March 27, 2012

Know Your IT Systems Vendors

Posted in Cloud, Computer Validation, IT, Vendor Audits tagged , , , , , , , , , , , at 9:38 AM by Solutions2Projects, LLC

IT systems and infrastructure are critical to any organization.  This is especially true for life sciences companies selecting and implementing IT systems critical to the business functions supporting compliance functions. Regulatory bodies expect life sciences companies to demonstrate control over these elements regardless of whether they are the ones developing or maintaining the IT systems (infrastructure, software, etc.).

Companies cannot simply toss the responsibility over the fence to the vendors. Life sciences companies are still responsible for the integrity of the data and control over the systems.  They may delegate but only after verifying the vendor can meet the compliance and control requirements. 

This is where vendor audits come in to play. 

Vendor audits for software are not new.  Over the past decade I’ve seen the importance of vendor audits for software wax and wane and wax again.  In light of the increase in cloud and hosted solutions chosen by companies to decrease overall spend, the need for vendor audits is critical.

And, as biotechs become more virtual and more services are outsourced (CRO, CMO, data management, complaint handling, etc.), it is imperative that companies verify their vendors meet compliance requirements as well as their own procedural and process requirements.   The vendor’s IT systems and controls must meet the requirements as if they were hosted by your own company.  Not all vendors perceive the need to meet compliance requirements at the same level and you need to know before you enter any agreements.  Once you’ve signed the contracts, you’ve lost your leverage for process improvements and controls. 

Why conduct the audits? 

  • Gain high level of confidence that the computerized system will meet technical, commercial and regulatory requirements (GAMP 5)
  • Confirm the supplier builds quality and integrity into the software product during development
  • Leverage knowledge, experience and documentation of supplier (GAMP 5) to potentially reduce validation effort
  • Confirm processes and controls when  outsourcing IT / software functions (SaaS, PaaS, IaaS, hosted solutions, co-locations)

When should audits be performed?

  • For high risk systems / outsourced services
  • Before any contracts are signed!
  • Scheduled follow up audits based on
    • Audit results
    • External audit program
    • Risk assessment
    • Significant vendor business changes
    • When there are issues with the vendor

How are audits performed?

  • Similar to other vendor audits for CMOs or other critical suppliers
  • Plan for the audit and communicate expectations to the vendor
  • Conduct the on-site audit (for IT systems, Quality and IT representatives should participate)
  • Summarize findings with the vendor at the end of the audit
  • Document findings in an audit report and provide to the vendor for a response
  • Follow up on observations and document

The financial cost of, and risk associated with, software solutions has increased exponentially which means that it is imperative for organizations to understand what they are getting into before they sign on the dotted line.  The cost of a software or IT system blunder can be expensive in terms of resources, time and can make or break a life sciences company.  If you cannot demonstrate control, and therefore the integrity of your data, for systems supporting drug product administered to patients, a regulatory body may not grant approval for your product or could shut down manufacturing operations.  Your company owns the data and the responsibility even if it service is outsourced. 

Knowing your IT vendors gives you the knowledge to reduce the risks associated with the IT solutions in your life sciences company.  Without this knowledge, you are powerless to defend your risk assessment and risk mitigation strategy to regulatory agencies.


December 9, 2011

The Rhythm of Projects and Half Marathons

Posted in General tagged , , , , at 11:52 AM by Solutions2Projects, LLC

I recently ran my first half marathon after training for nine weeks and realized that the rhythm of a computerized system implementation project (for me at least) mimicked the rhythm of running a half marathon.
At the start of a race, similar to the start of an implementation, there is excitement, apprehension, jostling for position, and general anxiety. Project team members are excited about solving an existing problem with a new system but are uncertain about how their respective jobs will be impacted by the changes that will be made which causes anxiety. In order to alleviate that anxiety, folks in an organization jockey for position to ensure that they can positively influence the changes or avoid them entirely. Some may put themselves in positions of leadership and control or find a way to avoid completely.
As you move from the starting gate and begin to establish your own pace, you feel a sense of relief that it’s finally underway and a bit of a thrill that it’s finally happening. On a project, the (seemingly endless) planning is behind you and there’s finally progress toward the actual goal. There is cheering from the executive sponsor (similar to my family cheering me on at mile 2) and the project moves on.
Eventually, the excitement and relief fade as you pass the first few mile markers. Yes, there’s been some accomplishment but then there is the realization that there is quite a bit more to go. At this point, it’s extremely important for the project manager to keep the team motivated, focused on the overall objective, and give team members a sense of accomplishment. It also helps to have some cheering from the sidelines to reinforce the importance of the project and provide a sense of appreciation from outside the project team. This is a great time for rewards (even small tokens help) and cheering from the business sponsor similar to the cheering from the sidelines from friends, family members, or complete strangers. The boost takes you through a couple more miles and a couple more deliverables on a project.
A few more miles tick by and you feel like you are in the home stretch. Some of the big miles or milestones have been accomplished and it feels good. You get a renewed sense of energy and purpose and realize that it’s actually possible to meet your goal. It actually becomes possible to visualize the end even though you can’t see the finish line.
And then it gets hard again. For me it was at 10.5 miles. I was thrilled at how far I’d run and impressed I’d made it that far. But then I did some math and realized I still had 2.6 miles to go. I hadn’t trained beyond one 9 mile run and two eight mile runs. I wasn’t going to stop but I knew it was going to be hard. I put my head down and focused on completing the run…one step, one quarter mile, one half mile at a time. I broke it down into manageable chunks and gave myself kudos for every quarter mile. I closely monitored my progress to remind myself of how little there was left to meet my goal.
I do the same with a project team. The project team is tired at this point. While they know the end is near, the finish line seems so far away because of all of the little things left at the end of a project and none of them are fun. This includes data clean up and migration, data set up, work instruction and procedure finalization, training, and closing out documentation. At this point, the little deliverables don’t give much of a sense of accomplishment but it takes the project team closer to the go live date one step at a time. As a project manager, it’s critical to keep the project team members focused on checking these off and not getting distracted by what seems to be an endless list. Cheering from the business sponsor is helpful here, too.
As with every project I manage, once I see the finish line, I pick up the pace and use every last bit of energy to push across the finish line. Sometimes I have to push and pull the project team members along me but we must all cross together. We started as a team and we will finish as a team.
The elation you feel crossing the finish line lasts for a brief period of time before the letdown begins. There’s no longer a focused sense of purpose associated with a project. After the race, I looked back and said to myself, ‘well, now what?’ I walked back to the hotel to meet up with my family and we resumed the day. It is similar on a project. Once the project is over, most project team members return to their day jobs and work to get into a new comfort zone now that the new system is in place. It’s often uncomfortable and takes some time to get used to. Things will not be the same as they were.
At Solutions2Projects, LLC we recognize that computerized system implementations are not easy and that change is uncomfortable for most people. For most implementations, we recommend having incentives, rewards and project tracking and love to center them around a theme. On one project, our theme was ‘around the world in 88 days.’ To keep the company informed (and provide the team with a sense of progress) we had a map with marked destinations and as we reached milestones, we marked them on the map. Each milestone was in a different country and had a reward associated with that company. The rewards were small but the gesture appreciated by the team members. We celebrated the project completion with an America-themed end of project party since our destination was the Bay Area.
As a project manager, recognizing that there are going to be hills and valleys during an implementation helps to remove the surprise associated with the downs. This will provide you with the power to manage through the phases knowing that there is an easier time coming up and that eventually, there will be a finish line. I suppose that’s the great thing about projects…there’s always a beginning, a middle, and an end. At the end there should always be a celebration as the process to get there is never easy. And, once the project is over, as with this race, it’s time to find another one!