Pharmaceutical Commerce - May/June 2017 - 21

Information Technology
How cloud-based IT systems address
FDA validation requirements
Paper validation records will disappear in the face of continuous validation
By Bruce Kratz and Jon Ragati, Sparta Systems

The life sciences
community has always
been more conservative
when it comes to
the adoption of new
technologies, and cloudbased systems are no
exception. This cautious
approach to shiny new
technology objects is
more than appropriate
given the high stakes
nature of the good
work these companies
p e r f o r m . Mi t i g a t i n g
risks and avoiding new ones is top of
mind for pharmaceutical IT and quality
professionals. Now that cloud-computing
models are well accepted across many
industries with proven security models
and high reliability, it is becoming a viable
option for life sciences enterprises.
However, the nagging challenge of
validation of these systems is still widely
misundersto o d among life sciences
professionals. The data with some of
the highest concerns for risk in cloud
environments includes records pertaining
to quality systems in pharmaceutical
manufacturing. Company requirements
in these industries are extremely tight on
computer system validation due to the
need to stand up to the rigor of regulators.
Life sciences companies are used to
owning the controls that govern their
systems, controlling the pace of upgrades,
and running extensive validation cycles
on those upgrades, which are often many
months in length. This flies in the face of
trends in the cloud computing delivery
model, which favors frequent releases of
new features across all customers at a pace
controlled by the software vendor.
However, the benefits of cloud-based
deployments have ushered in a new class
of Quality Management Systems (QMS)
that have transitioned successfully to the
cloud. Among those systems, thoughtful
vendors have taken new approaches
towards validation that not only meet the
requirements but in many ways provides a
higher quality output. They have taken the
burden of managing validation processes
across a multi-tenant system and turned
it into an asset by taking advantage of
automation techniques that streamline the
execution process. Automated validation
approaches take what is traditionally a onetime event that happens at the end of a
major software or process upgrade and
turn it into an ongoing, every-day process
that, it can be argued, ensures a system that
is "continuously validated"-always being
evaluated against a known set of outputs.

COTS software
Traditionally, most pharmaceutical
companies deploy on-premise software.
They may purchase a commercial off-theshelf (COTS) system, install it internally
on servers, configure it to communicate
on the cor por ate network and w ith
other corporate systems and databases,
and manage it in compliance with a
corporate IT strategy and set of Standard
Operating Procedures (SOPs). Aside from
the development of the COTS software
package, everything is owned, managed

solutions across all tenants and take on the
burden of operating those systems with
shared resources and procedures to drive
efficiency. To the business, the costs are
passed on as a monthly operating expense,
not a capital-intensive planning session
that requires months and years of planning.
Basics of cloud computing
On the most basic level, cloud
computing refers to using "virtualized
servers" distributed over the Internet to
store, access and manage data instead of on

Sparta Systems' Stratas QMS system. Credit: Sparta

and maintained by the company. This
results in significant overhead costs to the
company, which includes applying patches,
administer ing the internal network
connections, securing the data, creating
disaster recovery contingencies, and the
capital-intensive nature of keeping the
required hardware viable. The expense and
capital burden of the on-premise model
in many companies takes a back seat to
the inherently slow pace of deploying
functionality to the business. IT projects
continue to back up as IT teams shrink and
the needs of the business grow.
The cloud business model changes
the g ame sig nificantly. Tr ue multitenant cloud computing-based systems
are able to deliver great value by sharing
infrastructure and software across several
tenants (customers). To deliver that
value, cloud software vendors deploy

physical servers inside corporate network
infrastructures. The common deployment
patterns of cloud computing are single and
The single-tenant cloud is an architecture
in which a single instance of a software
solution and supporting infrastructure is
"hosted" on servers in the cloud for one
customer. In this situation, one company
has its own instance of a solution so there is
no shared resourcing. The tenant is the only
company able to access the software. This is
a similar model to on-premise in that it is
one singular system with software installed
and the company is the only one accessing
it. While the customer does benefit from
not having to manage the solution directly
or worry about the hardware involved,
that solution often cannot provide the
economies of scale that multi-tenant
deployments can provide.

The multi-tenant cloud is an
architecture in which a single instance of
software serves multiple customers. In the
multi-tenant cloud, many customers are
sharing computing resources and storage,
and running on the same application,
but the data of each software instance is
protected by definitive access points and
security features. Since resources are shared
and maintained externally, the cost to each
tenant is reduced.
FDA-scale systems validation
Validation refers to the process of
checking that a software system meets
specifications and that it fulfills its intended
purpose. Properly capturing validation
documentation is key for deploying cloudbased solutions and should be documented
in accordance with the company's internal
SOPs. If an auditor reviews a company's
software environment, the company must
be able to demonstrate how the software
was validated per its internal SOPs. With
cloud solutions, the time-consuming tasks
with regards to validation that normally
occurs during the Installation Qualification
(IQ) and Operation Qualification (OQ) in
many cases can be provided by the software
When it comes to electronic record
keeping and FDA, they made an early
attempt to be proactive when they came
out with guidance for complying with Title
21 of the Code of Federal Regulations;
Electronic Records; Electronic Signatures
(21 CFR Part 11). According to FDA:
We suggest that your decision to validate
computerized systems, and the extent of the
validation, take into account the impact
the systems have on your ability to meet
predicate rule requirements. You should
also consider the impact those systems might
have on the accuracy, reliability, integrity,
availability, and authenticity of required
records and signatures...We recommend
that you base your approach on a justified
and documented risk assessment and a
determination of the potential of the system
to affect product quality and safety, and
record integrity.
If, after reading that section of the
guidance, you are left with more questions
than answers, you are not alone! Keep in
mind, this validation guidance was last
updated in 2003, well before the cloud
revolution. The resulting gray area leaves
many questions unanswered on the use of
cloud systems for regulated workloads and
how they should be validated. FDA was
expected to publish additional guidance on
the use of cloud, but that guidance has not

May | June 2017 Visit our website at 21

Table of Contents for the Digital Edition of Pharmaceutical Commerce - May/June 2017

Table of Contents
Pharmaceutical Commerce - May/June 2017 - Cover1
Pharmaceutical Commerce - May/June 2017 - Cover2
Pharmaceutical Commerce - May/June 2017 - Table of Contents
Pharmaceutical Commerce - May/June 2017 - 4
Pharmaceutical Commerce - May/June 2017 - 5
Pharmaceutical Commerce - May/June 2017 - 6
Pharmaceutical Commerce - May/June 2017 - 7
Pharmaceutical Commerce - May/June 2017 - 8
Pharmaceutical Commerce - May/June 2017 - 9
Pharmaceutical Commerce - May/June 2017 - 10
Pharmaceutical Commerce - May/June 2017 - 11
Pharmaceutical Commerce - May/June 2017 - 12
Pharmaceutical Commerce - May/June 2017 - 13
Pharmaceutical Commerce - May/June 2017 - 14
Pharmaceutical Commerce - May/June 2017 - 15
Pharmaceutical Commerce - May/June 2017 - 16
Pharmaceutical Commerce - May/June 2017 - 17
Pharmaceutical Commerce - May/June 2017 - 18
Pharmaceutical Commerce - May/June 2017 - 19
Pharmaceutical Commerce - May/June 2017 - 20
Pharmaceutical Commerce - May/June 2017 - 21
Pharmaceutical Commerce - May/June 2017 - 22
Pharmaceutical Commerce - May/June 2017 - 23
Pharmaceutical Commerce - May/June 2017 - 24
Pharmaceutical Commerce - May/June 2017 - 25
Pharmaceutical Commerce - May/June 2017 - 26
Pharmaceutical Commerce - May/June 2017 - 27
Pharmaceutical Commerce - May/June 2017 - 28
Pharmaceutical Commerce - May/June 2017 - 29
Pharmaceutical Commerce - May/June 2017 - 30
Pharmaceutical Commerce - May/June 2017 - 31
Pharmaceutical Commerce - May/June 2017 - Cover4