Siddhartha Gigoo 

Pharmaceutical companies are leveraging information technology (IT) to reduce the cost and time to discover, manufacture, and market their products. The industry faces significant pressures to bring low-cost, high-quality products and therapies to market despite rising development costs, including rising costs to comply with complex regulations. Remediation of IT systems as a result of nonconformances to quality and compliance requirements has significantly contributed to this cost escalation.  

Outsourcing IT-related work across the value chain is proving to be an effective strategy for reducing costs. Increasing regulatory pressures are driving companies to focus more on quality and compliance, which are becoming the key business drivers for necessary investments in the right technologies. Companies are investing more in IT to improve operational efficiency, enable business innovation and transformation, and at the same time reduce compliance costs and effort. Improving efficiency and productivity thus have become the supreme drivers for outsourcing and offshoring IT work to vendors and external service providers. 

As a result of investments in new tools and technologies, pharmaceutical companies are bound to see the cost of meeting regulatory compliance requirements increase. Emerging trends suggest strong investments in bioinformatics, clinical trial management systems, application development and maintenance, upgrades from legacy to modern systems, electronic regulatory submissions, sales force automation, content and document management, and scientific and technical communications. Validation and qualification thus become critical to quality requirements. Regulatory compliance then becomes a top-management propriority, and pharmaceutical companies are increasingly aligning their IT strategy with regulatory compliance needs. 

Regulatory compliance: industry perspectives

To meet the challenging demands in IT, pharmaceutical companies are engaging IT vendors and service providers to benefit from offshore services and end-to-end solutions. For example, Six Sigma improves productivity, digitized processes help reduce cycle time, and outsourced network and infrastructure management and application maintenance can boost efficiency and enable business innovation. With safety and quality as the prime imperatives, companies are required to adhere to various regulations that govern the manner in which IT is used in product development and manufacturing. Good clinical practices, good laboratory practices, and current good manufacturing practices (collectively known as GxP) such as Computerized Systems used in Clinical Trials, General Principles of Software Validation, 21 

 Part 11 Rule on Electronic Records and Signatures, Computerized Drug Processing, and CGMP Applicability to Hardware and Software are legally binding (1–4). In addition, the International Conference on Harmonization (ICH) combines the regulatory authorities of United States, Europe, and Japan in efforts to achieve greater harmonization in the interpretation and application of technical guidelines and requirements for product registration.  

Positive strategies include devising best practices to avoid noncompliance in IT systems, standardization, streamlining business processes and a risk-based approach toward validation of information systems. Mature pharmaceutical companies view regulatory compliance as not only a legal requirement but also an ethical requirement and a part of good business practice. A culture of quality and continued compliance essentially ensures that risks are minimized and quality is not compromised, which in turn yields lasting business value and builds up investor loyalty and faith. 

Given the complex regulatory pressures, pharmaceutical companies are expected to spend more on regulatory compliance needs in the future. Chief information officers and chief financial officers are being asked to demonstrate business value to justify IT investments. It is difficult to measure the return on investment from regulatory compliance activities because it is almost impossible to prove the consequences of noncompliance when they have been successfully averted. Nonetheless, one of the major challenges for the industry is to adopt cost-effective processes and methodologies to achieve and sustain compliance. 

The pharmaceutical industry has started to accelerate the outsourcing and offshoring of IT work such as application development and maintenance to vendor companies. By outsourcing, companies expect to reap substantial cost savings in business areas such as IT-enabled drug discovery; clinical data management; IT infrastructure support, application development, and management; and scientific communications. Besides benefiting from cost savings as a result of the so called labor arbitrage, such companies expect their resources to focus more on innovation-led core business operations by having IT vendors look after and worry about IT-related needs.  

Pharmaceutical companies expect IT vendors to help them achieve their regulatory compliance–related goals at low costs. An ability to deliver cost-effective and efficient IT services that meet regulatory-compliance requirements is the key for vendors and external service providers to win IT outsourcing contracts from companies. 

IT vendors must view regulatory compliance as a critical lifeline in successful execution, management, and delivery of IT and business solutions and services to pharmaceutical companies. Of late, pharmaceutical companies have started evaluating and selecting IT vendors on the basis of their credentials in compliance services, which include focus, proven capability, and experience in compliance areas such as managing validation, qualification, and data privacy. They consider such elements as critical differentiators when awarding IT outsourcing contracts to vendors.  

IT vendors and service providers also are being exposed to regulatory compliance pressures. FDA expects IT vendors that provide services to pharmaceutical companies from vendor sites to comply with regulations and prepare for future FDA audits. The intent is to increase the monitoring of project operations at vendor sites. Therefore, compliance is a critical requirement for vendor and service provider sites.  

				Vendors that develop and maintain IT systems for regulated companies from their sites must be aware of their responsibilities as prescribed in FDA's Compliance Policy Guide (CPG) on Vendor Responsibility, which makes vendors "liable, under the Food, Drug and Cosmetic (FD&C) Act, for any violation attributable to intrinsic defects in the hardware and software" (1). According to the guide, "Vendors may incur liability for validation, as well as hardware/software maintenance performed on behalf of users."			

IT infrastructure qualification and system validation are among the most critical requirements in regulatory IT compliance. One of the most important challenges for a vendor is to manage its IT infrastructure and systems in a qualified and validated state to meet necessary regulatory requirements for software development and maintenance at vendor sites.  

FDA regulations, as published in documents such as 

Computerized Systems Used in Clinical Trials

General Principles of Software Validation,

 dwell largely on software applications and do not directly mention IT infrastructure. 

) Part 11 (Electronic Records and Electronic Signatures) is an umbrella regulation covering all predicate rules for good clinical practices, current good manufacturing practices, and good laboratory practices. Part 11 mentions computerized systems as well as software applications such that any computerized system in its entirety is subject to the regulation. FDA defines a computer system as:    “a functional unit consisting of one or more computers and associated peripheral input and output devices, and associated software, that uses common storage for all or part of a program and also for all or part of the data necessary for the execution of the program; executes user-written or user-designated programs; performs user-designated data manipulation, including arithmetic operations and logic operations; and that can execute programs that modify themselves during their execution. A computer system may be a stand-alone unit or may consist of several interconnected units.”  

 is defined as a unit that includes hardware, software, peripheral devices, personnel, and documentation such as manuals and standard operating procedures (SOPs). It is based on an infrastructure made up of data centers, servers, workstations, routers, switches, firewalls, applications, and protocols. 

 Part 11 rule suggests that "any decision to validate computerized systems, and the extent of the validation, takes into account the impact the systems have on its ability to meet predicate rule requirements." The effect these systems may have on the accuracy, reliability, integrity, availability, and authenticity of required electronic records and signatures must be considered. Further, the rule states that "even if there is no predicate rule requirement to validate a system, in some instances it may still be important to validate the system." Although this rule does not seek to establish "legally enforceable responsibilities," the industry has witnessed a few cases in 2005 where FDA issued warnings to a regulated firm citing noncompliance to Electronic Records and Electronic Signatures (ER,ES) requirements (specifically, pointing out a lack of validation in a computer system as a grave risk).  

Therefore, the entire IT infrastructure stands influenced by 21 

 11, thereby making it fall under the ambit of regulatory scrutiny. Qualification of IT infrastructure thus becomes essential to the validation of computerized systems. IT infrastructure houses and sustains validated systems; therefore, the sole purpose of infrastructure qualification is to guarantee and safeguard reliability, security, and business continuity. IT infrastructure, if not maintained in a demonstrable state of control and qualification, may affect the validated status of GxP applications or electronic record systems that depend on the infrastructure.  

Understanding IT infrastructure qualification

When outsourcing work to IT vendors, one of the foremost points that pharmaceutical companies look for is whether the vendor company has facilities that are capable of meeting FDA requirements for qualification and validation. Companies expect that infrastructure, third-party, or proprietary tools used in project execution are qualified and validated to meet prescribed FDA guidelines. And vendors are asked to demonstrate evidence that they can develop, operate, and maintain IT infrastructure and systems in a validated and qualified state.  

In a GxP environment, qualification of IT infrastructure and validation of applications are required. Qualification ensures that desktops, platforms, servers, networks, routers, switches, and so forth are maintained with controlled and repeatable processes. In many cases, qualification extends beyond IT infrastructure such as networks to include processes, procedures, day-to-day operations, and personnel. Nonetheless, the level of effort required to qualify IT infrastructure should be proportional to the complexity and value of the information assets it supports and the risk it poses. 

				FDA considers software validation to be "confirmation by examination and provision of objective evidence that software specifications conform to user needs and intended uses, and that the particular requirements implemented through software can be consistently fulfilled" (5).			

In a GxP scenario, validation is the process of demonstrating that any "entity" used in the process of drug development is suitable for its intended use and performs the functions that are expected of the entity. Computer system validation provides documented evidence substantiating the performance of the entity in question. 

For drug-regulated systems such as software that generates toxicology study reports, validation is mandated, and IT infrastructure that supports such a software application must be qualified. Companies make a business decision to validate systems based on the risks that are attached to systems; these are risks that can affect product quality, data integrity and reliability, information security and other critical elements in the drug development business process. Many companies validate all systems and infrastructure thinking that this is a good business practice, the right thing to do, and that generates goodwill in the industry, restores confidence, and promotes faith with the regulatory agencies and inspectors besides fostering a culture of quality. This approach can lead to a benchmark in of itself and set high standards in the industry in addition to becoming a best practice that results in long-term tangible benefits for the company and its customers. 

 applies to applications and software, whereas 

 applies to IT infrastructure such as platforms, operating systems, networks, and so forth. The primary goal of qualification is to ensure utmost quality in performance and operations of a system. Qualification processes are required to maintain qualified infrastructure, which will accommodate the operation of validated computer systems. The qualification for IT systems and infrastructure as determined by FDA are: 					

installation qualification; that is, a system is installed and configured to specifications. This is the process of establishing documentary evidence that a respective system is installed and configured to the manufacturer's specifications.

operational qualification; that is, a system performs according to specifications and requirements (intended use). This is the process of establishing documentary evidence that a respective system functions and operates according to a provider's (manufacturer, developer, or vendor) design intentions and throughout its intended operating range.

Controlling processes and systems is the key element in qualification and validation. Demonstrating evidence of such control in the form of current and approved documentation that is strictly followed is the key to success in meeting evaluation and success criteria. 

Nonconformance may threaten data integrity. Compromising the integrity and security of clinical, health, and drug-related data that exists on systems could lead to bad decision-making that in turn could pose a serious risk to consumer and patient safety. Moreover, a lack of infrastructure qualification may lead to risks of unreliable data, data corruption, missing system controls, no control over risk factors, an inability to base anything on results, and disqualification and rejection of a system's regulated data during an inspection. 

The sidebar "Excerpts from FDA Warning Letters" provides some insight into the areas that were closely examined during site audits in 2004. 

Qualification: vendors must plan and invest

Blind adherence to mere checklists, misinterpretation of regulatory requirements, and poor and inadequate documentation can lead to a failure to meet compliance objectives effectively.  

The following are a few questions that prospective clients generally ask vendors in requests for information or while on due diligence visits: 

Does your company have a defined infrastructure qualification and system validation policy? Can you develop and maintain our systems to meet validation requirements?

Is the infrastructure (data centers, servers, routers, switches, operating systems, databases) at the vendor site qualified? 

Do you have SOPs for predicate rules, data privacy, change management, physical and logical security, and business continuity planning?

IT services companies that are ISO- or CMM Level 5–certified have well-defined and documented IT processes and procedures for software development and infrastructure management and maintenance. Their lack of tailoring procedures and guidelines for meeting GxP-critical FDA compliance requirements, however, may pose a problem. Many IT vendors do not have defined processes for computer system validation and infrastructure qualification. There could be inadequacies in computer system validation and IT infrastructure qualification documentation, and certain specific processes required for validation and qualification may not be that well enforced. 

During prospect engagement discussions, vendors should be ready to answer questions about qualification and validation. They must be conscious of the importance of such investment in making their IT infrastructure qualified and systems validated, which may call for some business decisions. In the long run, such investments will yield good results for vendors in terms of repeat business from customers and ensuring competitive business advantage. It will also help vendors showcase regulatory compliance prowess to pharmaceutical clients. Chief information officers and chief financial officers of vendor companies will have to plan for such investments in IT quality, particularly for drug-regulated industries.  

The ideal solution for vendors to meet compliance requirements in a cost-effective way would be to adopt a risk-based approach. This would call for a risk assessment, gap analysis, and remediation plan. The risk-based assessment must map to FDA regulations about software validation and predicate rules on GxP and 21 

Risk-based qualification of IT infrastructure

Qualification traditionally has been a time-consuming, document-intensive, and costly process for pharmaceutical companies as well as IT vendors. Of late, the pharmaceutical industry has begun to approach qualification from a risk-based perspective, with the sole objective of cutting non–value-adding processes that do no impact system reliability, quality, or data integrity in any way.  

A risk-based approach to qualification and validation processes involves implementing a validation regime based on risks posed to systems. It also helps in right-sizing the level and effort required for qualification and validation purely based on risks, criticality, and potential business and regulatory impact. Risk-based qualification involves identifying, understanding, evaluating, controlling, and monitoring risks that IT infrastructure poses to software applications that support the drug development process or a business process supporting product development. Such risks associated with the IT infrastructure could directly or indirectly affect product quality, safety, data, information, business process, and so forth. Size and complexity of the IT infrastructure and influence on quality or business process are important elements in such a risk assessment. Vendor companies should publish policies about qualification that identify which methods would be undertaken to qualify IT infrastructure, facilities, and equipment such as data centers, networks, servers, platforms and desktops.  

Risk-based qualification and validation help manufacturers determine the coverage, level, and effort on the basis of elements, including but not limited to: 					

the type of the equipment and assets it supports (

the effect and risk to applications that are involved in pharmaceutical product development;

Articles

During the past decade, the pharmaceutical industry has increased its use of information technology (IT) in research and development, production, and commercialization of pharmaceutical products. IT systems must be operated and maintained within a compliance-oriented framework to minimize risks; maximize safety and security, integrity, accuracy, reliability of information; and maintain product quality, For IT vendors and service providers, meeting requirements for qualification and validation calls for substantial investments in terms of creating capability, expertise, and resources. The author discusses the implications, challenges, and solutions in managing IT infrastructure qualification and validation in an FDA-regulated environment, particularly at vendor sites.