job functions. As with any industry, a Life Science organization can gain a competitive advantage by delivering learning programs that focus on professional development, leadership training, product education and performance improvement. However, the regulatory cloud that hangs over the Life Science company forces the QA team, as well as the Validation and IT teams, to evaluate Learning Management Systems (LMS) based on the product s ability to address regulatory functionality in the most efficient and cost-effective manner possible. This can only be accomplished if the regulatory requirements are embedded into the LMS architecture and the product s core design, rather than programmed into the system that wasn t initially developed to meet these requirements. While professional development and talent management programs led by HR, sales, marketing and product development are critical to a company s long-term growth, we know that companies struggle with noncompliance when quality and compliance regulatory requirements are not embedded in the corporate learning system. So when a Life Science organization evaluates corporate-wide learning systems, the needs of QA should be the highest priority. This point was underscored in a 2012 survey of 200 Life Science companies, conducted by market research firm Lead to Market and sponsored by UL EduNeering. The survey revealed that for the most part, QA does have a voice in the learning system evaluation process. The presence of QA also demonstrates to regulators and other stakeholders that senior management has made a commitment to quality and compliance and also recognizes the business benefits of embedding quality into the cultural fabric of their organizations. page 2

3 Does Quality Have a Voice in Learning System Selection? In Q1 2012, Lead to Market conducted a survey of 200 Life Science companies to better understand the role that QA plays in selecting the corporate learning system. Because the QA team is responsible for achieving the regulatory compliance obligations, including Good Manufacturing Process (GMP) training, the specific learning requirements must address these areas: Key Topics Ability to support role-based qualification training programs Ability to develop GMP-focused and other regulatory curricula Ability to meet FDA validation and 21 CFR Part 11 requirements Ability to generate reports for regulatory-focused audits to demonstrate a commitment to ongoing compliance In the survey, leading quality executives were asked if they had a seat at the table during the learning system evaluation process. Among the departments represented, QA had the strongest voice, which demonstrates that most senior managers understand the critical role that QA performs within the company: Which of the following departments will be a part of the selection team? Check all that apply. QA Y/N 75.00% HR Y/N 53.57% Corporate Training Y/N 32.14% Leadership and Development Y/N 25.00% Procurement Y/N 17.86% Other 10.71% Delving deeper into the QA role in evaluating learning systems, we have identified these three areas as the greatest quality/compliance requirements: Does Quality Have a Voice in Learning System Selection? Why Quality-Related Learning Remains Priority #1 The Quality-Focused LMS Focuses on Standardization and Validation Addressing the Critical Needs of HR, Sales and Other Areas Summary What Requirements Matter Most to QA? 1. Alignment of the program to the organization s quality management process 2. Ability to achieve ongoing validation requirements, especially as the learning technology evolves 3. Ability to readily accommodate individual company business requirements, such as M&A activity, global expansion, contractor relationships and product expansion Clearly, an LMS designed for general professional development is not likely to contain some of the quality-focused learning requirements. This point was also underscored in the survey, in which respondents who had indicated that their company was evaluating an LMS were asked if they were satisfied with their current system. About half of the respondents were marginally satisfied or not satisfied that their regulatory demands were being met by the selection process. page 3

4 On a scale of 1 to 5, 1 being not satisfied at all, 5 being completely satisfied, how satisfied are you that QA s needs for GMP and/or Regulatory Compliance training management (Part 11 system, SOP training, etc.) are being met by the entire selection process? % % % % % Why Quality-Related Learning Remains Priority #1 In the Life Science industry, the risks of noncompliance are significant in regards to product quality and patient safety. From our survey, we learned that almost 90 percent of respondents thought it was important that the LMS be specifically designed to meet their Life Science industry needs. Another key consideration for LMS selection involves the FDA s computerized system validation requirements. According to the FDA, validation is the formalized documented process for testing computer software and systems, required by a specific Code of Federal Regulations (21 CFR a). Failure to validate systems can lead to an FDA 483 Observation or even a Warning Letter. To be compliant, Life Science companies must validate all of their software, databases, spreadsheets and computer systems and develop the appropriate documentation for all phases of the Software Development Life Cycle (SDLC). QA is responsible for meeting global regulatory requirements and assuring that individuals have been trained and are qualified for their job functions. In the United States, the FDA has defined stringent regulations around trained and qualified personnel. Likewise, in the European Union (EU), companies must demonstrate that both personnel and qualified personnel those responsible for conducting the training have been adequately trained. In addition, both US- and EU-based Life Science companies must meet stringent computerized system requirements, such as validation, electronic copies, audit trails, record retention and more, as mandated by 21 CFR Part 11 and EU Annex 11. On a scale of 1 to 5, 1 being not important at all, 5 being very important, how important is it for your organization to use a learning management OR training management system specifically designed for the Life Science industry? % % % % % page 4

5 The Quality-Focused LMS Focuses on Standardization and Validation The QA team needs an LMS that can ensure and enforce standardization, organization and reporting of specific and meaningful role-based qualification requirements. According to regulations, employees must be able to demonstrate documented qualification that they can perform their specific job functions. Qualification could be represented by a collection of role-based training items or tasks that must be completed to satisfy the defined expectations of the training manager or department manager. To fulfill this qualification requirement, managers must be able to collect and organize all of the training items related to a specific job function or role. The training materials or tasks can be grouped into certification-based curricula. Without these documented standards, the QA team cannot receive consistent and meaningful reporting metrics that are measurable at every level within the company. Curricula are required at different levels of the organization. For example, a facility may require that all employees understand safety policies. That means the LMS must be able to organize groups of learners in many different ways: by region, by facility, by department and finally, by role. As the graphic below shows, ensuring compliance with these many levels requires an LMS that can place an individual into as many groups as necessary to fulfill the mandated or prescribed training within the organization. From our survey, we learned that almost 90 percent of respondents thought it was important that the LMS be specifically designed to meet their Life Science industry needs. Corporate & Divisional Requirements COMPANY LEVEL Facility-Specific LOCATION LEVEL Functional Knowledge DEPARTMENT LEVEL Job-Specific ROLE LEVEL page 5

6 Addressing the Critical Needs of HR, Sales and Other Areas Despite the regulatory requirements to address 21 CFR Part 11 and EU Annex 11 regulations, QA requirements are not the only critical learning areas that will drive a company s growth. Dozens of studies have demonstrated that talent management and related leadership and professional development training programs, along with the sales and marketing management teams, are critical for retaining top performers and driving new business. The question that Life Science companies have to address is how to manage a single corporate learning system that satisfies the regulatory obligations, while costeffectively delivering talent management and leadership development programs for the organization. Some companies have solved the issue by investing in more than one learning system. This enables HR and Leadership to manage their programs while Quality and Compliance manage their programs in Employees Contractors Suppliers Security Protocol Portal Portal Portal Compliance / 21 CFR Part 11 Talent and Development Platform Tools: Control Document Management Tool Assessment Tool Forms Tool Leadership and Succession Planning 180, 360 and Self-Assessments Security Protocol Corporate-Wide Systems: HRIS Active Directory EDMS CTMS Biometrics Third Party Content Vendors: AICC Third Party Internal Content: ILT Policies Virtual SCORM Courses page 6

7 the validated environment. What's more, Quality and Compliance can generate reports for audits that target only the qualification and compliance activities. However, we are seeing a more intriguing solution that delivers a seamless front-end experience for the end user. A single interface portal has been created, often using single sign on so that the user who logs into the network system can simply visit the corporate learning portal, which then directs the learner to the appropriate content: skill development, compliance training, performance management, etc. The front-end portal can be refined for nonemployees as well, in alignment with an existing supplier or contractor extranet. In the back end, the HR/Sales programs reside on their own servers in a non-validated environment, separated from the compliance and quality system. This separation ensures that IT and validation teams can focus their validation attention only to the 21 CFR Part 11 learning database. What s more, this segmentation ensures that the investment in talent and professional development programs, in which a more dynamic and collaborative environment is required, won t compromise the mandated regulated obligations for training and documentation, as the diagram illustrates. This separation ensures that IT and validation teams can focus their validation attention only to the 21 CFR Part 11 learning database. Summary In a Life Science organization, a true enterprise learning architecture should support goals for the management of all learning activities, across all areas of the company. However, the regulatory pressures facing Life Science companies are monumental and implementing a learning program that is not aligned with the quality management system can threaten production output, brand reputation and long-term growth. That s why leading Life Science companies evaluating corporate learning systems place a high priority on the needs of the QA team, building an architecture that enables other areas of the company to recognize their needs without sacrificing their commitment to quality and compliance. page 7

8 What Requirements Matter Most to QA? To understand exactly what is expected of all of the RFPs we reviewed. We have of an LMS that is designed for the segmented these requirements into three Life Science industry, we revisited major categories: approximately two dozen Request for LMS Functional Requirements Proposals for corporate learning systems Technical Requirements that we received from Life Science Service and Support Requirements companies since What we learned from this analysis was that the same We analyzed the requirements and requirements were being cited in nearly identified which of the specific requirements within these categories were of the highest priority for the QA team. The chart lists key priority needs of QA. In some RFPs, QA provided their own priorities, but others did not have priority scores. We applied our own experiences supporting the Quality teams within our 200 Life Science clients using ComplianceWire. LMS Functional Requirements: LMS Functional Requirements: (listed alphabetically) Administrator Management Experience; Tracking and Scheduling Assignments and Notification Management Assessment Management (Testing and Evaluation) Coding Nomenclature End User Experience Host Online Content Languages Reporting and Analysis: Standard and Custom Reporting and Scheduling Comments from UL EduNeering: For compliance purposes, notifications need to be scheduled based on the compliance need: daily reminders, weekly reminders, etc. The LMS should provide this flexibility based on the compliance policies established by the company. Whether the training item is an electronic version of an SOP, or a video or classroom event, compliance managers need to measure proficiency and retention. The LMS should provide the ability to attach a quiz to any training item so that the learner cannot complete the activity until they receive a passing grade on the quiz. QA often codes each training item for audit reporting and assignment purposes. The LMS needs to support a unique code for each training item. End users need a simple, intuitive interface that enables them to complete training and view their progress at any time. This is true of any LMS, but may be especially true of an LMS focused on compliance-related training. When QA shares SOPs and other documents, this content needs to be uploaded to a secure server so that learners can access the files outside the company firewall. The LMS needs to support multiple languages especially critical SOPs and provide the ability to roll up multiple language versions of the same training item so administrators can properly assign and track completions for auditing purposes. The LMS must deliver both standard and customized reports that focus on role-based curricula completions. That is, reports that display who is Qualified or Partially Qualified based on a job function curricula. In addition, the LMS must provide the ability to store department specific training status reports that enable managers and supervisors to own compliance training completions. page 8

9 LMS Functional Requirements (continued): LMS Functional Requirements: (listed alphabetically) Risk-Based Approaches to Learning that Minimizes High-Risk Activities Support for Mobile Devices Support for Virtual Classroom Activities Training Management: Course and Curricula, Classroom Registration, Catalog, On-the-Job Assessments and Blended Programs Training Management: Role-based curricula based on specific job functions Training Management: SOP Management Version Control: Ability to set a new version 1.1 Comments from UL EduNeering: The LMS should provide the ability to identify who in the organization conducts high risk activities versus other activities. With this information, training managers can target high-risk end users with more focused training. As more and more sales teams use ipads and related mobile devices, compliance content must be delivered to these devices. Compliance training delivered via a webinar or virtual classroom must be captured within the LMS. The LMS must support a wide variety of training types, including on-the-job assessments and monitoring. These types of training activities are common in the FDA regulated environment. The LMS must support role-based curricula and role-based user groups, based on job functions and hierarchy within the organization. For example, every employee in the facility may need workplace safety training, but only specific job functions require training on equipment SOPs. The LMS should be able to connect the Facility compliance training to the Equipment SOP training so that the administrative effort is reduced and reports are more focused and targeted for audit purposes. The LMS must support SOP management and the versioning and retraining rules that accompany each SOP. This means wrapping a training assignment around the electronic version of the document and then linking to that specific document on the network or within the document management system. Not all LMSs provide this level of version control, but QA needs the ability to up version an SOP so that it automatically triggers a new training assignment; this may not be a major requirement outside of FDA-regulated industry, but a core requirement of QA within the industry. page 9

10 Technical Requirements: Technical Requirements: (listed alphabetically) Application Architecture Application Security Data Architecture Data Center (Cloud Applications only) Enhancements Electronic Records and Signatures: compliant with FDA 21 CFR Part 11 and EU Annex 11 Comments from UL EduNeering: The SaaS LMS should provide a two tier architecture so that access to the data is achieved via database procedures. Security and data protection should receive the highest priority from the LMS vendor. As such, the vendor should make sure that infrastructure level security be enforced with SOPs that cover firewalls, servers, network hardware configurations, virus scanning, system hardening and encryption. All of these SOPs should be available for review during an audit of the vendor s facility. The LMS design should be redundant at every level so there is no single point of failure. The entire site should be mirrored to a disaster recovery site and synchronized at least every 15 minutes. The LMS vendor needs to maintain redundant data centers and have a fully documented and tested disaster recovery and business continuity plan. With a cloud computing LMS, clients should expect regularly scheduled enhancements with minimal interruptions to service or client downtime and without additional costs. For validation purposes, the LMS vendor must provide test scripts to clients, which would greatly minimize the validation effort by clients, as opposed to a server-based LMS upgrade, which would require additional IT and validation resources. The LMS should be designed to meet the strict requirements of 21 CFR Part 11, which includes a number of requirements such as: Validation of systems to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records. The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review and copying by the agency. Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify or delete electronic records. page 10

11 Technical Requirements (continued): Technical Requirements: (listed alphabetically) Integration with Other Applications Integration with Third Party Content Providers (Off-the-Shelf Learning Content) Policies and procedures that dictate the development of software requirements QA Process Single Sign On Support either Security Assertion Mark Up Language (SAML) technology or Lightweight Directory Access Protocol (LDAP) Comments from UL EduNeering: The LMS should provide application interoperability with document management systems, HR systems, Manufacturing Execution Systems and others. The LMS should be able to support SCORM and AICC-compliant content. The LMS should provide the ability to upload SCORM content to a secure server. Unlike other LMS vendors, one focused on the Life Science industry must have development specifications that are developed in stages that reflect a Software Development Life Cycle methodology (SOP SDLC1). Specific documentation should be generated during each of the SDLC stages. The LMS vendors' QA team should include experienced validation experts. The LMS vendor should have experience with active directory authentication via secure LDAP and SAML. The LMS should require an ID, Password and company code to authenticate a user. Our Professional Services team has created Single Sign On. The LMS also should contain interoperabilities that enable end users to access the system using existing company sign-in methods, including biometrics. Service and Support Requirements: Services and Support Requirements: Comments from UL EduNeering : Help Desk Support Hosting an On Site Audit: Audit or Sourcing Team May Need to Visit Vendor Facility Product Implementation and Integration Information Audit Support Training, Documentation and Support Services The LMS vendor should supply 24/7 help desk support. The LMS vendor should host the client for regular audits, sharing all procedures and policies. The LMS vendor must provide an experienced product deployment team that can share best practices from dozens of related Life Science company deployments. The LMS vendor s help desk team must be available when clients are facing audits so they can provide reporting best practices. The LMS vendor must provide administrator training programs and complete documentation related to the system functionality. page 11

12 About UL EduNeering UL EduNeering ( is part of UL LLC, a global independent safety science company offering expertise across five key strategic businesses: Product Safety, Environment, Life and Health, Knowledge Services and Verification Services. UL EduNeering develops technology-enabled knowledge solutions for improving business performance and helping to assure regulatory compliance. For more than 30 years, the company has served corporate and government customers in the Life Science, Health Care, Energy and Industrial sectors using proprietary learning management platforms that integrate business, learning and technology. For more than 10 years, under a unique partnership with the FDA s Office of Regulatory Affairs (ORA), UL EduNeering has provided the online training, documentation tracking, and 21 CFR Part 11-validated technology system for ORA-U, the FDA s virtual university. UL EduNeering is also the exclusive online partner for compliance solutions to AdvaMed and the Medical Technology Learning Institute (MTLI), delivering compliance education to AdvaMed s members, including an engaging online course on the AdvaMed Code. UL EduNeering and the Drug Information Association (DIA) formed a strategic alliance to create online educational offerings for biotechnology, pharmaceutical, academic, and regulatory professionals around the world. DIA members gain access to UL EduNeering s online compliance solutions, which are used by over one million individuals in more than 50 countries. 202 Carnegie Center Suite 301 Princeton, NJ UL and the UL logo are trademarks of UL LLC