Validación de Sistemas de Gestión de Negocios (ERP) Validación de Sistemas de Gestión de Negocios (ERP)

Transcripción

1 Validación de Sistemas de Gestión de Negocios (ERP) Validación Validación de de Sistemas Sistemas de de Gestión Gestión de de Negocios Negocios (ERP) (ERP) 1 2 1

2 World s changes The Pharmaceutical Industry has adapted its business model in response to growing industry constraints and the decline of the primary-care focused blockbuster therapy. Principal Key Success Factors in this scenario are: Maintaining Quality Optimising Process Cost Management Reducing Time to Market Optimising Supply Chain Latino America Consultores, with its experience, is one of the most Qualified Partners in South America to achieve that goal, according to cgmp requirements, with a special focus on Pharmaceutical Business Evolution. 3 International Support Support in R&D Technology Transfer Business Process Re-engineering Feasibility Studies Momentum Life Science Regulatory Affairs Qualification, Validation & Management Engineering, Design & Construction Support Business Development & Alliance Quality in Outsourcing & Auditing IT in Compliance Training 4 2

3 Product Knowledge Engineering Project: URS, Feasibility, Preliminary Budgeting, Conceptual Design, Basic Design, Detailed Design, Design Qualification Verification: Equipment & Plant Qualification Support, Utilities Qualification Support, Analytical Methods & Equipment Qualification, Information & Data Management System Validation Product & Process Support Supports for Formulation, Pilot Phases, Scale Up and Industrialization Process Qualification Technology Transfer Support Regulatory Affairs & Compliance International Regulatory Support Supports in Preparation Dossiers Supports in Preparation of Technical File for Medical Devices Preparation and Implementation of Variation Procedures Compliance, Innovation & Data Management ERP, LIMS, DCS, SCADA, WMS, EDMS have to be in Compliance. Feasibility Study & Software & Supplier Selection Solution Providing & System Integration Support Computer System Validation (GAMP 5.0), 21 CFR 11 Compliance GxP Risk Assessment & Remediation Plan Management Support for IT Infrastructure Management & Enhancement, Networks Qualification Legacy System Assessment & Full Plant Remediation Support 5 ERP Validation Main ERP Structure Basic Strategy 6 3

4 ERP: Example Generic Architecture 7 Diferencias Estructura Modular Módulos Independientes vinculados por un Mecanismo de Transacciones Cada Modulo puede tener una interface Altamente Configurable Customizable usando lenguaje ABAP Implementación por Expertos Documentación estándar de implementación (ASAP/Blueprint) Corporate Validation Support Diseño en base a Funcionalidades Posee un sistema de interface particular utilizando SQL (SQL Database Transaction) Altamente Configurable Customizable utilizando un ambiente Microsoft Implementación por Analistas y Expertos MS/SQL Paquete opcional de compliance (Process Industries) Configurable por un Menú Estándar Compatibilidad con Office Nativa (Data Import/Export) 8 4

5 Approach Principle For both Systems a Process Mapping & Risk Assessment activity is mandatory; For SAP it s mainly dedicated to identify the Configured Transaction and the Customized Function (if present) For AX it s mainly dedicated to identify minimal configuration detail and customization 9 Full Assessment Metodology Activity 1 Prj.Planning & Inventory 2 GMP & Risk Assessment 3 Assessment 21 CFR Part 11 4 Gap Analysis 5 Planning Systems List Risk Assessment Report System Assessment Report Gap Analysis Report Action Plan DELIVERABLES Remediation Plan 10 5

6 ERP Validation SAP Validation Approach 11 Unsolvable Situation = Después de haber eliminado lo imposible, lo que queda, por improbable que sea, debe ser la verdad Arthur Conan Doyle - Sherlock Holmes,

7 Typical Situation Complex Configuration, apparently without enough documented evidence (not totally accurate) Huge number of transaction, with a long history Insufficient level of test during project release phase NO Change Control Management in place (usually insufficient and NOT documented) Few Resources could be dedicated to perform validation The project is TOTALLY left to external consultants RESULTS: 1. Project Duration: from 6 month to over than one year 2. Negative impact on the structure 3. The company has no control of the project and does not develop a real understanding of the processes 13 Cómo podemos mejorar esto? Mission Impossible?? 14 7

8 Risk Based Approach Systems System Level Impact Assessment Funcional Level Impact Assessment systems Direct Indirect No Impact funcionalities Critical Non Critical 15 Document Hierarchy Risk Assessment Document (RA Datasheet, RA Report, Collected Lists & Documents) Validation Plan (Scope, Objectives, Roles & Responsibility, Activities & Deliverables, Criteria, Management Issues, etc) Traceability Matrix (Links & dependences between RAR Mitigation/Corrective Actions FRS v/s Testing, SDS v/s Testing, Findings v/s SOP, etc) Functional Requirements Specification (Main Document, User s Process Flow, Blue Print, SAP Manuals, Configuration Documents, Customization Documents, SAP s Projects Documents, SAP Guides, List of Transactions, Process SOP, System s Working Instruction and Application Manuals) System Design Specification (System general architecture, Specific Connection /System Mapping scheme, Technical document of the equipment, general connection scheme, SOP for system management & maintenance, document for SAP standard installation reports, )list of installed components, SAP environment s general documents and History, basic IT Dept. Working instruction & rules, Development Environments rules and document), etc Document for Testing (Test Plan, SAP Unit Test, SAP Module & Integration test, SAP?s Installation Test Summary, Installation Qualification, Operational Qualification, Performances Qualification) Summary Report (Activity Detailed Report, List of Deviation, Open Issues, Action/Validation Plan for future steps Upgrade) Optimising Existing Project Document, Integrating what is missing up to the sufficient level to describe CRITICAL SYSTEM FUNCTIONS and to test them 16 8

9 Document Hierarchy Risk Assessment RAR-XX Statu s Version Date Action Plan RAR-XX CA XX CC Validation Master Plan Approach, Scope, Responsibility, Deliverable, Criteria, Remediation Steps Draft Scheduling Traceability Matrix RAR-XXX- YYY CAXX X OWNE R Detailed Scheduling Procedural Remediation SOP Description Owne r Statu s Technical Remediation Description Obj. Note Working Instruction Code Statu s Version Change Code Statu s Version SDS System Design Technical Doc. Technical Doc. Description Code Code Type Scop e Statu s Statu s Link Version Version FRS Functional Requirements Descriptio n Process Block Diagram / Flow Chart Transactio n Manual Cod e Cod e SAP Nam e Code Type Type Transactio n Desc. Desc. Versio n Owner Versio n Versio n Status Link Link Lin k Installation Qualification OCASA Code Scop e Descr. Condition s Expec. Result Result Operational Qualification OCASA Code Statu s Version Date IQ Report Results Comments TO DO OQ Report Results Comments TO DO 17 Project Start 18 9

10 Project Monitoring Nombre actividad Duration Start Finish Predecessors Preparacion Documentos de 15 d Mon 23/07/12 Fri 10/08/12 Validacion Preparacion FRS e SDS Start Up 1d Mon 23/07/12 Mon 23/07/12 10 Desarrollo FRS 10 d Tue 24/07/12 Mon 06/08/12 12 Desarrollo SDS 10 d Tue 17/07/12 Mon 30/07/12 Revision FRS e SDS 4 d Mon 30/07/12 Fri 03/08/12 Risk Assessment P11 y Analisis SOP 2 d Wed 01/08/12 Fri 03/08/12 19 Project Monitoring Nombre actividad Duration Start Finish Predecessors Etapa de Testing 19 dmon 13/08/12 Thu 06/09/12 Desarrollo IQ 3 d Mon 13/08/12 Thu 16/08/12 16 Desarrollo OQ 5 dmon 13/08/12 Mon 20/08/12 15 Ejecucion IQ 3 d Thu 16/08/12 Tue 21/08/12 Ejecucion OQ 10 d Tue 21/08/12 Mon 03/09/12 20 Preparacion PQ 2 d Thu 30/08/12 Mon 03/09/12 21 Cierre de las Actividades 2 dmon 03/09/12 Wed 05/09/12 Interim Validation Report 2 dmon 03/09/12 Wed 05/09/

11 Project Highlight Significant ITEM DATA Users 600 SAP Modules Fi-Co, TR, SD, MM, LO Managed Environment DEV, QA, PROD Sites Managed 7 (actual + future) Total Transaction Active 138 Total Transaction Customised 14 Totale Critical Transaction 37 (Impact GMP) Document Prepared 25 Consultant Team 2 Full Time 3 Part time Customer s Team 4 Full time (70% time equivalent) Key Users ONLY for Revision Project Duration 3 months 21 ERP Validation AX Validation Approach 22 11

12 System Configuration 23 System Architecture Dynamics R. 8 (2009) AX PHARMA CUSTOM APPLICATION Especialización Industria Desarrollos Terceros Desarrollos Propios Configuración Corporativa Fundamentos (Best Practices) El esquema representa la Estructura Lógica de un ERP Corporativo. MS Axapta 2009, Especialización Industria, y Paquetes de desarrollos de terceros representan la Capa de Software instalado dentro de la suite comercial de Microsoft. Desarrollos Propios y Configuración son configuraciones específicas de un Cliente realizadas dentro del entorno MS para cubrir las Mejores Prácticas disponibles

13 How to Proceed Identify the Process Model (Process Flows / Process Mapping) Use the existing Information Involving the Key Users and the IT Applying the Risk Analysis to identify the Real Impact and the Real Criticality, and to put in place additional controls &/or corrective actions Verify the applicability of controls and corrective actions depending on the structure, internal capabilities and impact on business processes 25 BPM Methodology Applied to the Project HOW What kind of Process are executed? What kind of Scope? Consistency? GMP Impact? WHY The Process is done in this way? It s critical? I need to control here? Are there additional control? FIX FIX TO DO IT BETTER Short Term Improvement / Procedures Minimize impact Business Process Management D Design M Model E Execute M Monitor O Optimize Validate/ Control IMPROVE Identify Test Execute test Consolidate, Report, identify Open Issue Set Change Control Procedures Set PQ Long Term Close Open Issues Change Management 26 13

14 Using Risk Based Approach METODOLOGÍA DEL ANÁLISIS DE RIESGO La metodología del Análisis se aplica de acuerdo con los siguientes pasos: 1. Mapeo de Procesos (GxP) 2. Identificación de Funciones Criticas 3. Identificación del Escenario de riesgo 4. Evaluación de probabilidad 5. Evaluación de severidad del impacto 6. Asignación de clasificación al riesgo 7. Evaluación de la probabilidad de detección 8. Asignación de prioridad al riesgo El riesgo está basado en la identificación de un Evento o Escenario de Riesgo. Para cada amenaza al sistema, se identifica un posible evento de riesgo, relacionado con una operación-no correcta y/o una potencial corrupción o incumplimiento GxP de los datos que se manejan. Los posibles eventos relacionados a un mal funcionamiento del sistema se listan en el Risk Assessment Report. A cada riesgo se asocia una acción correctiva que va a impactar en la validación del sistema. 27 DOC Hierarchy RA - Risk Assessment RA Datasheet RA Report (RAR CA) Collected Lists & Documents VP Validation PLAN RA Results Scope, Objectives Roles & Responsibility Activities & Deliverables Criteria Management Issues Draft Scheduling TM Traceability Matrix RAR CA Type Description Owner Status Reporting/TO DO PLAN SDS System Design Specifications System general architecture Equipment Technical Datasheet System s SOP Standard installation reports System Installed components System environment s IT Working instruction & rules FRS Functional Requirements Specifications Main Document User s Process Flow, & Blue Print Manuals Implementation Project Documents Configuration Docs Customization Docs User s SOP, Application Manuals IQ Installation Qualification SDS ref. & IQ CODE Scope & Description Test Conditions Expect. Results Collected Result Report OQ Operational Qualification FRS ref. & IQ CODE Scope & Description Test Conditions Expect. Results Collected Result Report System Risk Based Assessment & Remediation Planning/Controls System Description System Testing PQ Performances Qualification Process Item / Process Flow Id. Process Description Scope of Test & Description Test Conditions Expect. Results Collected Result Report 28 14

15 Stage & Gate & Responsibility Matrix G -1 Kick Off Assessment G 0 Mapping & G 1 Plan Dynamics Validation Dynamics Validation G 2 Interface Validation G 7 Final Interim Validation Report Mes 0 Time Line Mes 6 29 Project Highlight Significant ITEM DATA Users 200 AX Functions Production, Warehouse, Quality Control, Maintenance, Quality Assurance, Dispensing, ecc. Managed Environment DEV, PRE Sites Managed (2 + Corporate Standard) Total Funcionalities Active Total Funcionalities Customised + 25 Total Critical Funcionalities +150 (Impact GMP) Document Prepared 14 Consultant Team 2 Full Time 2 Part time Customer s Team 10 Part time Key Users (50% time equivalent) Full time IT Project Manager (70% time equivalent Project Duration Phase I 3 months 30 15

16 Computer System Validation General Considerations 31 Lesson Learnt Using Risk Based Approach to Identify Critical Business Processes and preliminary evaluating Business & GMP Impact the for all Critical key Process Steps has produced a significant impact (validation effort focused and reduced by around 40%) Using the deep Knowledge of the customer s IT Team, according type and contents of technical document allows to work in parallel, sharing and improving on both sides system s knowledge and project controls The Consultant Team support Protocol Preparation very well supported by the Internal QA, Tech Team and Key Users, working in parallel using best knowledge on both sides to make the activity faster, time effective and more complete. User team develop and prepare SOP and working instructions to support Validation and testing; During the Project an AUDIT has been supported; The Consultant Team act as a Tutor / Supervisor, while the Customer s Team obtain System and Project Ownership 32 16

17 Benefit of Compliance Comply International Rules show Innovation, Knowledge & affordability, and it s a Powerful Business Item Design an Qualifying Process, Systems & Plant in compliance with FDA or EMA requirements, means that the Product, once ready to export, are compatible with the most restrictive international rules; A structure prepared to manage qualified process means reduction of Technology Transfer Time, both IN & OUT; An Integrated QMS, supported by Qualified Processes & Systems, reduce Inspection Risks and Inspection Preparation Time; Qualified Processes means reduction of Registration Time A Full Compliant Plant increase Group Trust and Group Visibility

18 Muchas Gracias por su Atención Gilberto Rossi Leandro Mbarak