Quality & Validation for the Supply Chain

Transcription

1 WHITEPAPER Quality & Validation for the Supply Chain INTRODUCTION Track and trace regulations are emerging around the world, introducing a new challenge for supply chain companies: How do these companies keep up with continuous regulatory changes and achieve compliance while still maintaining high-quality, reliable, validated systems? TraceLink has developed a network-tenancy platform that is purpose-built to meet compliance requirements while also offering high quality and reliable industry-leading validation activities at a lower cost. Whereas singletenancy environments will struggle to keep up with the evolving regulations that necessitate frequent software changes, the TraceLink network-tenant environment is scalable. With a single software instance, a robust Quality Management System, seamless Installation and Operational Qualification, and Automated Testing, TraceLink offers industry-specific compliance, plus a range of systems management improvements. Global Track and Trace Regulations Are at a Turning Point To regulate the flow of prescription medicines and safeguard the complex global supply chain against counterfeit activity, dozens of countries are implementing track and trace requirements. The USA, EU, South Korea, India, Brazil, Russia, Saudi Arabia, and China already have regulations going into effect. By 2019, more than 75% of the world s prescription medicines will be protected by track and trace legislation. While most regulations involve some combination of generating and managing serial numbers, tracking product through the supply chain, verifying data and reporting associated events to government authorities, no two countries in the world have passed the same legislation or mandated the same information formats. The 01

2 implications for supply chain businesses are daunting: they must master each country s disparate track and trace requirements, create architecture capable of generating, managing, and storing what will be unprecedented volumes of regulated data, and figure out how to efficiently exchange that data with hundreds to thousands of supply chain partners. To add to the complexity, most regulations are still evolving, so it is a critical time to continuously monitor, interpret and react to ongoing changes and to efficiently update systems and software as regulatory requirements evolve. This will require companies to be agile in a constantly shifting environment while maintaining a high level of quality and compliance to basic GxP system quality and validation principles. 75% of global medicines will be covered by track and trace regulations by the end of UNITED STATES SOUTH KOREA UNITED STATES UNITED STATES SOUTH KOREA SAUDI ARABIA EUROPEAN UNION INDIA RUSSIA BRAZIL BRAZIL CHINA Quality Management System and Validation TraceLink has instituted a comprehensive, end-to-end approach to quality and validation. This approach spans from the requirements through deployment based on: The TraceLink GxP/GAMP 5-compliant Quality Management System (QMS) A mature, robust library of SOPs, Standards and Work Instructions documenting our development and software release processes Quality oversight Software Development Life Cycle (SDLC)-focused release processes Cloud Operations procedures 02

3 SDLC documentation related to product release is available for review. Installation Qualification (IQ) and Operational Qualifications (OQ) summary documents for each release are also provided to the customer. The IQ process includes the full set of installation activities for each software component in the TraceLink network, including software release version, date, listing of components, and migration tasks when required. It details each component installation and upgrade step, the commands executed to perform the step, and the results of performing the step with confirmation that the component is active after updating and running the correctionbuild version of the component. The OQ is performed on an independent Quality Assurance (QA) test platform with the identical configuration and install procedures used for the TraceLink customer-facing environments, ITEST and PROD. For each major release, test plans are defined to check each new or updated feature area and to ensure that it conforms to the requirements. Test cases contain the specific test execution steps for each feature area and are updated with Pass/Fail and references to defect numbers when failures occur. Artefacts such as screen shots, system output, and data interface files are captured with the test results as artefacts from test execution. Continuous Integration: How TraceLink Software Quality Assurance Uses Automated Testing The TraceLink Software Quality Assurance team employs automated testing to quickly, consistently, and accurately run testing that improves the quality of the code, simulates different company use cases and configurations, and reduces customer issues. Because automated testing is reliable and repeatable and all parameters are defined, the exact same test is executed each time, which reduces (if not eliminates) the chances for human error. TraceLink has built an Automated Testing Framework that includes unit and integration testing and currently runs more than 5,000 automated tests each day. New automated tests are also continuously being added to this testing framework with each new release. Thus, the daily automated testing continuously tests code as it is developed and enables robust regression testing which creates high confidence that new code developments enhance the software. Automated testing allows for a more agile and flexible release process. In the current life sciences supply chain environment, where continually evolving regulations necessitate frequent code changes, automated testing is essential. 03

4 The TraceLink Life Sciences Cloud and GAMP Compliance Most of the 20 top pharmaceutical companies in the world are currently live and in production today with serialisation because they have chosen the Life Sciences Cloud platform, and find it to be in compliance with GAMP and GxP. How GAMP Is Categorised Good Automated Manufacturing Process, or GAMP, is a set of guidelines developed by the International Society of Pharmaceutical Engineers (ISPE) to help improve compliance, quality and efficiency for the pharmaceutical industry. Key objectives include patient safety, product quality and data integrity. GAMP provides a framework for companies to assess the risk level of their systems and software and help determine validation resources. The GAMP risk assessment also encompasses business processes, user requirements and regulatory requirements. GAMP 5, the current version, outlines five classification categories. Category 1 includes widely available software used throughout the industry and is deemed low risk. This includes infrastructure software such as Windows. In subsequent categories, software becomes more specialised and has a higher risk assessment. Unique solutions that are developed and used mainly by a particular business are considered the highest risk and are classified as Category 5. 04

5 How the TraceLink Cloud Environment Factors into GAMP 5 The Life Sciences Cloud is a set of applications that run in the Amazon Web Services (AWS) cloud. TraceLink considers AWS which serves more than one million active customers in 190 countries as Category 1 infrastructure. TraceLink validates our applications, which are considered Category 4 (Configurable Software Package) within the GAMP 5 framework. This validation is performed on the underlying AWS infrastructure, thereby validating the whole system, including TraceLink software and infrastructure components. TraceLink Life Sciences Cloud Applications Are GAMP 5-Compliant The Life Sciences Cloud environment is compliant with GxP and GAMP validation requirements in accordance with the TraceLink GMP/GAMP 5-compliant QMS. This means: The TraceLink application and associated software and infrastructure components are validated as a validated system/platform during QA (OQ) testing and the IQ. All software components, version numbers and actions executed during the IQ and OQ are listed in the IQ/OQ summary certificates and provided to TraceLink customers. TraceLink uses the exact software and system stacks in our validation processes: the infrastructure and software components deployed and tested by QA are identical to the components deployed in production. TraceLink provides a validated system to the customer. Following PQ or UAT testing by the customer, full endto-end validation of the system is complete. Following deployment to production, all systems are under stringent change control according to TraceLink SOPs. TraceLink has been audited by an independent third-party, Rx-360 Consortium, and the audit report (available for purchase) demonstrates compliance. 05

6 Automating the Validation Life Cycle To ease the number of validation resources and manual processes, TraceLink offers Automated Validation Manager (AVM). AVM is a cloud-based service that automates the entire validation life cycle of the Life Sciences Cloud, including all the elements customers will need to produce PQ and User Acceptance Testing (UAT). Automated validation eliminates the need for manual, labour-intensive, paper-based validation procedures. In addition to all the IQ and OQ already included with a TraceLink subscription, AVM provides access to PQ/UAT and validation documentation to ensure TraceLink software capabilities are performing as intended, including: Functional risk assessment Validation plan Test cases and results User Requirements Specifications (URS) Traceability matrix Summary report AVM audit certificates and summaries Executing Performance Qualification (PQ) validation tests is essential in an environment where evolving regulations necessitate frequent code changes. Customers will be responsible for performing PQ activities as required within their organisations. With AVM, the PQ process is streamlined and provides evidence of compliance. All components in the TraceLink QA process are identical to those deployed and tested in production, so once a company has finished their PQ on-site or using AVM, full validation of the system is complete. Network Tenancy: A New Dimension that Delivers Higher Quality The validation of a single-tenant solution poses operational challenges and substantial costs. In a single-tenant environment, significant internal resources are required to perform the IQ, OQ, and PQ activities and testing. Single tenancy also requires costly and labour-intensive retesting and re-validation for all changes, including new integrations, point-to-point connections, and software updates. This is in contrast to the TraceLink network-tenancy model, where all IQ and OQ testing and validation is performed by TraceLink, and the PQ effort is minimised for the customer with AVM. TraceLink performs the majority or all of the validation activities while providing documented evidence of successful execution, and the time and cost burden of managing QA and validation with staff is eliminated. 06

7 Network Tenancy Reduces Cost Infrastructure Serialisation requirements will challenge the traditional hardware and infrastructure set-ups of a single-tenant environment. Companies will need to generate, transmit, manipulate and store unprecedented volumes of data literally terabytes of serial numbers and associated events. To manage this in a single-tenant set-up, companies would need to purchase large quantities of additional hardware for data storage and increased performance. Operationally, a significant increase in ongoing IT staffing costs would be required to maintain the data centre, handle repairs, ensure for redundancy, and disaster recovery management. An in-house infrastructure would be prohibitively expensive from a capital, personnel, expertise and risk management perspective. A network-tenancy environment can quickly scale to meet the unprecedented data demands of emerging serialisation requirements. In the TraceLink AWS cloud environment, provisioning, configuring and deploying multiple servers and software changes is as quick as provisioning one. Amazon runs on a utility model where resources seamlessly expand when more are needed, and contract when needs decline. TraceLink only pays for what we use, a cost savings that is passed along to customers. Overall, a network-tenancy platform provides greater agility and the ability to accommodate changing demands. Software Single-tenancy service providers oversee multiple software versions across their client base. They must manage different changes for each client, along with subsequent re-validations. This limits their ability to react quickly and to uniformly update all systems with regulatory-related changes. Given the continuously evolving compliance requirements, if a company is not running the latest software version, they run the risk of falling out of compliance. The TraceLink network-tenancy architecture supports rapid updates to keep pace with inevitable changes in the regulatory environment. Software updates are rolled out to all customers simultaneously. Because every customer receives critical updates immediately, they are kept continuously compliant. And while all customers share the same instance of the software, company integrations, mappings and data are all securely isolated from each other. 07

8 CONCLUSION: RETHINKING DATA MANAGEMENT AND TECHNOLOGY New and emerging track and trace regulations require supply chain companies to rethink the way they manage data and technology. While legacy systems and infrastructures have served businesses well for many years, they do not offer the flexibility, agility and cost efficiency that organisations require to keep pace with new track and trace demands. Because of the high information load, trade partner collaboration requirements, and evolving regulations, legacy single-tenant environments where multiple versions of software must be managed are no longer viable. Network tenancy offers the scalability and agility to manage regulatory requirements. At the same time, it promises high quality and a validation process that is lower effort and lower cost, and it benefits from automated testing and confirmation to ensure all software capabilities meet compliance with industry standards. 08