U.S. FDA Title 21 CFR Part 11 Compliance Assessment of SAP Records Management

Transcription

1 U.S. FDA Title 21 CFR Part 11 Compliance Assessment of SAP Records Management Disclaimer These materials are subject to change without notice. SAP AG s compliance analysis with respect to SAP software performance based on 21 CFR Part 11: (i) in no way expresses the recognition, consent, or certification of SAP software by the United States Food and Drug Administration; and (ii) applies to certain components of SAP Records Management only as stated herein. The customer is solely responsible for compliance with all applicable regulations, and SAP AG and its affiliated companies ( SAP Group ) have no liability or responsibility in this regard. These materials are provided by SAP Group for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. page 1/12

2 Content 1 Summary U.S. FDA Title 21 CFR Part 11 Assessment SAP Records Management Security E-Records FDA Requirement Change, Status, Workflow and Authorization Management and Archiving in SAP Records Management Digital Signature How SAP Records Management complies with FDA Title 21 Part References page 2/12

3 1 Summary Based upon SAP AG s interpretation of the U.S. Food and Drug Administration (FDA) Title 21 CFR Part 11 rule and the functions and features discussed within this document, SAP AG believes that SAP records management software in the SAP ERP application fully complies with 21 CFR Part 11. page 3/12

4 2 U.S. FDA Title 21 CFR Part 11 Assessment 2.1 SAP Records Management Records Management is a standard solution for the electronic management of records. Quick access to information is a key factor for performing business successfully. Records Management guarantees this quick access. In one record, all information objects of a business transaction are grouped together in a transparent hierarchical structure. By converting paper records to electronic records, you can enjoy all the advantages of a paperfree office: No storage costs for records, no cost-intensive copying procedures, and optimal retrieval of information. However, SAP Records Management not only provides an electronic representation of the conventional paper record, but also offers functions that far exceed those available for conventional records management: you have fast and secure access to archived documents. You can enter Office documents and notes directly in a record, using document templates if required. You can include Internet or intranet pages in a record. In addition to documents, you can also integrate other diverse electronic elements (the elements can originate from the local SAP system, from other SAP systems, or from non-sap systems): Business Objects Transactions Reports These integration options mean that the record provides a universal view of all the information objects that exist for a business process. Access to information is facilitated. The user no longer has to navigate through systems to find information objects, because all the information objects for the whole record are available in one structured view. Clicking on an object in this view displays it directly. In addition, the integration of the Workflow Engine and an ad hoc workflow tool enables you to efficiently control your processes from the record: Predefined workflows can be included in a record and started from the record. Users can, however, also define ad hoc workflows in the record. If they do so, users send record elements in an electronic circular to employees and determine the employees tasks. This process is logged and can be traced from within the record. Basis for the following investigation is the records management in the ERP 2005 application. 2.2 Security SAP records management is built on top of SAP NetWeaver. Therefore, all security features of SAP NetWeaver Application Server are valid for SAP Records Management. For details please refer to the Whitepaper U.S. FDA Title 21 CFR Part 11 Compliance Assessment of SAP Net- Weaver. page 4/12

5 2.3 E-Records FDA Requirement FDA requires the ability to log and track changes on Business Objects and dependent objects in a compliant software environment. The computer system must provide functionality to log changes, creation and deletion applied to Business Objects and to dependent objects (e.g. configuration data). The minimal necessary information the system has to provide is: Old Value of an attribute of the changed Business Object New Value of this attribute Person who changed the value Date and time of change (SAP ERP uses UTC) Action (create, modify, delete) Change, Status, Workflow and Authorization Management and Archiving in SAP Records Management Change Management You can keep logs of activities performed on elements 1 in Records Management: You can display the log for any element at any time. Prerequisite: The service provider underlying the element has implemented the logging functionality. This is always the case with standard service providers delivered by SAP. You can define the level of detail in the log in Customizing (in registry maintenance). The level of detail is a classification parameter and can be assigned to an element type. In total, there are three classification parameters that relate to the log. These have the following meaning: LOG_LEVEL: Level of detail in the log. The higher the level of detail is, the more precise the log will be. In the service providers delivered by SAP, the values specified below apply (activities for structure elements also apply for elements belonging to these structure elements): 0: No logging 1: Logging of critical activities (Delete, Open and Close) 2: Logging of critical and changing activities 3: Logging of displaying, changing and critical activities LOG_KEEP_DAYS: Time in days that the log entries are kept for (determines the expiry date) 1 An element is a piece of information that is checked into Records Management. Elements can be integrated into records, but do not have to be. A record itself is also an element, and at the same time contains elements. This means it is possible for a record to contain other records as sub records. Record models and file plans are also elements. page 5/12

6 In the default setting, this retention period is 365 days for all element types. LOG_NOT_DEL: Flag, whether logs should be deleted after the expiry data. The expiry date is the date that is calculated from the entry for LOG_KEEP_DAYS. If you select "X" for LOG_NOT_DEL when creating an element type, logs will not be deleted even when the expiry date has passed. If you want logs to be deleted for an element type, do not make an entry in this parameter when creating the element type in question, and proceed as described below (Deleting Log Entries). It is also possible to delete specific log entries using this flag. If you do not assign any classification parameters to an element type, all elements belonging to it will have the following default settings: LOG_LEVEL: 2 LOG_KEEP_DAYS: 365 LOG_NOT_DEL: Blank For displaying the log you can call the log display screen either by choosing the relevant symbol in the display screen for the element in question or via the context menu. This depends on the individual element. The log display screen shows the date, time, user, activity, changed attribute values and comments. It the element contains structure elements, all activities performed on the sub objects belonging to the structure element are displayed also. You can also use a special transaction to display the log for an element. To do this, call the SAP Easy Access Menu and choose Records Management Administration Display Log (transaction SRMPROTOVIEW). The transaction starts a program that selects and displays log entries. We recommend that you always display the log for just one element at a time, as the log entries do not directly allow you to tell which element the entry actually refers to. You can identify the element either from the POID Directory ID or from its unique ID. We recommend identifying the element from the POID Directory ID. You can find the POID Directory ID of an element by positioning the cursor on this element in transaction ORGANIZER or SCASE and choosing Information in the context menu. The POID Directory ID is then displayed under Technical Information. Log entries are not deleted automatically. To delete log entries, you need to run function module SRM_PROTOCOL_DELETE_EXPIRY in test mode. The function module then deletes all entries whose retention period has expired. This retention period depends on the entry for classification parameter LOG_KEEP_DAYS (see above). To keep the data volume as low as possible, you are advised to run this function module regularly and to set classification parameter LOG_LEVEL to 0 for all element types that you do not require logs for. Electronic Records Tool The cross-application component of the SAP ERP Central Component Electronic Records Tool offers the creation of change documents, documentation of changes on table level and documentation of changes in long texts (SAP Script). All functions can be activated and do not require modification. A change document object captures changes to fields within a transaction and writes this information to a unique record. This record is date and time stamped and maintains the old and new values for each of the fields that have been changed in addition to the user ID of the person who made the change. A report is run to query and display the audit trail record. These objects may be active in the shipped version of SAP Records Management or may require configuration for activation. For more details please refer to the SAP Library. page 6/12

7 Status Management You can use Status Management for records and documents. In Customizing, define the status values and the permitted sequence of these values. Users can then set these status values as attributes for records or documents. Following steps need to be performed for Status Management within Customizing: Status value definition, status profile definition, status network definition, assignment of a status profile to an element type. Standard Events The Service Provider for records and the Service Provider for documents offer various standard events. You can use these for workflows, for example. To allow these events to be triggered, you need to assign the value of classification parameter WF_RAISE_EVENT as TRUE in the registry maintenance for the relevant element type. The Service Provider for records and the Service Provider for documents can trigger the following events: CREATED CHANGED If a new version is created, event parameter NewVersionCreated takes the value X. CLOSED DELETED The events are triggered for changes made using either the GUI or the API. Workflow The Ad hoc workflow and the standard Business Workflow can be used within SAP Records Management. The customizing steps to follow are described within the SAP library. Authorization Authorizations control user-access to system data and are therefore a prerequisite for implementing Records Management. The SAP authorization concept protects transactions and programs in SAP systems using authorization objects. Authorization objects allow complex authorization checks. These checks are subject to a number of conditions. Authorizations depict features of the authorization objects according to the activity and responsibility of the employee. The authorizations are summarized in an authorization profile, which belongs to a role. The administrator assigns the appropriate role to the employee so that they can fulfill their tasks in the system. SAP delivers authorization objects for Records Management. You can use them to control access to records, cases, documents and incoming post items for organizational units of your organizational structure. SAP delivers ready-made roles that contain the authorizations for the task areas of the employee. These roles contain the authorization objects for Records Management and for Case Management. You can use the roles as templates for your own roles and adjust them to your requirements. The authorization concept for working with Records Management has three levels. Level 1 is checked first, then level 2, and finally level 3. page 7/12

8 Level 1: Authorization restrictions via defined views which do not allow the user to access information directly. Level 2: Authorization check using the Records Management authorization object. Level 3: Authorization check using the authorization objects of a Service Provider (as long as this has implemented an authorization check) As a general rule, an authorization check for an element in its own repository is only successful if these authorization checks have been passed. Archiving You can archive all elements that are based on the generic Service Provider back end. (From now on, these elements will be referred to as all documents) You can archive both document content and all of the document s attributes. As the document content (that is, the unstructured content in Knowledge Provider) often represents the most significant share of the data volume, this content can be moved to a content server well before the growth of metadata (document attributes) makes archiving necessary. SAP provides a relocation report for this purpose. You can also configure an element type in such a way that the document content will be stored on a content server right from the start. (This setting can be made in the content model). By doing this, you no longer need to move the document content yourself. You can archive the logical document (all metadata) using the Archive Development Kit (ADK). Consistency between document content and metadata is therefore assured, even if the content and metadata are in different systems. Once archiving is completed, you still have read access to the documents. 2.4 Digital Signature The Digital Signing of Documents function supports digital signing of documents in Records and Case Management (RMPS). Qualified digital signatures contain the OSCP (Online Certificate Status Protocol), that is, the certificate status is checked and logged online in the trust center. This type of digital signature meets the requirements of the German signature law. The signatories sign digitally at the front-end using their private key saved on a chip card (smart card) in connection with the corresponding public key certificate. This function also supports the automatic verification of externally signed attachments that are imported into RMPS as incoming post items in . The server verifies the signature and certificate using an external security product that exchanges data via the SSF interface (Secure Store and Forward) of the SAP system. Currently, the digital signature in RMPS is only supported with the security product SECUDE. In case digital signature is needed elsewhere within SAP Records Management in ERP 2005 the Encapsulated Signature Tool in SAP NetWeaver Application Server can be implemented on a project basis. Prerequisite for the usage of the Encapsulated Signature Tool is: The solution must fully consist of ABAP coding which is the case for SAP Records Management. The prerequisite is not true for user interfaces, as the tool can also be used with user interfaces programmed in another language than ABAP, e.g. JAVA. In this case, security and authentication issues have to be considered carefully to avoid security gaps. page 8/12

9 You must have release 6.20 or higher of SAP NetWeaver Application Server (formerly named SAP Web Application Server) for the use of the encapsulated signature tool. For further information, refer to the implementation guide titled Digital Signature Tool (see References below). 2.5 How SAP Records Management complies with FDA Title 21 Part 11 The following table summarizes how SAP Records Management complies with each requirement of Part 11. Part 11 Clause 11.10(a) 11.10(b) SAP Assessment of SAP Records Management SAP Records Management provides logs of activities performed on elements. The log display screen shows the date, time, user, activity, changed attribute values and comments. If the element contains structure elements, all activities performed on the sub objects belonging to the structure element are displayed also. The log can be displayed for any element at any time. The service provider underlying the element has to have implemented the logging functionality. This is always the case with standard service providers delivered by SAP. The logs are secured from unauthorized access. All electronic records generated in SAP Records Management are accurate, complete, and presented in a human readable format. You can call the log display screen either by choosing the relevant symbol in the display screen for the element in question or via the context menu. This depends on the individual element. You can also use a special transaction to display the log for an element. To do this, call the SAP Easy Access Menu and choose Records Management Administration Display Log (transaction SRMPROTOVIEW). The transaction starts a program that selects and displays log entries. We recommend that you always display the log for just one element at a time, as the log entries do not directly allow you to tell which element the entry actually refers to. Electronic records in SAP Records Management can be printed or exported into several industry-standard formats such as Adobe PDF and XML. All electronic records can be maintained in the active database or archived to accommodate all required retention periods even when software is upgraded. Access to these records is secured by authorization profiles (c) You can archive all elements that are based on the generic Service Provider back end. (From now on, these elements will be referred to as all documents). You can archive both document content and all of the document s attributes. As the document content (that is, the unstructured content in Knowledge Provider) often represents the most significant share of the data volume, this content can be moved to a content server well before the growth of metadata (document attributes) makes archiving necessary. SAP provides a relocation report for this purpose. You can archive the logical document (all metadata) using the Archive Development Kit (ADK). Consistency between document content and metadata is therefore assured, even if the content and metadata are in different systems. Once archiving is completed, you still have read access to the documents. page 9/12

10 Part 11 Clause SAP Assessment of SAP Records Management Archived documents are still integrated in the history of SAP Records Management. These are flagged with the supplement Archived. By doubleclicking on a document, you can display it. At present, it is not possible to find archived documents using the Records Management search. This function is planned, however, and will probably be delivered in a Support Package (d) 11.10(e) 11.10(f) 11.10(g) 11.10(h) 11.10(i) 11.10(j) 11.10(k) (a) 11.50(b) Robust security administration and authorization profiles assure system access. Changes to security profiles are recorded in SAP NetWeaver Application Server. SAP Records Management provides logs of activities performed on elements. The log can be displayed for any element at any time. The log display screen shows the date, time, user, activity, changed attribute values and comments. If the element contains structure elements, all activities performed on the sub objects belonging to the structure element are displayed also. The service provider underlying the element has to have implemented the logging functionality. This is always the case with standard service providers delivered by SAP. The logs are secured from unauthorized access. You can control the processing statuses of SAP Records Management records and documents using status and workflow management and so enforce the proper sequence of operations as required by the applicable regulation. SAP NetWeaver Application Server executes authority checks in conjunction with its robust security administration and authorization profiles to ensure only authorized individuals can access the system, electronically sign a record, and access or perform the operation at hand. SAP NetWeaver Application Server also records changes to authorization profiles. N/A The Product Innovation Lifecycle (PIL) for SAP development requires that all personnel responsible for developing and maintaining SAP products have the education, training, and experience to perform their assigned tasks. A wide range of additional education and training offerings and regular assessments of individual training requirements ensure a process of continuous learning for SAP staff involved in the development and support of all SAP software. This clause covers a procedural requirement for customers and is not related to the functions or capabilities of the COMPUTER system. N/A For open systems, SAP NetWeaver Application Server supports interfaces with complementary software partners that supply cryptographic methods such as public key infrastructure (PKI) technology. The Encapsulated Signature Tool can be implemented to satisfy these requirements. The Encapsulated Signature Tool can be implemented to satisfy these requirements. The Encapsulated Signature Tool can be implemented to satisfy these requirements. page 10/12

11 Part 11 Clause (a) (b) (c) (a)(1) (a)(2) (a)(3) (b) (a) (b) (c) (d) (e) SAP Assessment of SAP Records Management The Encapsulated Signature Tool can be implemented to satisfy these requirements. This clause covers a procedural requirement for customers and is not related to the functions or capabilities of the COMPUTER system. This clause covers a procedural requirement for customers and is not related to the functions or capabilities of the COMPUTER system. SAP NetWeaver Application Server requires two distinct components a user ID and a password to perform each and every electronic signature. By design, SAP NetWeaver Application Server does not support continuous sessions where only a single component is necessary subsequent to the first signing. This clause covers a procedural requirement for customers and is not related to the functions or capabilities of the COMPUTER system. SAP NetWeaver Application Server user and security administration functions ensure that the attempted use of an individual s electronic signature other than the genuine owner requires the collaboration of two or more individuals. SAP NetWeaver Application Server provides a certified interface to biometric devices such as fingerprint and retinal scanning devices. Look for certified vendors in the SAP Complementary Software Program. SAP NetWeaver Application Server user and security administration functions provide the necessary controls to ensure that no two individuals have the same combination of identification code (user ID) and password. SAP NetWeaver Application Server can be configured to force users to change passwords at various intervals and it provides system checks to prevent users from repeating passwords or using combinations of alphanumeric characters that are included in the user ID. User ID s can also be invalidated, for example, when an employee leaves the company. This clause covers a procedural requirement for customers and is not related to the functions or capabilities of the COMPUTER system. SAP NetWeaver Application Server fulfills this requirement and behaves as demanded by the requirement: This clause covers a procedural requirement for customers and is not related to the functions or capabilities of the COMPUTER system. page 11/12

12 3 References For more information, look up the following references, many of which are found in the SAP Service Marketplace extranet (authorization required): help.sap.com: SAP NetWeaver 04 Security Guide help.sap.com: SAP NetWeaver 2004s Security Guide help.sap.com: Digital Signatures and Encryption SAP White Paper Complying with U.S. FDA Title 21 CFR Part 11 for the Life Sciences Industry SAP White Paper SAP NetWeaver: Providing the Building Blocks for Effective Governance, Risk, and Compliance Management SAP Whitpaper U.S. FDA Title 21 CFR Part 11 Compliance Assessment of SAP Net- Weaver Digital Signatures in SAP Applications SAP Best Practices SAP Notes attachment Digital Signature Tool Implementation Guide FDA Title 21 CFR Part 11 Electronic Records; Electronic Signatures: Final Rule, March 1997 help.sap.com: Records Management help.sap.com: Electronic Records Tool Authors: Dr. Anja Modler-Spreitzer and Dr. Christoph Roller, IBU Consumer Products & Life Sciences, SAP page 12/12