essential guide to fda

8/13/2019 Essential Guide to FDA

1/33

Selecting, Implementing,and Using FDA ComplianceSoftware Solutions

EtQ, Inc.THE LIFE SCIENCES GUIDEBOOK


2/33www.etq.com 800.354.4476 [email protected] Life Sciences Guidebook: Selecting, Implementing, and Using FDA Compliance Software Solutions

Table of Contents

Introduction: Why do We need QMS?

Getting on the Quality Management Software Soapbox. . . . . . . . . . . . . . . 1

Getting Started on Your Journey

8 Simple Rules for Selecting a Quality Management Software System . . . . . . . .

Look Under the Surface: 4 Things to Ask a Compliance Software Vendor . . . . . .

Tips for Implementation Success

Build vs. Buy: Best-Practice QMS Solution over Custom Development . . . . . . .

Avoid Scope Creep in Enterprise Software Implementation . . . . . . . . . . . . .1

Why Marketing is Important for Your Quality Management System . . . . . . . . .

Risk Management in QMS

The Importance of Risk in the Complex Quality Lifecycle . . . . . . . . . . . . .

Risk Assessment: Creating a Risk Matrix . . . . . . . . . . . . . . . . . . . . . .

Regulatory MattersFDA Compliance in Quality Management

Using Complaint Handling Software to Improve Quality . . . . . . . . . . . . . . .1

3 Reasons to Adopt Automated Validation in Quality Management Systems . . . . .2

GMP Compliance that Spans Enterprises: Supply Chain Compliance . . . . . . . .

Using Quality Management Software Tools to Manage Recalls . . . . . . . . . . . .

The Bill of Compliance in Quality Management: The Quality Hub Concept . . . . . .

Final Thoughts: Fun Takes on Quality Management

The Hitchhikers Guide to Quality Management Software . . . . . . . . . . . . . .2

What Star Wars Can Learn from Quality Management Software . . . . . . . . . . .2


3/33


4/33

2 |

www.etq.com 800.354.4476 [email protected] Life Sciences Guidebook: Selecting, Implementing, and Using FDA Compliance Software Solutions

The Fallacy that Software is too Expensive: Much like theadvent of standardize parts in the automotive industry, havinga configured system that has all the components developed outof the box has driven the price point down considerably. Onesolution can satisfy many different organizations needs, andso companies can now get into a decent enterprise software

product for a fraction of the cost 10, even 5 years ago.

The Fallacy of the In-House Maintenance: Another issuethat comes up with many smaller businesses is a small IT foot-print. They cannot manage yet another system, and IT will notadminister the system for them. Thanks to the advent of cloudcomputing, we are seeing this paradigm slowly fade. Software asa Service (SaaS) is growing in exponential fashion, and it enablesa small organization to get into the game with little to no admin-istrative IT footprint. Much like we use Facebook, Pandora, andLinkedIn in our personal lives, so too are professional softwaresolutions coming into the fray. Applications that are delivered in

the cloud and are paid as a subscription are enabling smaller busi-nesses to enjoy the benefits of enterprise Quality Managementsolutions, without having to dedicate specific resources or signif-icant cash flow to a single tool. Pay as you goits the way of thefuture.

Everyone resists change. Most often, the larger companies will behe ones to take the first step, and sometimes the innovators inhe industry, regardless of size. Mainstream adoption often comes

when it becomes easier to make the change from one system (or noystem) to an automated software tool. With flexible, configurableolutions that can be deployed in-house or over the Web, change

ecomes easier, and more and more small to mid-sized organiza-ons can enjoy the benefits of the solutions in the market today.

What are the Obvious and Not-so-ObviousBenefits to a QMS Solution?As with anything, you often find that your goals change over time.This is also the case with an enterprise Quality Management SystemQMS). Many will enter into an investment in a QMS with very specificoalsimplement Document Control and Corrective Action, andhen as they see more value, they see more potential in the software.

You get the core needs covered, and then as that is runningmoothly you begin to look for ways to make the software work forou elsewhere. Thats what its forit makes your job easier. Thebvious benefits are:

Time-savings: Lets face itmanually processes are time-consuming. Chasing paper is not what youre in Quality for. Youneed to be able to free up as much time dedicated to ensuringthe Quality and Compliance of your operation. Software canprovide that time-savings through automating processes, inte-grating with other business systems, and fostering better visi-bility and collaboration throughout the business.

Return on Investment:5. Theres not doubt that software is ainvestment. From the small desktop solutions to the enterprisesystems, there is an investment to be made. The return on thatinvestment is where the difference is made. If you can reduceyour Corrective Action cycle time by 50%, and youre able tfocus on the issues that matter most to organization, then youve

already seen the return. The key here is to ensure that youvemaximized the software to realize that return.

Then there are the not-so-obvious benefits.

Rapid Application Development:6. As a Quality professioyoure not in the business of building applications. But to theearlier point, software these days is less developing and moreconfiguring. Many organizations are leveraging the workflowbased platforms to extend the software to more areas of thebusiness. Take the Environmental Health and Safety (EHS) systemfor examplemany Quality systems have similar functions to

that of an EHS system. If you can leverage your existing solutioin Quality, and create a similar set of modules for the EHS teamyouve not only doubled the power of the software to anotheroperational area, but youve also created another hero momentfor you and your team. Many organizations have become a centerof excellence due in part to their use and innovation into otherareas like EHS, HR, PLM, and Supplier Management.

Enterprise Risk Management:7. QMS solutions that incorporrisk are unique in that the risk concept transcends Quality. Risk is acompany-wide issue. Youve heard the mantra, Quality is everyones responsibility. Thats a nice statement, but often Quality

is really only the responsibility of the Quality departmenVery few outside of Quality actually speak Quality, so there a disconnect. However, everyone in the company speaks riskBy using risk as a benchmark, you are translating your Qualitactivities into risks and opportunities that the entire companycan understand. Enterprise Risk is a function that can come fromQuality and be extended to the entire organization. Along withthat, a risk-based QMS can be extended to encompass the entireenterprise, thereby becoming an Enterprise Risk Management(ERM) solution.

Whats Your Price? Moreover, whats Your

Price Not to go with QMS?How much to pay for an Enterprise Quality Management solution?Again, when we look at this, we have to discuss in terms of not pricepoint, but also investment and return. How much is an automatedsystem worth to your organization? Typically enterprise systems wilnot be cheap, but the key is to do your due diligence and examineyour current as-is and the potential to-be by implementing asystem. Configurable systems and systems hosted in the Cloud willbe offered at a reasonable price, and as these systems become moreflexible and easily deployed, you will see the price points go down

Getting on the Quality Management Software SoapboxIntroduction: Why do We need QMS?


5/33

3 |


Consider the following examples of Return on Investment (ROI):

Case: One Life Sciences consumer goods company was usingover 500 systems to manage both Quality and EHS (QEHS)processes. This varied in range from spreadsheets to enterpriseERP systems, across all of their global applications. Managing

500+ different sources of data left them with a disparate viewof their QEHS. They decided to make the investment in an auto-mated solution, and thanks to the benefits listed above, theyvereduce the 500+ systems down to a single system. Regardless oftheir actual investment cost, the benefit of having a single sourceof the truth has been an overwhelming return.

Case: A Blood Services organization had a manual Qualityprocess that tracked their Quality Control (QC) data. Since thiswas a manual process, the time it took to manage and review theQC data was roughly 45 days to completion. Once they imple-mented an automated system, they have since reduced this time

to less than a day for the same process. Less than a day! Theyestimate the time saved to be near 650 hours of labor. This is aperfect example of time-savings as an ROI metric.

Scalability: Cant We All Get Along?One key area that needs to also be mentioned is scalability. We noonger live in a single siloed world. Companies have multiple facil-ies, each with their own unique processes relative to the corporatetandard. Everyone operates in their own way that works for them, andmplementing a software system should not force them to change.

QMS needs to be adaptable to the business processes for each linef the business, but also conform to a corporate standard. So the

uestion becomes, how can we all be unique in our processes, butonform to the common corporate platform? QMSs are evolving toddress this issue. It used to be that for each site, a separate instancef the software needed to be installed and maintained. If you have0 sites, then you would need 30 systems, each with their owndministration and workflows. No longer is this the case. Flexibilitys now extending beyond just the processes and workflows, but alsonto the locations in which processes are located. With flexibility byocation, you can log into the system from your site and see all theelevant workflows, coupled with some of the corporate standard

workflows. They become one holistic workflow that can vary site toite, but maintain the relevant data that corporate needs to track.

o in effect, you have a global, holistic solution that can satisfy bothorporate needs and the needs of the individual sites.

Getting on the Quality Management Software SoapboxIntroduction: Why do We need QMS?


6/33

4 |4 |


n a market where high-demand causes organizations to seekoftware systems that will t into their complex business infra-tructure, the pressure to nd the right system often causes angsto many. Coupled with the host of options out there, the pressureuilds. Often, organizations will settle on a system that has mostf the functionality they need, but doesnt provide everything they

want. That being said, here are 8 Simple Rules on what to look forn a QMS.

Flexibility to Adapt to Business Processes: Probably the mostimportant consideration is the ability of the system to adaptto your existing business processes, and be flexible enough tochange and improve as your processes change and improve. This may seem like a simple statement, but many times softwarevendors build their systems around a generic, best-practiceapproach that cannot be changed without substantial time andcost. These vendors want you to adapt your processes to theirsoftware, not the other way around. If your company has spentyears developing and ne-tuning business processes, and uponpurchasing a software system, you nd yourself reengineeringyour proven processes to t within the software systems limita-tions, you have compromised your efficiency.

Do not compromisefind a solution that is truly flexible and config-rable, and can configure all aspects of the software, including work-lows, forms, fields, reports, business rules, even the look and feel.

Configuration should also be easy for non-technical administrators.Graphical tools such as drag-and-drop will enable administrators town the configurations of the system with limited to no programmingnowledge required. In many cases, the cost of changing your oper-tions as a result of an inflexible software package outweighs theost of the package itself. Careful and thoughtful attention to theoftwares exibility is key to a successful implementation.

Web-based versus Web-enabled: The Internet has madethe world much smaller. Organizations are building intranetsand extranets into their global network, and the need to havesystems in place that not only utilize the Internet but also thrive

on it is key to success. Following this lead, enterprise softwarevendors are building tools that move away from the old client-server models to a thin-client interface, allowing for more flexi-bility in a global environment. There are software vendors thatare Web-based and some that are Web-enabled. Knowing thedifference between the two can provide a key differentiator inyour selection of the system.

Look and FeelMaking the System Your Own:3. One ofmore overlooked issues when selecting the software is the abilityto brand the system with your organizations look and feelWhile many ask whether the system can be configured to meettheir changing needs, the ability to change the colors, logos,fonts, and general layout of the navigators, forms and reports isusually an afterthought. Many systems will offer some level oconfigurability, but this will usually not extend to the layoutsthemselves. End users must contend with the vendors look-and-feel, which will be foreign to them. The ability to control aaspects of the softwares user interface helps user-acceptance ofthe software, and user buy-in is one of the major contributors toa software implementations success. In the age of Web-basedapplications, vendors can demonstrate flexibility by complyingwith Web user interface standards. Furthermore, they should beable to provide this control without the need to customize thesoftware. When selecting a system, have a well-defined set ofuser interface requirements that will make the system work foryou, and ensure that the system is able to meet those require-ments without having to do extensive development.

Making Sense of the Data4. Reporting and Searching: Wyou automate using QMS, there is an enormous amount of datacreated. Without some means of easily accessing the data, theQMS makes it extremely difficult to derive trends and insighton the Quality system. Users are left to their own devices tomanually filter out the data, or even export the results into anexternal system for reporting. This is a time-consuming effortand can lead to time management issues in finding the data,filtering the data and reporting on the data. Software systems willoften offer some means of search capabilities, but this comes inmany ways and may require administrative intervention. Havingsearch capabilities is often not enoughthe system shouldbe able to search not only at the highest level, but also searchon multiple criteria and search within records, or even withinattachments embedded in records. At the same time, reportingon the data comes in many flavors. Many software vendors

consider reporting an afterthought in the development of theirproductsusually partnering with third party tools to help makesense of the data, but with only limited integration between thetwo systems. Others will embed reporting tools directly intotheir productproviding a more integrated method of pullingdata across records within the system. When selecting a softwaresolution, determine the types of searches and types of reportsyou need to generate, and require that the vendor is able tocreate such searches and generate the reports you need.

8 Simple Rules for Selecting a Quality Management Software SystemGetting Started on Your Journey

8 Simple Rules for Selecting a Quality ManagementSoftware System


7/33

5 |


Taking Quality to the EnterpriseScalability Matters: Ulti-mately, your QMS may not serve a single site, especially if yourorganization has multiple facilities. As more and more companiesscale their systems to span the enterprise, it will becomenecessary for the QMS to follow suit. When selecting a softwaresystem, think about the long-term goals on how you plan to

scale. It may not be an immediate need, but having the ability toexpand your QMS beyond your four walls to include other facil-ities, or even suppliers and customers, can make a differencein the systems long-term value. Watch out for false scalabilitypromisessome systems will claim scalability, but have no realexperience in the matter. A scalable system must obviously betechnically capable of handling the load of additional users, butthat is only half of the picture. The scalability of administration isequally important and can be much more expensive to fix later ifnot considered up-front.

ook for customer references that have scaled the system to a level

hat is equal to your business, specically in the ability to delegatedministration to different levels in the organization, across thentire enterprise. Truly scalable systems include location-baseddministration that extends beyond simply managing different userroups, to enabling location-specic congurations and dynamicltering of location-specic data.

Tying Systems Together through Integration: Operationalareas no longer live in silos when it comes to business systems.Whether they are Production, Financial, or Quality systems, theability to interact, collaborate, and coordinate across the businessis key to uncovering any gaps in processes, and creates visibility

from one operational area to the next. It is of paramount impor-tance to be able to integrate your systems.

When looking to select a system, keep in mind the integrationptions available within the solution. Avoid solutions that claimntegration, but will only do basic integration lookups. While this isowerful and eliminates some degree of double-entry of data, truentegration will not only pull data in from production systems, but

will also push data back to those systems, such as nonconformancessues, overall cost of Quality activities and more.

Know Your AudienceEnd User Acceptance: Typically, the

team selecting a software system is made up of multiple areasIT,Quality, Operations, Purchasing, and more. More often than not,the participants are manager-level, and are making the decisionon behalf of themselves and the end users. The end users, whilemost likely the highest volume user, are more than likely notinvolved in the ultimate decision. Many software systems willhave the technology and process management needed, butonce implemented, the end users are lost. It doesnt look familiar;it doesnt look and feel right, and requires significant adjustmentto get used to. Look and feel may not seem like a deal breakerbut it can be a hindrance in the learning curve for many users,

and cause delays in getting implemented and effective. Manysoftware vendors do not come from your industry. In fact, manycome from a technology background, and never take intoaccount the user experience. The result is a software system thatis technologically advanced, but completely un-user friendly.

When selecting a software system, take into account the end usersexperience. Make sure the software can easily be congured to helpthe end userwhether it is familiar forms and layouts, even colorsthat match the corporate look. If you are replacing an existing system,see if you can match the new systems look and feel, even the formlayouts to the old system. This can make the transition much easier,and make the end users more productive right from the start.

Time to ValueImplementation and Deployment:8. Yocovered your needs in terms of the solution and it has all the bellsand whistles your company needsnow what? The solutionneeds to be implemented. This is where, many times, software

selections fail. In fact, in a recent study of over 9,000 softwarimplementations, 71% of them either failed or were late orover budget. Many of these projects cited the implementationproject as a major reason for failure. It is critically important thathe software vendor be able to demonstrate their capability tonot only deliver the solution to you on time and on budget, butdo so in a fashion that lets you use the system as you intend touse itwith all your configurations and best practices built in.

Look for a solution that has a proven implementation method thatinvolves the requirements gathering, the side-by-side collaborationwith their folks and your team, and sticks to an agreed upon project

scope. Furthermore, get your requirements nalized up frontadding new features and functions mid-stream often delays projectsas more time is added to the project to meet these new last minuteentries. Finally, make sure all the stakeholders in your organizationhave had their opportunity to contribute to the requirements phase. This will ensure that all parties are satised before the implemen-tation begins.

These 8 rules of engagement when selecting a software solution(which can really be applied to any enterprise solution, not justQuality or EHS), can have a tremendous impact on how you approachyour software purchases in the future.

8 Simple Rules for Selecting a QMS SystemGetting Started on Your Journey


8/33

6 |6 |


n this day and age, very rarely do people buy anything withoutoing their research. This rings true when it comes to the buyingrocess for enterprise software systems. In many ways, the buyeras so many tools available to research vendors and understand theros and cons, we see a much more informed and educated enter-rise buyer. Web-based research will give you some of the key areaso rate a vendor on, such as:

Market expertise

Features and utilities

Broad company overview

Pricing and support structure

Breadth of applications offered

All these things can be commonly found after some basic research,nd a few discovery demonstrations. However, we still see cases

where a company has selected a vendor, and that vendor continueso fail on their delivery of the solution. You would think that theseailures would be picked up on during their extensive, informedesearch, but there is more to a company than the above bulletoints. Below are some additional considerations to be aware of

when selecting an enterprise vendorthose that go beyond pricing,eatures, and tools.

Implementation Track Record: One of the primary reasons

software implementations fail is a lack of communication andproject management within the implementation team. To put itmore simply, the project scope goes over time and over budget.Often (and especially in the Compliance software market), thesoftware sale draws so much focus, that the service elementbecomes an afterthought. Look for a vendor that has a proventrack record of implementing their solutions successfully, andmake sure to spend some time reviewing their strategy. Properimplementations, whether large or small, should incorporatesome element of project management that involves both

parties. The best way to find out if the implementation methodsare proven is to look for proof from existing customers.

Customer Satisfaction:2. Todays enterprise software buywill no doubt ask for references. Most vendors will gladly turyou towards their go-to reference or load you up with casestudies. And most buyers will discuss the cursory questionsWhat do you like about the software, and does the softwaremeet your needs, etc. When doing your reference call, italso a good practice to delve into some more intangible ques-tions. Remember, enterprise software is not only an investmentin a solution; it can be an investment in the people within thecompany. Questions like What do you think of your accounmanager or service manager, or Do they respond to your needsat this company, or even What is their user conference like wigive you a deeper insight into how this company operates. Thesetypes of questions (which may seem silly at first) add dimensionto the vendor, and also give you an indication of the health andlongevity of the company. You want to invest with a companythat will be around for as long as you continue to work withthem.

Financial Well-Being:3. As stated above, you are investing an enterprise solution and the company behind itits criti-cally important that you feel comfortable about the companysfinancial well-being as well as their product offering. In this daand age, software companies are being bought and sold, and acompanys control is sometimes in the hands of a venture capi-talist rather than a software architect. In some cases, the softwarevendor is a minority shareholder in their own company. Venturecapital investment, loans and lines of credit to keep operationsgoingtruth is, a software vendor may have more debt thanequity. Dont hesitate to get financial information from thevendor.

Look Under the Surface:4 Things to Ask a Compliance Software Vendor

Look Under the Surface: 4 Things to Ask a Compliance Software VendorGetting Started on Your Journey


9/33

7 |


Now many may not be apt to opening their books for you, and thatsinethere are a few ways to get an accurate financial picture:

Search the Web for Investment News:a. Vendors may notactively promote when they are bought or invested in, butthe investors love to talk up their portfolio. Look for press

releases from investors on your vendor, and read carefullyon whether the investment firm is providing capital, oractually purchasing the vendor.

Ask for a Debt to Equity Ratio:b. This is a great way to seethe financial health of an organization without pryinginto their books. The Debt to Equity ratio will indicatehow much they owe versus how much they own. Be waryof vendors with high ratioschances are they may beburning more cash than they are bringing in.

Annual Growth Rate:c. Average growth percentages overa 3-5 year period are nice, but the vendor could havehad one great year in year 1, and the next 2-4 years theydeclined. Compounded Annual Growth Rate provides amore accurate depiction of how the company has faredfinancially over the past few years.

Annual Net Income Growth Rate:d. Another good metricto asses the health of a vendor is to examine the netincome growth, which is essentially the vendors prof-itability. They could have a decent revenue stream, butare they profiting enough to sustain themselves? Netincome will give you an idea if the vendor can stand onits own two feet. These are just some basic ways to under-stand the health of the company. A healthy company thatinvests money back into their product and plans for thelong-term will ultimately result in more product innova-tions, providing you with services for years to come.

Proof of Concepts and Workshops: If you get to a point wheretwo vendors are equally adept, then it might be time to suggesta workshop or proof of concept. These are typically 1-2 dayengagements with the vendor whereby you give them a simpleset of requirements, and ask them to implement it on a smallscale. Its like a test-drive of the system on your terms andusing your processes. What makes it powerful is that you can geta glimpse of how your future relationship with the vendor willbe, and how they work when implementing your solution. Theseworkshops can be time-consuming (and occasionally a pay-forexercise), so reserve this for special circumstances.

Look Under the Surface: 4 Things to Ask a Compliance Software VendorGetting Started on Your Journey

In our world where we have all the information at our fingertips, itssometimes easy to say we know everything. But there are still thosedata points that are not publicly known, and getting the right answerscan make a big difference in your decision. So its important to doyour research and come to the table prepared, but dont be afraid toask for more information on your enterprise software solution.


10/33

8 |8 |


n todays dynamic and demand-driven market, the need tomplement enterprise technology to keep pace with rapidly evolvingperational, production and compliance environments is key touccess. In recent years, enterprise technology has become morerevalent in its penetration of all operational areas within a business.t has become so prevalent that it is rare to find a department withinn organization that does not have a dedicated enterprise softwareolution to provide some level of support.

n the case of Quality, this statement rings true. In recent years,nterprise software solutions have become commonplace in manyrganizations, whether integrated QMS, or Quality Management

modules within larger production systems, even down to simpleoint solutions for Document Control or Corrective Action. Recenteports on top software components for organizations show that

Quality Management is at the top of the list. In many organizations,Quality Management solutions are a strategic priority. As demandor these solutions grow, so does the vendor landscapemoreoftware vendors are providing solutions for Quality and Compliance

Management than ever before.

When determining the strategy for automating a mission criticalusiness process like those in QMSs, a Build versus Buy choiceemains a key decision. Overwhelmingly, organizations have provenhe decision to Buy provides much greater value and success thanhe decision to Build. Here is a Top Five list of things to watch outor in a build versus buy scenario.

Predictable and Transparent Costs: Developing an enterpriseapplication is no small task, especially when it comes to esti-mating the cost of development. When you buy a best-practiceenterprise solution, you evaluate in advance the features, func-tions, and capabilities in an existing enterprise environment. Aknown cost is attached to a best-practice solution. If you builda new system with alternative development resources, projectcosts and time to deploy may range widely, affecting the successof the project.

n fact, according to Gartner Research Group, packaged applica-ons with best practices already built in have found favor withinmany enterprises and are now considered viable choices for manyorporate tasks. In fact, corporate edicts have often been establishedhat preclude even a discussion of the build versus buy process.

Therefore, buying a software package with best practices alreadyuilt in, under all circumstances is the dominant trend.

When evaluating whether to buy or build, its critical to thoroughlynderstand total costs during the software lifecycletypically 7 oryears.

Build vs. Buy: Best Practice QMS Solution overCustom Development

This step is important, because 70% of software costs occur afterimplementation. A rigorous lifecycle analysis that realistically estmates ongoing maintenance incurred by a custom developmentproject often tips the balance in favor of buying.

Flexibility and the Ability to Adapt to Change:2. Busineexperience constant and rapid changes. Companies change theirprocesses, expand or shrink, and competition drives innovationto the market. Application developers often hear although weneeded that a year ago, its not what we need to run our businesstoday. Add in rapidly changing technology and the adaptabilityof a homegrown system becomes an issue, and often a systembuilt in-house becomes obsolete before its complete. A bestpractice configured application is a production ready applicationthat can be customized for a unique environment within a rela-tively short timeframe.

Furthermore, having the flexibility to adapt to changes is key tosuccess in response to changing market conditions. With configu-rable solutions, processes can be changed as needed with little tono additional costs. With custom developed solutions, there is littleroom for changeif change is required, it can result in hundreds ofdevelopment hours and the project overruns can be steep.

Best Practices Experience and Core Business Focus:3. Wdetermining an enterprise solution, it is important to consider

the focus of the organization. How well do the vendors know thebusiness challenges your organization faces? How well versed inbest practices is the vendor, and what is their experience in theindustry? A vendor who is rooted in these best practices has abroad knowledge base of experience to draw from, whereas acustom development from a vendor outside of the industry willbe starting from scratch on how to match your business processesto the application. This can push the scope of the project out,simply because the learning curve on processes and terminologyneed to be collaborated on. Selecting a vendor with a broadbackground on a specific industry like Quality Managemenhelps to provide a foundation for building a process that meets

your requirements, with a long-standing knowledge base ofexperience to draw from.

Consider the Project ScopeProven Implementation versus4.New Application Development: According to a report by tStandish Group on more than thousands of software projects,40% failed completely, and an additional 33% were challenged,meaning that they completed late, went over budget, or werecompleted with fewer features and functions than originally spec-ified. Even more staggering, a recent study by Gartner Research

Build vs. Buy: Best-Practice QMS Solution over Custom DevelopmentTips for Implementation Success


11/33

9 |


revealed that nearly four in ten major software purchases endedup as shelfwaresoftware that was purchased, but neverimplemented.

The root of all these challenges lies in the ability of the project toe defined properly. With custom developed solutions, the project

cope encounters obstacles not foreseen at the outset of the project,nd it is extremely difficult to estimate the time and expense asso-iated with a major development project. This is primarily due toevelopment of new features not inherent within an existing appli-ation or customer developed application, which creates a tendencyo change and modify the scope on the fly. The result, according tohe Standish Group, estimates that 52.7% of all custom applicationrojects cost 189% of the original estimate provided.

oftware vendors with best practices built-in draw on a historyf implementation of similar processes, and have implementedundreds of projects of similar focus and scope. These implemen-

ations follow a proven process, and follow a pattern of projectmanagement that delivers the product on-time and within scope.

Return on InvestmentLook for the Hidden Cost of Devel-opment: While many custom-built applications outline a broadscope for a project, without having a best practice approach it isimpossible to determine how long the project will actually take.Vendors that offer a best practice solution are able to leverageyears of implementation and product development to accuratelyscope out a project and will not incur the same project overrunscustom developed solutions encounter.

Consider the breakdown on build versus buy conducted in a StandishGroup Report, illustrated in the tables at the bottom of the page.

When comparing these two scenarios, we can assign a risk ranking tobuild versus buy, as illustrated in the risk matrix below:

Because a best-practice configured solution requires little to nodevelopment costs and uses a proven method of implementation

to ensure projects are kept on scope, the actual risk associated withimplementing is considered lower than that of a custom-built appli-cation. This is primarily due to the unknown factors that can occurin custom development, as well as long-term costs to update andmaintain the custom-built system.

Avoid the Dangers of Buythen BuildWhen making the decision of build versus buy, its important todetermine the level of development required, in either case. Whilemany off the shelf software systems will claim to have the best prac-tices built out of the box, what is often not determined is any levelof custom development that may be needed after the software is

purchased. Often times, purchased solutions will incorporate a


Comparison: Build Versus Buy


12/33

10 |


ramework of best practices within their solution, but in order toailor the system to meet your needs, the system must be customeveloped. As a result, the customer is left with a purchased solutionhat will need a custom development project added into theurchase, creating the same challenges with a purely built solution.ook for systems that have the flexibility to adapt to specific processes

without any need for custom development. These solutions oftennable the administrator (or Power User) to configure all aspectsf the system to meet unique business needs. Configurable systemsuch as these completely eliminate any custom development needs,nd provide a truly flexible and adaptable system that embodies theurpose of a purchased, best-practice solution.

The decision to implement enterprise software is not a simple task.oftware solutions typically represent an investment of 5-7 years,ften up to a decade for many organizations. When weighing theptions of determining software selection, the Build versus Buyecision is one that will always come up, and requires careful consid-

ration on the path to take for your investment.

While both options have merit, many organizations opt to leveragehe existing best practices implemented within the industry, theroven track record of success and innovation, and the most flexibleechnology that will help them seek returns on their technologyolution. For many, the growing trend lies in purchasing a solutionhat provides the most functionality and features, and presents theowest total risk to the organization.



13/33

11 |11 |


While many companies focus heavily on the softwares ability tomeet the business need, very few focus on the vendors ability tomplement the software. The responsibility of a software implemen-ation project is shared between the vendor and the customer. Whilehe vendor needs to deliver on all those promises they made in the

RFP, the customer needs to make sure that their processes are well-efined, and that all the requirements of the solution are outlinedn detail. Without the roadmap for the solution, the vendor can onlyake a best attempt at meeting the business need. Kind of likehooting a moving target in the dark, blindfolded and with one handed behind the back.

With all the investment put into selecting a software vendor for yourusiness, it is hard to believe that there is any possibility of failure.

However, recent studies have shown that within a sample set ofmore than 9,000 software rollouts, 71% either failed or were latend over budget. Even more staggering, a recent study by Gartner

Research revealed that nearly four in ten major software purchasesnded up as shelfwaresoftware that was purchased, but nevermplemented. The root cause of such pitfalls is usually attributed tohallenges associated with project management, and the inabilityo properly define the requirements to make the implementationuccessful. As a result, the end users never really accept the solution,nd the cost to implement correctly becomes extended.

uccessful projects are the result of the Quality of the solution andhe acceptance of the solution by the end users. As seen in theiagram below, without proper planning and project definition athe start of the project, implementation projects can often suffer inhe long-term. Projects without a defined scope will often requireluctuations in resource levels, and push the project out far beyonds expected completion.

Avoid Scope Creep in Enterprise SoftwareImplementation

Here are just some quick points to consider when looking at animplementation project:

Get the Requirements Up Front:1. While this may seem a no-brainer, many companies wont truly know what theirrequirements are when they start a project. You may have oneor two project managers who swear up and down they knowthe processes, and do not need this exerciseuntil you actuallyget all the stakeholders in a room. At that point, the picture getspainted a different shade of what you thought. Many times, thestakeholders will trickle in during the project after implementation has begun, and this is the source of the evil Scope Creepparadox. The more features we want, the more time it will take,and the more time it will take, the less likely the vendor is todeliver it on time.

By gathering all the stakeholders and clearly defining the project andits requirements at the start, the actual implementation process willmove much smoother. No one is trickling in and all elements of theproject are planned and ready to go. This early investment of time inthe beginning of a project may seem like it would take longer on theoutset, but in reality, this up-front investment of time actually speedsup the project in the long run. Resources are efficiently managed,project timelines are met, and this project is delivered on time andon budget.

Get a Design Specification:2. Whether you are implementia configurable, out-of-the-box solution or a heavily customdeveloped application, getting a design specification is animportant step in the process. A design specification is essentially

Avoid Scope Creep in Enterprise Software ImplementationTips for Implementation Success


14/33

12 |


a simple mock-up, wire frame or depiction of what the finalproduct is going to look like once implemented. These are typi-cally done in phases of the implementation, so that each pieceis given its own design specification. Think of it like building ahouse. You would want to see the floor plan before they startlaying the foundation, and building up the rooms. You want to

make sure the bathroom is in the right place, the kitchen, andso forth. Same goes for the software solutionmaking sure theforms look right, the fields and keywords match your ideas, andare in the right place are very important.

At this point, with the requirements gathered and design specifi-ations in place and approved, then the real implementation canegin. Whether configuration or coding, most implementations

will vary, but ultimately the goals are similar. This is to deliver theinished product according to the information provided in the firstwo points. Ensuring the finished product matches your require-

ments exactly is important, which is covered in the next point.

UATUser Acceptance Testing: Its important to alwaysinclude the end users in the processthey are after all, the dayto day users of the system. Their acceptance of the system willultimately determine whether the new solution is truly a successor not. The UAT phase of the process is like the test drive ofthe new sports carmaking sure that the seats are comfortable,the engine is tuned, and the wheels wont fall off. Just the samein the software worldmove around through the workflowsand forms, push the performance, and make sure the proverbialwheels stay on. This is usually done by the companys projectteam, but many like to take a few of their end users and let them

comment on the system. This is a good practice to get the wordon the street for those daily users.

The theory behind using this project management/requirementsirst approach to implementation is that during UAT, only minorroblems are tweaked. The last thing either party wants is a majorechnical flaw this late in the game.

nvestment in software shouldnt fall victim to a poor implemen-ation. Not only does it leave a bitter taste in the mouths of theroject team, but the software investment becomes diluted andould end up as shelfware. Ensuring the project requirements are

athered at the start, the design is approved before implementingnd testing on the backend will help to make sure the project isompleted within scope and within budget.

Avoid Scope Creep in Enterprise Software ImplementationTips for Implementation Success


15/33

13 |13 |


n the previous chapters, weve talked about the difficulty of change.But, in reality its not necessarily that people have so much of anversion to change, its more about motivation to change.

f I were to give you $1000 to switch to my car brand, you are certainlymore likely. Or, if I associate my energy drink with your favorite sport,hen you might feel compelled to drink my highlighter-colored,ugar-filled beverage. Im talking about marketingthe one thinghat we are exposed to every day. Believe it or not, consumers todayncounter from 3,500 to 5,000 marketing messages per dayso were no stranger to the pitch.

erhaps one of the biggest obstacles in user adoption of a new QMSystem is getting people excited about it. But part of user adoptionnd acceptance is inspiring people to use it. Its one thing to have tose the system, but its a completely different thing to want to usehe system. Here are just a few techniques in how to effectively incor-orate a little marketing into your Enterprise QMS or EHS rollout:

Give it a Good Name: More often than not, the software vendorsname sticks with the company, but there is rarely a clause in theagreement that says you cant rename it. So why not give it a name

that will resonate with your company? One company wanted toeliminate the Quality from its QMS so that employees outsideof the Quality department would be interested. So they renamedthe software, Enterprise Processes for Integrated ComplianceEPIC. Now thats a cool name. Another company didnt eventry the acronym route, they just named it Turbo. Now, whowouldnt want to work in Turbo all day? A good name goes along way.

Dress it Up:2. Most software solutions are flexible and configurable enough to change not only the business processes andworkflows around the tool, but also change the look and feel. Take advantage of this flexibility and brand your solution tomatch your companys colors, logos, and corporate look. Peoplelove to feel at home with a new solution, and having the samedecor helps to ease the transition.

Run Your Own Mini-Launch Campaign:3. Were not talkinbig-budget advertising campaignthis is just a little marketingto get people excited about the upcoming rollout. Again, youretrying to inspire people to excite them about a software imple-mentation. You dont need to be a seasoned marketing exec-utive to run a campaign. All you need is a little slush moneand a printer. Here are just a few ideas to get you going:

Teasers: The best thing about teasers is you dont have to domuch to create a buzz. Innocuous phrases get peoples mindsrunning. In the case of the EPIC launch, this company postesigns all over the office, which looked like this:

Why Marketing is Important for Your QualityManagement System

Why Marketing is Important for Your Quality Management SystemTips for Implementation Success


16/33

14 |


This caused quite a stir in the office, and everyone began talkingbout EPIC. The key is to keep it a secret till launch daythats theease folks!

The Launch Party: This does not need to be a hip-hop rave, nordoes it need to be a black-tie gala. Everyone still has to work

a simple gathering with catered lunch is more than enough.In the case of the EPIC launch, the customer ordered lunch forthe team, had a sign made up and a cake with the EPIC logo onit. Never underestimate the power of free food. They sat...theyate...they saw the new system.

Incentives and Raffles: If you have some extra slush money,maybe you want to invest in a few promotional items or a rafflefor the launch. You can even ask the software vendor for a fewof their incentive items for the launchthey would be morethan willing to help out. Everyone loves gifts, and if you asso-ciate gifts and rewards with your new system, it becomes a plea-

surable experience for the users. Remember the EPIC launch?Yeah, they gave out food, free stuff, and rafflesit was great.What a great system!

Keep the Dialogue Going: Every system launch goes throughits honeymoon period when everyone is buzzing aboutthe system. The key is to keep it in peoples minds, after thehoneymoon is over. Email newsletters are a big help herecreate a monthly newsletter to let your company know whatis going on in the system. This can be company wide or just inyour area. Let them know how many CAPAs were processed,how the system has improved Quality, or where to find the new

Document Control module you installed. Communication helpsto keep your system at the forefront of their minds.

With just a little bit of marketing, you can turn an ordinary QualityManagement System rollout into something special for your team.They worked very hard to get the system up and runningwhy not

little notoriety and fun in return? Youll find that you not only haveewarded your employees for the effort, but youve also inspiredeople to adapt and use your new system.

Why Marketing is Important for Your Quality Management SystemTips for Implementation Success


17/33

15 |15 |


The Importance of Risk in the ComplexQuality LifecycleManufacturing industries have matured over the years, customeremand increases, and the complexity of the products also increases.o we now have a complex product lifecycle that needs to moveaster to keep up with demandmanufacturers must keep pace

with the demand, while ensuring Quality of the product at everytep. The faster we move, the harder it becomes to correct adversevents, and prevent Quality issues in the same way were used to.

We need a measure to help us search out the most critical issues andddress the Quality issues that matter most. Risk Management is ofrowing importance in Quality for this very reason.

ets look at some of the areas risk plays in the Quality lifecycle:

Risk in Design: Incorporating risk in design is a critical, but

sometimes overlooked component in the Quality lifecycle. Tradi-tionally speaking, Quality has always been reactive in natureevents happen and we need to correct them. However, if wecan work towards mitigating risk during earlier stages in theproduct lifecycle, such as in design, then we can mitigate therisk of these in-field failures. Tools like Failure Modes and EffectsAnalysis (FMEA) or simple Hazard Analysis provide the abilityto break down a design into core components and assess therisk of failure. By calculating the risk before the product is evenbuilt, you can take steps to mitigate that risk in a more proactiveway. Even for known risks, you can better prepare your team forpotential post-market events, and handle them more efficiently.

Risk in Process: Corrective Actions are an issue in many orga-nizations. You would think that a system designed to efficientlycorrect a problem wouldnt be a problem itselfbut it can be,especially if every event becomes a Corrective Action. Too manyCorrective Actions can shift the focus on what is most overdue,versus what is most critical. By incorporating risk into the processof adverse events, you can filter the critical and non-criticalevents, ensuring that the highest risk events make it to the topof the list. Less critical events can even be handled immedi-atelyQuality systems do not specifically state that every eventbecome a Corrective Action. Using risk will help to streamline the

system in this fashion.

Enterprise Risk Management: Risk mitigation is everywhere. Ifyou think of an umbrella, the spines that make up the umbrellaare the various risk areas (risk in design, risk in process, safetyrisks, human factors, governance, etc.). The umbrella as a wholeis Enterprise Risk Management (ERM). ERM seeks to combine riskelements from all over the organization and take action basedon those elements in broad strategic level.

In reality, ERM follows a path no different than the more granuladepartmental levels:

Risk Identification:a. Simply put, look for the potentrisks. Whether at a low-level or high-level, you need tfigure out where your risks arise. This can be from adversevents, hazard analysis, departmental surveys, and similaareas.

Risk Assessment:b. Once youve identified the risk, yneed to determine how severe it is. Is this risk high, lowor negligible? Assessment seeks to categorize (and poten-tially prioritize) our risk.

Risk Review:c. New risks within an organization need be reviewed. Risks cannot automatically be assigned anactionoften you need a team to review the risk ranking,determine the next steps, and so forth.

Risk Mitigation:d. We now ask the question, how do wfix this? Risk Mitigation relies on taking steps to correthe events, and ultimately reduce their risk to acceptablelevels. Corrective Actions help to create a plan for investgating and correcting systemic issues, and reduce the riskof recurrence.

Risk Reporting:e. The last step is sometimes overlookebut critically important. Reporting not only creates visbility into top risks, but it also lets you trend out potentiaareas of improvement. Reporting lets you see how oneareas risks overlaps with another areas risks.

As industries move faster and product lifecycles shorten, you needto benchmark Quality not only as a corrective measure, but in aproactive, preventive way. Incorporating risk into the product life-cycle will help to identify, mitigate, and prevent potential risks alongthe way.

You need to identify potential risks, assess the dangers, take steps tocorrect your path to mitigate the risk, and continue on. The fasteryou go, the more risk mitigation plays into the equation.

The Importance of Risk in the Complex Quality LifecycleRisk Management in QMS


18/33

16 |16 |


Risk Assessment: Creating a Risk Matrix

n this day and age, risk is the biggest buzzword in the compliancendustry. Weve talked about it, you cant go anywhere without hearingbout it, and everyones got a risk-based solution. I think the primaryeason why we focus on Risk Assessment and Risk Management, isecause in business, we need to quantify our actions. We can noonger rely purely on gut instinct to execute on events, whether

Quality, Financial, Social, or similar areas. The world moves too fast,nd one misstep can make or break your business. Risk provides thebjective metric to help the decision-making process. But, you needo know how to use risk.

How do you define risk? Its not as easy as you may think. Companiespend plenty of time and money coming up with a scheme on how toalculate risk for their organization. Risk is defined as the systematicpplication of policies, procedures, and practices to the tasks ofnalyzing, evaluating, and controlling risk. All this really means ishat we put tools in place to help us look for risks, assess those risks,nd then take action on the risk. The trick here is finding the risk, isnt? How do we find the risk?

The components of risk usually manifest themselves in two forms:azards or harms. Hazards represent the potential source of a harmfulvent (the cause). Harms are the resulting damages to products,ersons, or the environment (the effect). Risk is essentially cause andffect on a defined scale. Its the scale in which most struggle.

Usually, when trying to quantify hazards and harms, most organi-ations look at two metrics: Severity and Frequency (or likelihood).

Taking these metrics into account, we can develop a scale in whicho measure hazards and their harms. This can be numeric (scale of-5), verbal (excellent to poor) or both. If you were to graph thesecales, you would come up with a numerical matrix, one that high-ghts the risk zones by their multiplied number on the axis, muchke this one below:

You can see that we have a Low-Risk or Generally Acceptable Riszone, and a High-Risk or Generally Unacceptable Risk zone, but whaabout the middle? Theres a gray area of subjectivity here. How docompanies determine this gray area?

This is not always an easy answer. Some companies have to weighthe costs versus benefits on these risks, without creating a dispro-portionate cost to risk (Example: spending $1M to prevent a blisteris disproportionate; spending $1M to prevent a fatality is propor-tionate). Companies will carefully vet these zone, and typically adopta concept called ALARP (As Low as Reasonably Practicable). Simput, this means that the risk is as low as we can possibly get it, or itsTolerable or Undesirablebut it isnt critical or catastrophic. Sthen, with the ALARP in place, you have a risk matrix:

Now you can go off and start using it, right? Well...you need to vetthe matrixput it through real-world historical examples and seeif the risk matrix comes up with the correct risk based on historicalevents. You may need to tweak the matrix based on the vetting

Risk Assessment: Creating a Risk MatrixRisk Management in QMS


19/33

17 |


rocess. Hard mathematics will not properly assess the risk withoutlittle real-world honing. Once youve fine-tuned the matrix, you cantart utilizing it in your Compliance system.

Risk Assessments and risk matrices are wonderful tools to help guideecision-making in an organization, but they are not meant to be

tand-alone tools. They help to provide a guide for Risk Assessment,sing quantitative and repeatable metrics to ensure a consistent

method of determining risk. Most best-in-class organizations willssemble a risk team to go over adverse events and determine theisk. Its up to the team to decide how an event will be handled, and

what the true risk is. Risk matrices are the keys to unlocking quan-tative risk-based processes, but the people are the drivers of theystem.

The next question becomes, How do I incorporate Risk into myQuality Management System? More specifically, how can Risk easehe bottlenecks in an organizations Corrective Action process?

Too often, when adverse events enter an organizations Qualityystem, people are quick to open up a Corrective and Preventive

Action (CAPA). No matter what the adverse event, its severity ormpact, a CAPA is opened up. Having a CAPA system in place is anxtremely valuable (and essential) part of a good QMS. However,f everything becomes a CAPA, then you create a bottleneck.

Employees are so focused on working on their CAPAs, they forget too anything else.

What you end up with is thishundreds of CAPAs, without reallynowing which CAPAs are critical to the business and which haveess impact. It becomes the needle in the haystack conundruminding the critical adverse events can prove difficult if you dontave a way of finding them. I once asked a Quality Manager how heandles CAPAswhat his metric was. We handle the most overdueirst, was his reply, and he went on to say that if it isnt critical and ist the bottom of the pile, then they dont get to it in time. That said,here is a better way.

Risk Assessment: Creating a Risk MatrixRisk Management in QMS

Not every event needs to be a CAPA:1. Yes, its trueif youimmediately correct an event, then correct it. Not every eventneeds to be opened up as a Corrective Action, only those that aresystemic issues and pose a critical impact on the business.

Use Risk to filter events:2. So if not every event needs to be

CAPA, then how do we figure out the bad the from not-so-bad?You need a way to filter these events, and you need to do it in arepeatable, systematic method. Risk Assessment is a great wayto do this. Risk matrices will help your team make the determination as to the criticality of an event. The higher the risk, themore likely we would like to take Corrective Action.

Do a CAPA on your CAPA System:3. Sometimes even a goCAPA process needs a little updating. Make sure to continuallyaudit the CAPA process, and if the process is not efficient enoughthen it may be time to do a CAPA to correct any potential bottle-necks or problems within. Like any good process, a little mainte

nance and trimming is always healthy.Use Risk to Ensure Effectiveness:4. For an action to be trcorrective to the process, it must be effective, otherwise youreback to square one. Much like risk can be used to filter adverseevents, risk can also be used to ensure effectiveness of a CAPARisk helps to ensure that not only is the CAPA effective, buits within the risk limits of your organizations compliancstandards.

CAPA is an effective and essential tool but, like many processes, cabe blocked up if you are too reactive to events.


20/33


21/33

19 |


Data Reporting and Business Intelligence: All aspects ofQuality need to be benchmarked, including Complaints. It is crit-ically important that complaint data be entered in a data modelthat enables reporting, and that Quality Managers can regularlyrun reports on their Complaint Handling system. This helps touncover trends where the problem areas are. Look for better

ways to improve the process, and take actions based on theempirical data.

Change Management Completes the Loop: Collectingcomplaints and taking action on them is one part of the process.Critical to the success of truly improving quality is taking thisdata and applying it to the product lifecycle. Complaint andpost-market feedback is a critical element that has to be factoredinto the next product design. This data helps to build Qualityback into the product design, production and release. LeadingQMS solutions build this closed loop process into the product,enabling organizations to use the market to improve product

and process quality.

Complaint Handling systems have an important place as the front-ne mouthpiece of the consumer market. The important way to

mprove product and process quality is to take this feedback, filter it,ssess the overall impact, take action, and then make changes to theroduct to reflect that feedback.

Using Complaint Handling Software to Improve QualityRegulatory MattersFDA Compliance in Quality Management


22/33

20 |20 |


3 Reasons to Adopt Automated Validation in QualityManagement Systems

or many years, the concerns of Quality Management Systemsentered around the validation of those systems. After all, if theystem fails to work properly, the company becomes liable and anyepercussions will most likely not be pretty.

What is validation, really? Well, at its core it is ensuring the systemoes what its supposed to do. Interestingly enough, software devel-pers validate their software every time a new version is released,

when a new build is completed, even when a new line of code isdded. In the Life Sciences space, there is such an importance placed

pon the validation of the system, that many companies will focusmore on the validation capabilities than the actual functionality ofhe software.

Most validation is manual, and it has been a valuable method forears now. However, an entire validation project does not need tonvolve the human element. This is time-intensive work, and canause a software project to be held up for months to complete vali-ation. Then, if you need to make a change to the software, you haveo re-validate.

ts like driving a car by physically pushing it from behindsure itwill get you where you need to go, but a lot slower and with a lot ofnnecessary effort.

Automated validation can speed up the validation process whilellaying fears of non-compliance. Companies become concerned

with using software to validate software, simply because they dontrust it. Yet every line of software code is validated using automatedools. Not only does it make sense for Quality Management Solutionsn the Life Sciences market, but it can actually improve upon the

more manual validation process. Here are 3 reasons why you shouldonsider automating your validation:

Speed and Efficiency:1. Validation, while producing resuis time-consumingclick here, record results; click therrecord; type here, record; mouse-over here, record. Validationprojects can last upwards of 18 months depending on the leveland detail. Many companies will settle for less robust solutionssimply because of the validation project. That is not the bestway to maximize your investment in software. Automated toolsallow you to take the OQ/PQ scripts and run them in the exactsame way a human validator would, just much, much fasterFor instance, a single Corrective Action workflow would take manual validator a full week to complete; an automated systemcould be run in a few hours.

Automated validation runs very simply. The script tells thsystem to do an action (click here, type here, etc), and what theresulting action(s) should be. The system does the action andrecords it as pass or fail.

If it passes, great. If not, then what? Well, the second reason answersthat.

Visibility and Comprehensive Readout:2. Automated Vdation leaves no stone unturned. Every possible action, variable,readout, and pixel is accounted for. It is read, recorded andreported on. Every validation script in an automated validationsystem generates a comprehensive report displaying the pass

and fail areas of a QMS. Whats more is that an automated scriprunner will not mistakenly miss a step in the script, or be subjectto any human factors. The reports from automated validationhave all the elements of that business process that the softwareis designed to automate.

Most peoples concerns over automated validation is being ableto prove that the system was validated. They need that visibilityinto the system that tells them (and any auditor) that the system isworking as it should be. Automated validation tools are built in sucha way that reports can be run to demonstrate that the system is incompliance.

Cost savings:3. You may say cost is not the issue when it comes tvalidation. The cost of liability outweighs the cost of validation.Customers often say those exact words, and they are rightto apoint. If automated validation produces the same exact resultsas a manual validation project, but does so in 20% of the time,then wouldnt it make sense to choose the cost-effective option?We had a customer take the exact same workflow and do it onceusing manual validation, then again using automated validation. The result was exactly the same, only the automated tool took afew hours. The manual team was still working 3 days later...

3 Reasons to Adopt Automated Validation in Quality Management SystemsRegulatory MattersFDA Compliance in Quality Management


23/33

21 |


But Who Validates the Automated Vali-dation tool?

would be remiss if I didnt address this question. Of course youwould need to validate any software tool before you use it in yourrganization. However, the time it takes to validate an automatedalidation tool is much less time-intensive than an entire Quality

Management Solution. Once validated, it doesnt changeitsalidated and works. Quality Management solutions are config-rable workflows, forms, fields change. So validation becomes

most important when doing regression testingrunning the vali-ation on changed areas. It enables the quick validation companieseed to be agile, and provides the visibility and level of complianceeeded for Quality and Compliance Management in the Life Sciencendustry.

Traditional Validation Still Makes Sense inMany AreasManual validation has a significant place in adoption of Life Scienceoftware systems. Certain elements must be manually validated

thats never going to change. There is a tremendous benefit tohis process, and automated validation does not seek to replace it.

However, automated validation strives to ease the validation burdennd make the process smoother.

o, with the right amount of assurance and knowledge, you can learno reap the benefits of stepping up to the next level.

Automated validation is still in its infancy, and only a handful ofendors are using this revolutionary method to increase efficiencyn validation. But just as the need for faster time-to-market increases,o will the need to speed up business process validation. Automatedalidation provides the speed and efficiency without sacrificingompliance.

3 Reasons to Adopt Automated Validation in Quality Management SystemsRegulatory MattersFDA Compliance in Quality Management


24/33

22 |22 |


GMP Compliance that Spans Enterprises:Supply Chain Compliance

There are scarcely any constraints anymore to confine our busi-esses. When looking at Life Science organizationsspecificallyhose who strive to achieve Good Manufacturing Practice (GMP)

Compliancemany still tend to think within their four walls. Theyoncern themselves with their processes and Quality management,et fail to consider the organizations that affect them outside theirour walls.

am specifically speaking about extending GMP Compliance toContract Manufacturers and the supply chain. Software solutionsre able to provide multi-tiered security at every level, based on aersons location or role. Many organizations are adopting this in

multi-site capacity with tremendous successbut what aboutxtending a QMS to your contract manufacturers?

With all the compliance initiatives to increase visibility into the supplyhain, and the stringent regulations that companies must adhere to,would make sense to provide a system that spans enterprises in

ddition to divisions. Heres why:

Visibility: Having a contract manufacturer work in your QMSprovides you with the real-time visibility into their own Qualityoperations. With this level of visibility, you can maintain controlover the state of Quality outside of your four walls.

Real-time Collaboration Cuts Cycle Time: If there is a defect ornoncompliance, then the collaboration to resolve the issue canhappen much more quickly. Unlike in current disparate systems,you do not have the lag time while the supplier works on theirend to resolve the issue. Quality and compliance events nowbecome a collaborative effort, all working toward the same goaland cutting the overall cycle time.

Compliance Right, the First Time:3. Certainly, the time takto resolve any of these supplier quality events causes a loss intime, and the time taken to re-work and re-produce becomesa factor against demand. With clear visibility and control in thecontract manufacturers process, you can now help to get theproduct right the first time, reducing the time to market.

Technology Helps to Create a Secure Platform:4. Of cothe first concern is, no way are they getting into my data. Technology has caught up with thisyou can place securityon every aspect of the softwarefields, keywords, etc.sothat external enterprises only see the content that is relevantto them. You still control your data, they are now just able tooperate in your environmentunable to see anything but theirrequired information.

OK, so objectively speaking, why isnt this being done today? Herewhy:

Fear, Uncertainty and Doubt (FUD): Theres always goinbe FUD. Certainly in the regulated space, companies protectheir intellectual property very carefully. The concept oallowing contract manufacturers access to their dataeven ifprotectedposes a certain degree of fear.

Technology is Still Leading Edge: Not many software solutiooffer this level of security, so its not been widely accepted as apractice. But think of the benefits if such a technology existed (itdoes, by the way).

Knowing Too Much: Sometimes, ignorance is blisseventhis world we live in today. Some companies do not want thislevel of visibility and/or control. This may be due to plausibldeniability, liability issues, or it could just be that they donhave the bandwidth to engage the contract manufacturers atthis level. But think of thisif there is a serious event related toyour product as a brand owner, who is liable for the repercus-sions? The answer is the brand owner, not the contract manu-facturer. So the pain of knowing too much may bite back at youin the long-run.

The world is smaller, and more and more companies are collab-orating on new levels. We all are engaging in business. The key tosuccess, especially in the regulated environment, is incorporatingmore layers of visibility into the various areas that help to make yourproducts. This not only includes standardized compliance betweendivisions but also standardization across enterprises.

GMP Compliance that Spans Enterprises: Supply Chain ComplianceRegulatory MattersFDA Compliance in Quality Management


25/33

23 |23 |


Using Quality Management Software Toolsto Manage RecallsThere is a saying, plan for the worst, and hope for the best. Thiss the general tone when discussing Recall Management. Lets faceno one likes talking about recalls; there is no positive side toecalls, and certainly no one wins when a product is recalled. This isdouble whammy when you are a medical device manufacturerot only are you recalling a defective product, but you are also facingegulatory scrutiny and potential customer endangerment. So whenspeak about medical device recalls, many are apt to have a system

n place to manage processes in the unfortunate event of a recall.The critical factor in this case is what system is best suited to effec-

vely and efficiently manage the recall process?

The FDA website states, A well-built Quality Management Systemhould reduce the number of (or prevent) recalls, returned or salvagedroducts, and defective products entering the marketplace. Recall

Management is a necessity in businesses today; the best and mostffective means to automate recall processes is through an auto-

mated QMS, which enables seamless compliance with the best prac-ces of Recall Management.

Best Practices of Recall Managementmplementing a Recall Management system using an automated

QMS guides an organization seamlessly through the recall processnd enables integration with other functions across the enterprise.o what areas of Recall Management can a QMS solution provide?

Submit Recall Information to the FDA: Once its determinedthat a product or device warrants a recall, the process must beswiftly put into action. The FDA must receive all informationrelated to the product such as the name and information of therecalling firm, name of manufacturer, as well as the reason forthe recall including a description of exactly how the product isdefective, how this has affected the safety of the product, and thedate the issue occurred. An FDA Health Hazard Evaluation (HHE)form, which shows the organizations assessment of the healthrisk, must be completed and sent to the FDA. The company mustalso include the volume of product that was produced. They willneed to submit the quantity and dates of distribution and theamount of product that is on hold due to the recall. They willthen need to submit the distribution pattern and inform the FDAof the number of direct accounts that they deal with in order toretrieve all products back from facilities and consumers.

A recall plan must also be established at this point if the organizationoes not already have one in place. A recall plan is an important partf an efficient Recall Management system. Every organization shouldave a plan in place in the event of a recall and should conduct drillsr mock recalls on their plan to guarantee its effectiveness. This

helps to ensure that in the event of a recall, all of the necessary stepsare executed thoroughly and correctly, the first time. The recall plancovers everything from the submission of information to the FDAand how the public will be notified to the evaluation of the recall. Itis essentially the companys map of the recall process, telling themexactly which direction they need to go for each step in the process.

QMS SolutionComplaint Handling linked to eMDR: functions such as Complaint Handling can help in this processby logging and keeping track of all complaints in the QMS. AComplaint Handling application manages the investigation andresolution of customer complaints in compliance with FDA guide-lines. For Life Sciences organizations, a benefit of many QMsolutions is the ability to integrate directly with the FDAs Electronic Submissions Gateway using the electronic Medical DevicReporting (eMDR) form. This allows the user to create reports oadverse events affecting a medical device organization from theQMS and send them directly to the FDA, bypassing the need tofax or mail in reportsresulting in faster response time.

Notify the Public:2. Once the recall information has beesubmitted to the FDA and the recall plan has been put intoplace, the organization must then notify all parties involved. Thiscan be done through various media channels including pressreleases or recall notification letters to consumers and facilitiesAll recall notification letters must include the identification anddescription of the problem, and the depth to which the recall hasbeen implemented, whether retail, wholesale, or user level. Thisstep must also include detailed return instructions for customersas well as a return response form.

QMS SolutionDocument Control: Having the requidocumentation such as notification letter templates, websitetemplates, press release templates, work instructions, andsimilar records is key to providing a quick response to a recalUsing a revision controlled Document Control system, organizations can ensure that the necessary documentation is availablewithin the system and is accurate and controlled, and ensures

management of the creation, approval, distribution, andarchiving of these controlled documents.

Evaluate the Recall:3. Once the public has been notified and threcall has been initiated, the organization must then conducta recall evaluation to check its effectiveness. This will enablthe organization to benchmark its effectiveness and assess theprogress of the ongoing recall. During this stage, recall statusreports must be created; these status reports should consist ofthe date each customer was notified, the number of customers

Using Quality Management Software Tools to Manage RecallsRegulatory MattersFDA Compliance in Quality Management


26/33

24 |


who were notified, the number of customers who responded,the quantity of product that was accounted for or returned, aswell as the details of the effectiveness check.

Once the root cause of the recall is discovered, this informationhould be sent to the local FDA District Recall Manager, along with

ny corrective actions that have been established at this point. Termi-ation of the recall is the final step and can be started once its deter-

mined that all parties involved have been notified, and all tracesf the product have been recovered. Before the FDA will considerermination, a final status report should also be sent to the local FDA

District Recall Manager.

QMS SolutionCorrective and Preventive Action (CAPA): Inaddition to determining root cause and investigation, the CAPAprovides a method for recording and tracking any correctiveactions taken, as well as verification of effectiveness of thecorrective action. Using Quantitative Risk Assessment, organi-

zations can conduct a Risk Assessment at the root cause phase,as well as at the effectiveness phase to ensure that correctiveactions reduce the risk or recurrence to acceptable risk levels. Anautomated CAPA should have the ability to generate multiplereport types throughout the process, including a CAPA historyreport which details the CAPA process from start to finish, as wellas any other related records that are critical to the CAPA. Thistype of reporting is critical to the recall process, and providescomplete transparency when submitting information to theFDA.

QMS SolutionChange Management: Forty-four percent of

medical device recalls are caused by inadequate design control.Change Management links Quality into the product lifecycleand maps Quality at each step in the process starting fromproduct design. Change Management applications provide theworkflow and business rules necessary to execute and managea change within the organization across multiple operationalareas. Design, supply chain, production, and post-market dataare all linked to a holistic Change Management process, withQuality and compliance as the backbone. Furthermore, therecall information is integrated into every phase of the ChangeManagement process, enabling the data retrieved during therecall to be factored into the design, production, and execution

of the change. This ensures that once the recall is closed, theChange Management process learns from the data collectedand mitigates the risk of recurrence in the next productlifecycle.

In many ways, a recall can be seen as an emergency process forcrisis management. Much like a crisis management plan, you needto have the process outlined in detail, and you need to practicewhat needs to be done in the event of such an event. So too is theRecall Management plan. Companies run mock recalls to maksure the process is seamless and effective, and that a system will

have the workflow and business rules to ensure efficiency. QualityManagement Systems provide the framework and processes to helpcompanies plan for the worst and hope for the best.

Using Quality Management Software Tools to Manage RecallsRegulatory MattersFDA Compliance in Quality Management


27/33

25 |25 |


The Bill of Compliance in Quality Management:The Quality Hub Concept

Employee Management is a central factor in any manufacturingrganization. Whats most compelling is the evolution over the pastecade on our perception of Quality Management. Once thought toe another siloed system in an organizations infrastructure, Quality

Management Systems have evolved into a central point of promi-ence in defining how products and processes are executed.

n many industries, compliance is the word of the times; compliancencompasses so many facets within an organization. Compliance toegulatory standards, compliance to good manufacturing processes,ompliance to governance and riskcompliance is everywheren the organization. In order to remain competitive in todays fast-

moving markets, organizations not only have to adhere to theemand of the consumer, they need to ensure that compliance is

met throughout. Whether its in design, supply chain, production orost-market, compliance is the underlying force that drives compet-ive advantages over others in the market.

The challenge is how to manage compliance across these varying

perational areas, to ensure there is a consistent and viable way toollaborate and ensure that Quality and Compliance are met at allevels of the process.

The Bill of ComplianceMuch like organizations generate a Bill of Materials (BOM) whenreating a production process, organizations are taking a similarpproach to compliance. The BOM provides the different opera-onal areas with the list of materials, design specifications, proce-ures, work instructions and related data to ensuring the productions successful and consistent. The Bill of Compliance (BOC) operates

in a similar way; but instead of creating consistency in production,the BOC strives to create consistency in compliance from one opera-tional area to the next.

Quality Management Systems are the key to a successful BOC. ThQuality Management System operates as a Hub for all businessystems feeding compliance data, organizing and analyzing the data

and creating a level of visibility into Quality operations that cannotbe achieved with each system individually.

The BOC, like a bill of materials or bill of process, provides a persistestructure (a metadata definition) that defines bindings for masterand operational data elements (these could be stipulated regu-latory documents, Material Safety Data Sheets [MSDSs], assay resultraw material specifications and training certifications) required todemonstrate product and process compliance for material sourcesand destinations by region, industry or even customer, says SimonJacobsen of Gartner Research in report EQM Hubs Unite QualiManagement IT Systems Across the Value Chain, published o

March 29, 2012. Simon goes on to say that ...the EQM hub providethe master data management processes needed to

essential guide to fda

Documents