Validation of software as a service ERP system: Compliant use of cloud computing

4^th International Conference on Pharmaceutical Regulatory Affairs

September 08-10, 2014 DoubleTree by Hilton Hotel Raleigh-Brownstone-University, USA

David Hawley

Scientific Tracks Abstracts: Pharmaceut Reg Affairs

Abstract :

The adoption of cloud services has been rapid in recent years, over most sections of industry, except for Life Sciences. While the majority of organizations have been quick to realize the efficiency benefits of rapid deployment, flexibility and general accessibility, leaving the technical details to specialist providers, (internal or external), Life Sciences companies? use of these systems has been slow and tentative. The stumbling block has been the perception that validation of such systems is difficult or indeed impossible and therefore use of them would lead to non-compliances. Current regulations regarding validation of computer systems were written before could models were conceived, and the latest published guidelines barely cover the subject of cloud systems. A few Life Sciences companies have started to look at this area, and though the technical and nontechnical media are full of articles, of varying usefulness, on what can be done with ?The Cloud? little attention has been paid to regulated industries. Those pioneering Life Sciences Companies that have investigated cloud models have tended toward the use of infrastructure and platform as a service (IaaS and PaaS), where the risk and rigor around qualification of infrastructure are seen as presenting fewer issues than that of full software as a service. However software as a service can be validated. This presentation will show that the use of different principles and techniques, from those used to validate stand-alone systems can be used to carry out validation, even of large configurable systems such as ERP systems. Issues addressed include: ? Validation for first use ? The role of the service provider ? Auditing the service provider ? Frequent changes to the system, not under the control of the regulated company ? Quality and risk management at the service provider and the regulated company The presentation will include: ? A brief overview and definitions of different types of cloud model ? A description of the challenges of qualifying or validating each model ? Why SaaS requires a different approach ? How the approach was put into practice ∗∗ A case study where such a project has been implemented and the changes procedures and principles that were required for both the service provider and the regulated company ∗∗ Lessons learned ∗∗ How the compliant state is maintained

Biography :

David Hawley is Director of Life Sciences at Business & Decision North America. Twenty years later he left the company which by that time was part of the Pfizer group, having worked in Engineering, shop-floor Production Management of Pharmaceuticals and Medical Devices, and various roles in information technology. On joining the Business & Decision group in 2004, he has worked on more than forty projects in the UK, Europe, North America, Asia and elsewhere, specialising in the compliance of infrastructure and large configurable systems such as ERP systems. He has worked on SAP, Oracle EBS, Microsoft AX, Epicor, Plex and others.