e-signatures: Making Paperless Validation a Reality

Transcription

1 Cognizant Insights e-signatures: Making Paperless a Reality A paperless solution not only reduces printing costs; it also streamlines the entire life sciences regulatory submission and approval process, from CSV validation across the value chain. Executive Summary Global life sciences companies are increasingly storing documentation in electronic formats to improve operational efficiencies. The industry s embrace of a paperless environment is also driven by cost-cutting objectives and green IT principles. As such, organizations are adopting electronic records to establish validation of applications during computer systems validation (CSV) processes. As life sciences companies transition to electronic documentation, regulators have enacted security policies and practices to guard electronic information. The U.S. Food and Drug Administration s (FDA) Title 21 Code of Federal Regulations Part 11 1 and EudraLex Annex 11 2 regulations mandate adequate control of electronic records and signatures that are used as objective evidence of a validated state of applications. To comply and protect themselves from financial penalties, companies use robust security measures to preserve electronic information. HP Quality Center is the tool of choice for managing electronic documents, as it facilitates the efficient storage and retrieval of controlled copies for future audit purposes. We have developed an e-signature solution, iauthorize, that does away with traditional paper-based CSV processes and enables life sciences companies to create electronic signature-based approvals for submission to external regulatory agencies. This white paper demonstrates how companies using this solution can significantly reduce paper printing costs, minimize the transportation of wet-ink authenticated artifacts and reduce the time taken to complete the entire documentation approval, including security measures for maintaining paper-based records for the specified archival period. Need for Electronic Signatures Stringent regulations enforced by various global regulatory authorities require life sciences companies to validate and demonstrate compliance of prescribed information systems or applications used to support core business processes. This demonstration of fitment is called computer systems validation (CSV). Paper-based validation projects consume an average of 300 pages of printed copies of scripts. Scanning these scripts for subsequent manual authentication multiplies the project cost. Added to those expenses is the incremental cost of maintaining these documents in a physical state for the stipulated archival period, which includes cognizant insights march 2013

2 s Paper Volume 900 Pages 450 Pages 990 Pages 690 Pages = 3,030 Pages!! Approver 3 2 Reviewer Creator Test Lifecycle BRD 50 Pages FHS 80 Pages Design 50 Pages Risk Assessment Plan 60 Pages Test Strategy IQ Scripts 10 Pages PQ Scripts 40 Pages OQ Scripts 80 Pages Traceability Matrix 20 Pages Two Environments 3 3 IQ Logs 20 Pages PQ Logs OQ Logs 120 Pages Screen Shots 160 Pages Analysis Design Execution Summary Report 20 Pages 80 Pages Defect Reports Closure User Manuals Other Mandatory Docs 100 Pages Total Pages Printed Across Lifecycle Figure 1 storage in weather-resistant cabinets. A simple validation project with mandatory documentation and wet approvals can consume more paper than imaginable. Figure 1 represents a sample from a simple validation engagement with two levels of review and approval. Over 3,000 pages are printed for one review and approval cycle to meet the mandatory documentation required for validation. Regulations The first and most significant regulation that was initiated in this respect was the FDA s Title 21 Code of Federal Regulations (CFR) Part 11. Various other geographies, such as the European Union (with EudraLex) and Japan (with the Pharmaceuticals and Medical Devices Agency, or PMDA), base their mandates for electronic document controls predominantly on the 21 CFR Part 11 guidelines. According to 21 CFR Part 11, Persons may use electronic records in lieu of paper records or electronic signatures in lieu of traditional signatures, in whole or in part, provided that the requirements of this part are met, and that a docket stating a company s intent has been submitted to the FDA. Subpart B on the usage of electronic records establishes the system controls that must be in place if electronic records and signatures are to be used. The mandate stipulates that electronic signatures should be linked to their respective electronic records to ensure that the signatures cannot be excised, copied or otherwise transferred to falsify an electronic record by ordinary means. It also states that electronic signatures must be unique to one individual and shall not be reused by, or assigned to, anyone else. They may be based on biometrics or an identification code/password combination. EudraLex Annex 11, which is applicable to companies doing business in the EU, modified its PIC/S-11 to Annex 11 in June The provisions state: For critical data entered manually, there should be an additional check on the accuracy of the data. This check may be done by a second operator or by validated electronic means. The criticality and the potential consequences of erroneous or incorrectly entered data to a system should be covered by risk management. Complying with these two critical pieces of legislation allows life sciences organizations to meet the compliance requirements of major geographies, as they form the superset of guidelines for control of electronic documents. Granting approval to use electronic records and electronic signatures, 21 CFR Part 11 and EudraLex Annex 11 represent a paradigm shift by allowing major efficiency improvements in the business s operations. Life sciences companies, therefore, need an electronic authentication mechanism that demonstrates both functional and regulatory compliance. cognizant insights 2

3 Cognizant s e-signature Solution: iauthorize To better manage and control their electronic documentation and meet the requirements of 21 CFR Part 11 and EudraLex Annex 11 provisions, we developed iauthorize to complement test management tools used in the electronic storage of validation artifacts. This solution negates the need for printing documents solely for the purpose of capturing a handwritten signature, thereby establishing a fully electronic process. Based on our assessment, deploying this solution can potentially save up to 15% of the cost of validation for life sciences organizations and enable them to embrace environmentally friendly green policies. Solution Demystified iauthorize is built on top of HP-Quality Center, the most widely used test management tool across regulated industries, which forms the repository of controlled copies of validation documents. It is a closed system, as mandated by regulatory guidelines, where access is controlled by individuals responsible for the content and control of the electronic records. iauthorize integrates with any lightweight directory access protocol (LDAP) or user authentication system to provide digital authentication. It enables end-to-end authentication support of test management processes, such as requirements management, test plan, test execution and defect management modules commonly found in test management tools. It does this by enforcing workflow with electronic signatures across the spectrum of test management processes. Built-in flexibility enables compatibility with both regulated and non-regulated projects (see Figure 2). While our solution is aimed primarily at life sciences companies, it can also be used in other industries where regulatory documentation mandates and compliance legislation requires electronic signatures and digital authentication of electronic documents. Salient features of iauthorize include: Ease of customization of workflows: Helps enable users to customize levels of authentication, thereby providing the scalability and flexibility to customize workflows according to need. Support for bulk approvals: Supports bulk approval of all artifacts, which are duly reviewed and signed off from a regulatory perspective. iauthorize can potentially save up to 15% of the cost of validation for life sciences organizations and enable them to embrace environmentally friendly green policies. iauthorize Overview Checks in Testing Artifact HP ALM Modules HP ALM Workflow Customization Analyst System Triggers Mail Requirements iauthorize Tool Add-in Lead Lead Reviews and Approves Reviews and Approves Electronic Signature System Triggers Mail Electronic Signature Test Plan Test Execution Defects LDAP/User Authentication Module Figure 2 cognizant insights 3

4 End-to-end support of test management activities: Supports test management processes such as the requirements, test plan, test lab and defects modules of HP QC 10 and HP ALM 11. Generation of downloadable validation summary reports: This out-of-the-box feature enables generation of downloadable validation summary reports in PDF or HTML formats. Audit trails: Provides detailed audit trails for stakeholders and regulatory organizations. Applicability in other industries: Suitable for other regulated industries, such as healthcare, food products, health supplements, etc., that mandate electronic signatures. Detailed audit trails and automated review and approval mechanisms ensure compliance with 21 CFR Part 11 and EudraLex Annex 11 guidelines. Notification to individual owners and stakeholders about status and state transitions is enabled through automatic notification functionality. The solution is readily adaptable through configurable workflow customization, aligned to the individual organization s validation processes. The security and authentication mechanisms are in line with 21 CFR Part 11 and EudraLex Annex 11 requirements, which warrant dual authentication credentials. This solution currently uses the User-LDAP authentication feature of HP Quality Center, wherein a unique user ID and associated password is used for managing the approval process. While ensuring that regulatory compliance is the primary focus of the digital signature process, this solution also provides an ideal platform for life sciences organizations that want to move toward paperless validation and completely discard the use of printed versions of validation artifacts. In a nutshell, this solution provides a secure and configurable approval process for use in regulated environments by electronic signatures. iauthorize has been systematically validated in line with our CSV framework (aligned with GAMP guidelines) to meet adequate documentation and objective evidence regulatory requirements (see Figure 3). Integration with HP Quality Center iauthorize provides ready integration with HP Quality Center, helping clients save time and effort related to protocol design for tool validation and development of add-ons to the test management tool. As this solution is built over HP ALM 11.0/HP QC, it enables clients to leverage existing investments in tool licenses. The active version of the solution framework currently works with HP Quality Center on both HP ALM 11.0 and HP QC 10.0 as the test management tool. iauthorize Benefits Regulatory Compliance Demonstrated compliance with life sciences predicate rules. Faster Turnaround Time Automated process reduces manual intervention and removes inefficiencies. Hassle-Free Audits Archiving functionality to store documents and test assets in a single place with detailed audit trails. Cost Benefits Achieves up to 10% cost benefits compared with a paper-based validation model. Effective Test Management Built in adapter for HP QC Test Management tool for straightthrough QA-related data transmission. Secure Access Electronic encryption function for higher security of electronic signatures. Figure 3 cognizant insights 4

5 Footnote 1 Guidance for Industry: Part 11, Electronic Records; Electronic Signatures Scope and Application, U.S. Department of Health and Human Services, August 2003, 2 EudraLex Annex 11: Computerised Systems, European Commission Health and Consumers Directorate- General, and health/files/eudralex/vol-4/pdfs-en/anx11_en.pdf. About the Authors Rangarajan Rajamani is a Consulting Manager in Cognizant s Quality Engineering & Assurance Services business unit and has over 11 years of experience in consulting and developing solutions along the themes of regulatory compliance and operational excellence in the life sciences industry. Rangarajan was a key member of the team that developed iauthorize. He has worked in global pharma regulations, CSV lifecycle, pharmaceuticals manufacturing and compliant supply chains, sales and channel management, solution prototyping and back-end support for business development. Rangarajan has supported over 25 QMS and process audits and five vendor code of conduct (CoC) audits across industries. He can be reached at Rangarajan.Rajamani@cognizant.com. Sagar Mundada is a key member of Cognizant s Quality Engineering & Assurance Services business unit and has over 10 years of experience in HP test tools administration (TD 7.6, QC 10.0, HP ALM 11.0, HP QTP, PC). Sagar was the quality center expert who created the e-signature workflow architecture built on HP QC and has developed tools and utilities to automate the HP QC administration activities. He has also created reports using HP Delivery Dashboard and integration with third-party tools. Sagar worked on projects connected with various GXP and 21 CFR Part 11 compliance used in life sciences, implementation and maintenance of frameworks that replace traditional paper-based manual CS processes, enabling electronic signature-based approval for submission to many global pharmaceutical and biotech companies. He can be reached at Sagar.Mundada@cognizant.com. G. R. Ragesh is a key member of Cognizant s Testing Center of Excellence R&D team, with over seven years of experience developing innovations, tools and frameworks related to test automation. He is responsible for developing the electronic signature framework that runs on top of the HP QC LDAP authentication process. Ragesh can be reached at Ragesh.GR@cognizant.com. Rahul Deshpande is a Senior Manager in Cognizant s Quality Engineering & Assurance Services business unit. Rahul has over 13 years of experience in test consulting and designing innovative solutions for the life sciences industry. He manages the QA delivery and client relationships of Cognizant s life sciences industries in North America. Rahul led the team that developed iauthorize from concept to product rollout. In his current role, Rahul provides thought leadership and implementation assistance to clients as they transition in QA maturity. He can be reached at Rahul.Deshpande@cognizant.com. About Cognizant Cognizant (NASDAQ: CTSH) is a leading provider of information technology, consulting, and business process outsourcing services, dedicated to helping the world s leading companies build stronger businesses. Headquartered in Teaneck, New Jersey (U.S.), Cognizant combines a passion for client satisfaction, technology innovation, deep industry and business process expertise, and a global, collaborative workforce that embodies the future of work. With over 50 delivery centers worldwide and approximately 156,700 employees as of December 31, 2012, Cognizant is a member of the NASDAQ-100, the S&P 500, the Forbes Global 2000, and the Fortune 500 and is ranked among the top performing and fastest growing companies in the world. Visit us online at or follow us on Twitter: Cognizant. World Headquarters 500 Frank W. Burr Blvd. Teaneck, NJ USA Phone: Fax: Toll Free: inquiry@cognizant.com European Headquarters 1 Kingdom Street Paddington Central London W2 6BD Phone: +44 (0) Fax: +44 (0) infouk@cognizant.com India Operations Headquarters #5/535, Old Mahabalipuram Road Okkiyam Pettai, Thoraipakkam Chennai, India Phone: +91 (0) Fax: +91 (0) inquiryindia@cognizant.com Copyright 2013, Cognizant. All rights reserved. No part of this document may be reproduced, stored in a retrieval system, transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the express written permission from Cognizant. The information contained herein is subject to change without notice. All other trademarks mentioned herein are the property of their respective owners.