The situation
Years of testing and millions of dollars go into developing a new drug. It’s precision work, highly nuanced and sophisticated. By contrast, the blocky, clunky refrigerators that store many drugs might not seem quite so important. But if that unassuming fridge is on the fritz, if the door doesn’t seal tightly, if it goes just one degree above the strict temperature range required, all the precious cargo inside may spoil.
In the life sciences industry, Enterprise Resource Planning (ERP) systems function a bit like those fridges, storing data about procurement, manufacturing, and distribution that is nearly as crucial as the chemical compounds in life-saving drugs. A global pharmaceutical company implementing a new SAP ERP recognized this fact and looked to Good Practice (GxP) guidelines for software validation to make sure its technology was fit to preserve the integrity of what was within.
The company knew that errors in the software could have serious consequences. The Food and Drug Administration’s Code of Federal Regulations (FDA 21 CFR Part 11) requires security, accuracy, and reliability in software affecting patient safety and product quality. If software systems aren’t properly validated, the FDA and similar regulatory bodies in other countries can levy heavy penalties and issue consent decrees to shut down specific plants or product lines. Even more importantly, patients’ lives can depend on receiving the company’s drugs, and receiving these drugs depends on an entire constellation of data points converging correctly within the ERP.
When’s the last time a fridge saved anyone’s life?
The solve
What does it take to validate ERP software? Look at the system’s applications—was it installed correctly? Was it configured to the basic requirements? Was the data loaded accurately? Have all customizations been pressure tested? Are users experiencing the expected results for any actions they’re taking?
Each of those questions needed to be answered across the company’s global ERP footprint. And answering those questions meant executing thousands of testing scripts to make sure what the system returns matches what it should for different user requirements. Given the scale and complexity of the ERP system compared to the capacity of the lean internal validation team, the pharmaceutical company looked for reinforcements. Deloitte’s Software Validation practice proved a natural fit to support the Deloitte team already implementing the SAP solution.
Bringing deep skills in software testing, functional and business process knowledge, and regulatory experience, Deloitte designed a series of workshops to align the client’s teams on each phase of the software development life cycle and formally define the ERP system’s scope and the company’s needs. The resulting risk-based validation plan encompassed input from numerous stakeholders across the organization and 4,000 user and functional requirements. As part of the planning process, Deloitte’s proprietary Risk Assessment Accelerated Solution (RAAS)—which sorts each requirement by its GxP level of risk (H/M/L) much more efficiently than doing so by hand—cut the time needed for the functional risk assessment and testing prioritization planning nearly in half.
Our team ran thousands of testing scripts, created extensive documentation, and presented any validation defects they discovered for remediation before the defects could cause problems in action. By the end of the testing cycles, the company felt confident its system was fit to protect the critical data within.
Checking systems that store crucial data is more than just checking a box.
The impact
With the first phases of its new ERP system implemented and validated, the pharmaceutical company has seen positive effects—in terms of both what the company can avoid and what it stands to gain.
Regulatory compliance:
Through software validation, the company is positioned to maintain compliance with the requirements of the FDA and similar regulatory bodies in the other countries where it operates and is better able to minimize potential fines, penalties, and legal liabilities.
Improved efficiency and cost savings:
Validating the ERP helps identify potential issues that may impact system performance right at the outset, reducing the risk of system downtime or data loss. Finding those potential issues early on can decrease the cost of remediation and rework.
Patient trust and safety:
Most importantly, the company is more confident in its software’s ability to bring life-changing treatments to the people who need them. Thoughts of the ERP system won’t ever cross patients’ minds, but it’s humming away, preserving the data inside and making the company’s mission possible.
We know life sciences software validation — inside and out.
