Applying GAMP 5 to Validate an ERP System

Applying GAMP 5 to Validate an ERP System ISPE’s GAMP 5 explains the methodology for implementing an ERP s ystem, either new or existing, in a reglated en!ironment" #ere is a dis$ssion of an a$tal implementation" Stephen R" %errell &'(')(*&''  Editor’s note: This article was originally published published in the November/December November/December 2010 issue issue o  Pharma$eti$al Engineering ! Engineering ! the oicial publication publication o  ISPE www#ispe#org   $# Normally this content content is  ISPE " www#ispe#org  only available to society members! but is reprinted here in abridged orm by special arrangement# The  full text, including all related related references, is available available online# %&'E has its Tampa (onerence! )ebruary

21*2+! 2011: www.ispe.org/20ta!paconference # Ris+ management $on$epts in the pharma$eti$al indstry are matring and harmoniing as refle$ted in I-# ./ 0International -onferen$e on #armoniation1 .ality Ris+ Management" GAMP 5 0Good Atomated Manfa$tring Pra$ti$e 51 pro!ides dire$tion in applying these $on$epts in the de!elopment, implementation, and maintenan$e of $ompteried systems" Ris+ to the patient and prod$t 2ality $ontine to 3e the primary areas of $on$ern" 4his arti$le shows how s$h ris+3ased approa$hes $an 3e effe$ti!ely applied to ERP !alidation and $omplian$e" 4ypi$ally 4ypi$ally,, $ommer$ial offtheshelf software 0-64S1 pa$+ages, in$lding those sed as the 3asis for most ERP implementations, implementations, will 3e $areflly tested 3y the sppliers 3efore $ommer$ial release" 4herefore, there is no intrinsi$ !ale in attempting to test e!ery mose $li$+ or e!ery s3men in this $ontext and it is not a reglatory re2irement" 4he fo$s shold 3e rather on ensring that the $onfigration of the  prod$t is defined, defined, holisti$ 0in terms of GxP', GxP', * and Part ''7 $omplian$e1, $omplian$e1, follows a$tal 3siness  pro$esses, and is !erified !erified to 3e fit for intended se" se" 4he reglated $ompany shold fo$s on managing potential ris+ to patient safety and prod$t 2ality, and ensring $omplian$e with the rele!ant GxP reglations, in$lding *' -% R Part ''" Additionally Additionally,, they also shold $onsider the impa$t to the o!erall 3siness pro$ess"

GAMP 5 defines a $ompteried system as8 9A $ompteried system $onsists of the hardware, software, and networ+ $omponents, together with the $ontrolled fn$tions and asso$iated do$mentation": ;ased on this definition, a holisti$ approa$h was sed in the implementation of the ERP system as des$ri3ed 3elow" Case study overview

4he ERP system dis$ssed in this arti$le, SAP, was a lega$y system" 4he s ystem had not 3een pre!iosly sed for GMP prposes" 4herefore, the do$mentation srronding the system was essentially non existent in that it did little to spport the se of the system in a reglated en!ironment" An important element when pr$hasing a $ompter prod$t or ser!i$e is spplier assessment, whi$h may in$lde spplier adit" In this $ase, howe!er, while the system was new to the GMP manfa$tring plant, it had 3een in se spporting the 3siness for '5 years" As a reslt, a de$ision was made, <stified, and do$mented with the rationale for why an adit wold not o$$r" 4he organiation a$+nowledged that the !endor is an esta3lished and re$ognied 3siness soltion pro!ider with a large ser 3ase in the indstry" 4he pro
-reating a $ompteried system !alidation plan is a fndamental 3ilding 3lo$+ of any !alidation pro
%or the prpose of this $ase stdy, the ris+ was 3ro+en down into the following three $omponents8 '" System ris+s> *" -riti$ality of ser re2irements> and 7" GMP 4-odes 0transa$tion $odes1"

Ea$h fn$tion in the system has an asso$iated $ode" ?sing a transa$tion $ode ena3les 2i$+er a$$ess to any tas+ in the system" System risks

A system ris+ assessment 0RA1 was prepared early in this pro *" Ensre $onfigration is ade2ately tested> 7" Ensre $onfigration is managed postgo li!e> and B" Ensre sers are trained on said $onfigration" 4he $ompany was a3le to apply the for themes in the $ontext of their own 3siness model to de!elop the following8 C @efine  $reate the ser, $onfigration, fn$tional and design spe$ifi$ation> C 4est  3ild !alidation s$ripts> C Manage  $reate ERP friendly S6Ps> and C 4rain  tea$h the 3siness how to se the system"

4he ris+ assessment in$lded +ey GMP ris+s and other 3siness ris+s, in$lding those related to Sar3anes 6xley 0S6D1" All ris+ $onsiderations were e!alated and where appli$a3le, remedial a$tions were identified 3ased on $riti$ality" Ea$h ris+ identified was $learly designated as GMP or otherwise" As the  pro on$e after the ser re2irements were defined and again after the 3siness 3leprinting or fn$tional spe$ifi$ations were written" 6ne of the $hallenges with any ris+ assessment pro$ess is the assignment of #(M( 0high(medim(low1 and the dependen$ies 3etween <stifying one ris+ as higher than any other" GAMP 5 pro!ided the following error o$$rren$e 3y transa$tion8 '&&  > ',&&&  M> and '&,&&&  #" GAMP 5 sggests that a s$ientifi$ approa$h to ris+ assessment 3e applied" After m$h de3ate, the approa$h agreed pon was to rely on the +nowledge and $olle$ti!e experien$e of the wor+shop teams to $reate a 3aseline for #(M( assignation and then to $onsistently apply it to the system" 4his assessment was additionally sed to pro!ide priority targeting for remediation, and the reslts 3ro+e down as follows8 '&5 #igh ( )B Medim ( 5F ow priority for remediation" ?ltimately, the RA was re!isited at the $on$lsion of the pro
4he se!en step pro$ess 3elow des$ri3es how the team le!eraged the reglations and tilied the existing system do$mentation to aid in 3ilding the ?ser Re2irements" 4his pro$ess aided in the ris+ analysis and testing re2ired to exe$te the pro
Step *8 Re$y$leMost GMP reglated operating $ompanies will already ha!e an ERP or similar system in pla$e" If a $ompany has 3een reglated for a while, there may already 3e a !alidation pa$+age from a  pre!ios system that $old 3e re$y$led, and perhaps a nm3er of $hange $ontrol pa$+ages to se" In this $ase stdy, sing a high le!el ris+ assessment system, the $ompany was a3le to dis$ern whi$h parts and  pie$es of or original ?RS 0whi$h was system netral1 were appli$a3le to the $rrent 3siness pro$ess" Step 78 ;siness needs(ser re2irement wor+shopsIn order to ma+e the pro$ess as fo$sed as possi3le, ser re2irements wor+shops were formed with the !arios fn$tional grops" All ser grops were gi!en the s+eleton ?RS two wee+s in ad!an$e of the first wor+shop and were en$oraged to add, s3tra$t, edit, and $omment" 4he $ommented ?RSs were $onsolidated and ltimately yielded in ex$ess of 7,&&& ser re2irements, some dpli$ated, some am3igos, some 3iarre"  Hext, three halfday wor+shops per wee+ for for wee+s were s$hedled, ea$h and e!ery ?RS was re!iewed, and a ni2e identifier for tra$ea3ility 0li+e PP'B or 6#*71 was $aptred" Ea$h ?RS was gi!en a $riti$ality nm3er dire$tly $orrelating to its impa$t on the GMPs and Part ''" 4hese were8 C Mandatory ?RS ran+ed as a 9': J GMP or GMP and 3siness $riti$al> C ;enefi$ial ?RS ran+ed as a 9*: J nonGMP, 3t 3siness $riti$al> and C 9Hi$e to ha!e: ?RS ran+ed as a 97: J nonGMP, non3siness $riti$al" At the end of the for wee+s, the following ser re2irements were $aptred8 C 7/ le!el '> C ','5F le!el *> and C '/) le!el 7" 4his approa$h a$hie!ed two +ey goals" %irst, 3y !irte of the ris+ and $riti$ality pro$ess, the GMP testing  3rden was red$ed to a little less than B&& re2irements and se$ond, a re2irements do$ment was now a!aila3le for the ERP analysts to 3ild from" 4his do$ment was de!eloped 3y all +ey sta+eholders, in$lding .A" Step B8 ;le printingIn order to translate the netral ser re2irements into ERP$entri$ fn$tional re2irements, a site of P@@s 0pro$ess design do$ments or fn$tional spe$ifi$ations1 was $reated" 4he

goal of the P@@s was to define the system in a way that $old 3e nderstood 3y 3oth the analysts and  3siness" Ea$h P@@ was tra$ea3le 3a$+ to as many as 7& ?RSs and all 3siness pro$esses were defined graphi$ally sing MS Visio" 4he pro$ess flows integrated into P@@s gradally formed a pi$tre of what the system wold loo+ li+e  post goli!e, and the se of the ERP integrated into or 3siness pro$ess started to ta+e shape" ater, the flows were sed as a 3asis for P. and the P@@s were tied to the new S6Ps, whi$h then in trn formed the  3aseline for pro$ess $hange $ontrol" In addition to the pro$ess flows, the ERP implementation team translated ?RS into fn$tional pro$esses  3ro+en down 3y fn$tions, data, or interfa$es" Step 58 %n$tionsEa$h $olle$tion of ?RSs was translated into the appropriate fn$tion set in the ERP> any inpts, otpts, $al$lations, $onfigration, or se$rity $onsiderations were $aptred here" Step 8 @ata4he data se$tion was mainly fo$sed on those data elements ne$essary to 3e $onsidered for  the fn$tion set in s$ope to exe$te $orre$tly" Kithin SAP, master data plays a !ery important role and $an $ase signifi$ant system isses if not formatted or defined $orre$tly" Khere possi3le, master data $onsiderations were in$lded in this se$tion" Step F8 Interfa$es;eyond a 3ar$oding system, the ERP instan$e does not ha!e any ma de to the natre of the formation of s3 teams 03y ERP modle1> howe!er, there was referen$e to the ERP modles that any parti$lar fn$tion set was or $old impa$t" 4his fa$ilitated the s3 team $ommni$ations as $ross fn$tional pro$esses were de!eloped" GAMP 5-based system configuration

4his posed a $hallenge as the lega$y ERP system was already in pla$e" As pre!iosly des$ri3ed, the system had 3een sed for nonGMP prposes> therefore, do$mentation that had 3een $reated while !ala3le to the ERP team was not easily translated into the reglated $ontext" 4he $onfigration definition pro$ess was split into two parts" %or the ser!ers, operating systems, and $ore ERP 3ild, system $onfigration spe$ifi$ation 0$ore S-S1 was $reated" 4his allowed !erifi$ation to o$$r

simltaneosly there3y 2alifying the hardware and $ore software, while the ERP analysts were translating the ser re2irements" %or the a$tal $onfigration or $stomiation of the ERP, the de$ision was made to se the lega$y system as a 3aseline, do$menting all $hanges that were ne$essitated 3y or $omplian$e re2irements tiliing additional $onfigration do$ments 0-%@1" Part ! " #ardware and core software SCS!$

GAMP 5 Appendix @7 pro!ides a $he$+ list for S-S $ontent" Also, the team tilied the 9I4 Infrastr$tre -ontrol and -omplian$e Gide": @epending pon the roles and responsi3ilities defined in yor organiation, the do$mentation $an 3e managed effe$ti!ely with well defined roles and responsi3ilities assigned to ea$h 3siness nit within the $ompany" %or this pro
4he ser!er setp is $onsidered standard and $onsists of the following for en!ironments8 '" @e!elopment> *" Sand3ox> 7" .ality 0test1> and B" Prod$tion"  Hote that this !endor re$ommends installing the appli$ation ser!er and $entral data3ase ser!er on separate ma$hines and pla$ing them in a separate s3net" It is 3enefi$ial to see+ affirmation and spporting information from the !endor on installation re2irements" %RP infrastructure environmental conditions

It may seem redndant to $aptre and !erify en!ironmental $onditions, espe$ially $onsidering the ser!ers had already 3een sed in spport of the appli$ation" #owe!er, failre to ensre a temperate and sstained en!ironment for yor ser!ers $an ha!e a signifi$ant 3siness impa$t"

Physi$al se$rityAll of the physi$al se$rity attri3tes were defined and later formally !erified for the !arios data $enters arond the glo3e" @ata3ase se$rity profilesAn important and easily o!erloo+ed $omponent to any $lient(ser!er system is data3ase se$rity, i"e", who has a$$ess to yor 3a$+end ta3les" 4ypi$ally, appli$ation se$rity will not address those a$$essing yor ser!ers from otside the appli$ation" %or this ERP system, the administrator a$$onts, administrator’s roles, role mapping, data ex$hange a$$ont, and ?nix a$$ess were defined" Again, the 93$+ets: are not as important as the $ontent, and who $an a$$ess the data" It is important to nderstand who $an do what, define it, and $ontrol the a$$ess to the data" 'etwork to(ology

4ransport management4ransport pro$ess flow shold 3e managed from sand3ox to de!elopment, from de!elopment to .A, and then ltimately into prod$tion" It is important to define and $ontrol the transport method and flow" 4his shold 3e in$orporated into the $hange $ontrol system" Peripheral system interfa$es4he last +ey element to dis$ss in the $ore S-S are peripheral systems" It is important to nderstand the data inpt into the ERP, the data sor$e, and the $ontrols arond that sor$e" E2ally, one mst nderstand what system the ERP otpt data is sent to for se" 4hose interfa$es and the asso$iated systems shold 3e $areflly e!alated to determine GMP se and s3se2ently their !alidation stats" Examples from this implementation in$lded a 3ar$ode system, a IMS, and a la3eling system"