Enterprise Content Management in Regulated Industries

Transcription

1 Enterprise Content Management in Regulated Industries Breaking the barriers to broad adoption of enterprise content management in the life sciences industries Gabor Fari, Microsoft Corporation June 2006

2 Contents 1. Content Management Issues in the Life Sciences Industry Inconsistent Content Where Is the Content? The Problem with Metadata Lifecycle Management and Authoritative Content Overview of Enterprise Content Management Drivers and Challenges Keys to a Successful ECM Solution Maximizing User Acceptance Minimizing the Burden on IT Meeting Diverse Organizational Needs The 2007 Microsoft Office System and Enterprise Content Management in the Life Sciences Industries Microsoft ECM Design Goals Enterprise Content Management Capabilities for the Life Sciences Industry in the 2007 Office System Lifecycle Management Components of the Microsoft ECM Offering Document Management Records Management Forms Management Conclusion Appendix The Microsoft ECM Partner Strategy

3 Executive Summary Businesses in the life sciences industry have been affected in the past 10 years by increased competition and the need to operate in a more closely regulated environment. As a result, pharmaceutical and biotechnology companies face the need to establish better integrated and standardized processes across their organizations. This white paper is aimed at organizations in the life sciences industry that are considering implementing an enterprise content management (ECM) system, organizations that are in the process of implementing ECM systems, and organizations that are rethinking their ECM practices as they refine their content management goals. This paper will examine the state of content management, providing a view of factors such as legislative requirements and information management goals that affect the development and adoption of ECM solutions for the life sciences industry. It will review the challenges that many organizations face in making information available to users at all levels of the organization and in preserving that information for audit and compliance purposes. These challenges will be explored from the perspective of technical capabilities as well as user adoption. The white paper will address the overall importance of implementing an integrated solution that meets specific needs in areas such as records management, document management, and forms management. Finally, this paper provides a view of how Microsoft is addressing enterprise content management needs in the 2007 Microsoft Office system and Microsoft Office SharePoint Server 2007, which provides ECM functionality that can be scaled to meet the needs of the most intensive ECM tasks and makes ECM available to every information worker in an organization. 3

4 1. Content Management Issues in the Life Sciences Industry The need to mange content affects all regulated industries. One important element is the requirement to comply with applicable industry standards, instituted in the life sciences industry by agencies such as the U.S. Food and Drug Administration (FDA), the European Medicines Agency (EMEA), and others. Equally, if not more important, is the need for a broad group of information workers within these organizations to create, access, reference, plan, transmit, publish, and archive documents and records. The ease with which information workers can exchange information with data sources and document or records management systems is an important measure of how well an organization can transform its information workers into consumers of information and producers of business knowledge. The growth in the volume of information, the need for companies to differentiate themselves through the creation and protection of intellectual capital, and legislation that requires organizations to provide auditable records and comply with regulatory requirements have made ECM an imperative for these businesses. For example, a company's research and development group must collaborate effectively with its marketing personnel. In such an environment, the management of information is essential to reduce compliance risks, improve submissions, and increase the speed and quality of development and manufacturing phases. Many life sciences organizations struggle with how to manage content; they face issues such as inconsistency, a lack of discoverability, meaningful categorization, and dependability. 1.1 Inconsistent Content Most companies use templates for authoring content. The lack of a structured authoring environment, however, can result in templates that break or vary. Pharmaceutical companies spend a significant amount of time and money reformatting the same content to meet specific formatting requirements of regulatory authorities that can differ from region to region. Authors should be able to select the type of content they need to create, apply initial metadata, and have the template content pulled automatically into the document. Content authoring should be driven more by forms-based data entry and by templates with defined editable areas. Standard boilerplate text should be stored once and reused in each required instance so that necessary updates and modifications to the text are controlled and take place only once. Another difficult problem is managing links and referential integrity. A typical FDA submission can contain over 100,000 links. Companies check the links manually before finalizing submissions and turning them over to the FDA. Unstructured content stored on file systems, on users computers, or in content management systems needs to be related to other content. Today s submission workflow process consists mainly of authoring a document in Microsoft Office Word, rendering the document to PDF, and then setting links using a multitude of Adobe Acrobat plug-ins. It is an incredibly inefficient process: If the relative path of the target document changes after the links are set, the links break. The ultimate goal is to meet the requirements of an electronic common technical document (ectd) submission. An unstructured content authoring environment, however, does not make it possible to create so-called intelligent documents without major customization. 1.2 Where Is the Content? Content can be created and stored in many locations. Organizations need a central and trusted repository for all content that is subject to regulation. The content should be moved to and managed in this repository based on lifecycle rules. 4

5 1.3 The Problem with Metadata Metadata can be time-consuming and difficult to apply, which means that the metadata associated with a particular document or record is often inconsistent. For example, a laboratory report can also be known as a lab report or a lab. There are a number of types of metadata sources: industry (for example, MedDRA, SNOMED), existing in-house registries, and data dictionaries. An organization needs a variety of user-friendly ways to apply metadata: from a template, at specific stages in the content lifecycle, from smart tags (which allow metadata enrichment), and by users themselves. 1.4 Lifecycle Management and Authoritative Content What is the status of a piece of content? Which is the original and which are the copies? Where is the latest approved version of a document? A large portion of corporate content is redundant, and there is no way to know which document is the authoritative original. Ideally, there should be only one registered copy, and everyone who is authorized to access it should be able to find it. If the authoritative original is a corporate record subject to records retention policies, the same records retention rules must also apply to its identical copies. Organizations must realize that the ECM lifecycle is extensive, moving information from creation and capture, to management, to sharing and collaboration, to publication, and to archival or disposal. These considerations have forced organizations to review the challenges of content management within their enterprises and move beyond traditional filing and document repository systems. 5

6 2. Overview of Enterprise Content Management Drivers and Challenges The digital age has brought with it a wealth of content in a multitude of formats, such as images, text documents, Web pages, spreadsheets, presentations, graphics, drawings, and instant messages, video, and multimedia. The magnitude of structured and unstructured content can be complex and difficult for organizations to manage. A recent study conducted by Accenture, for example, indicates that more content will be created in the next two years than in the previous history of humanity. More than 93 percent of this content will be in electronic formats, and many of the electronic documents generated will need to be integrated with an assortment of information that is still paper-based. Organizations have considered strategies for how to structure and manage the content they generate and consume, from both a record-keeping and a document-management standpoint. Some organizations might have implemented solutions to varying degrees of success and user satisfaction. In their preliminary considerations and tentative implementations, organizations are reminded that explicit requirements within each major area document management, records management, and forms management need to be addressed in the context of an overall ECM strategy. When dealing with document management, for example, some of the particular requirements include establishing standardized content types, version control, workflow processes, document lifecycles, and collaboration. In records management, the requirements include establishing retention and expiration policies and minimizing outdated information within the organization. These specific requirements and others should all be addressed with an ECM solution. Several factors influence ECM solution development. Regulatory requirements such as the U.S. FDA 21 CFR Part 11 and legislation such as the Sarbanes-Oxley Act have changed ECM from an optional, nice-tohave capability, to a must-have system. Enforceable document retention policies, systems for managing unstructured information, and consistent records management are all requirements from the standpoint of compliance legislation and regulations. The requirements of 21 CFR Part 11 on industries regulated by the FDA has been wide-ranging. The rule affects electronic records stored in databases as well as electronic records created by word processors, spreadsheets, and graphics programs. The capabilities of conventional productivity applications need to be supported by a solution that can control the integrity and security of electronic records authored in those tools. Although legislative requirements and auditing concerns are main factors for many companies, other factors are also influential. Organizations need to exert control over an abundant volume of records and documents, with the direct benefits of reducing task duplication and minimizing the time employees waste looking for out-of-date documents or, worse, re-creating documents. In addition, managing content helps ensure that the right information, in the right format, reach decision-makers. After decisions are made, content management practices help preserve the context of those decisions as part of institutional memory. There is also a need to automate business processes to facilitate how content needs to be handled and to replace manual paper processing. The aim in automating these processes is to streamline workloads and secure greater throughput. Organizations look to ECM solutions to help with the process of authoring and publishing information to their intranets, extranets, and Internet sites without additionally burdening their IT departments. Another challenge that an organization needs to overcome is integrating the various components of an ECM solution. For example, an organization might start by implementing a records management solution and then quickly find that they also need collaboration capabilities to develop content that is under records management. An organization usually has one or more ECM solutions already in place that have been deployed to address specific needs in a particular department. As an organization moves toward having a company-wide ECM strategy, it becomes important for a new solution to interoperate with 6

7 existing solutions using industry standards. An organization needs a way to gradually build up its ECM strategy by deploying components in a way that doesn t require constant user re-training or pose an architectural and deployment challenge for IT. User acceptance of a solution is among the largest challenges. Even if users accept implementing an ECM solution in principle, they will not embrace a system unless it can be integrated well with their current work styles. A solution must be intuitive and should not require users to rely heavily on their IT department. The solution must also fit into the organizational culture. For example, an organization that operates with strong individual teams is not likely to embrace a solution that is rolled out to the entire enterprise. These same departments, however, might embrace a solution that makes collaboration easier for their teams. Because user adoption is essential to the success of a solution, ensuring that users recognize the usefulness of ECM in streamlining their workloads is very important. 7

8 3. Keys to a Successful ECM Solution Certain goals of ECM can be clearly expressed to audit-proof records, for example, or to enhance collaboration. ECM challenges, however, can be vague and elusive. What does user acceptance mean, for example? An organization knows that user acceptance is important, but it might not accurately predict which aspects of a system will result in user resistance. Three major factors that lead to a successful ECM implementation will be examined in greater detail in this section: user acceptance, the need to find solutions that minimize the burden on IT support, and the need to find a solution that meets diverse organizational needs. 3.1 Maximizing User Acceptance A critical factor in the success of an ECM solution is how well the system is embraced by its users. Even if all others goals are met, a system that fails in this regard will have limited success. Conversely, users will praise a system that they believe streamlines their workload, improves their productivity, and makes their jobs easier. How can an organization ensure that users accept a solution? It should start by considering the individual goals and needs of users. Most users already have more work to do than hours in the day, and they might not be enthusiastic about a system that adds to the complexity of their tasks. A successful ECM solution fits into users routines rather than makes users change to suit the system. If users are asked to specify properties for a document, for example, they will do so more willingly if the mechanism for adding this information is provided within the authoring application with which they commonly work. Systems that require minimal training and enable workers to proceed on their own will be embraced more thoroughly. A familiar and intuitive user interface will help users accept a system as one of their work tools rather than as a system that introduces new procedures. Solutions that help users find documents and information more quickly and accurately, that expedite approval processes, and that minimize task duplication will be embraced and championed as well. 3.2 Minimizing the Burden on IT The implementation of an ECM solution also presents challenges. Every solution will encounter some difficulties in users' adopting it, but the best fit will be a solution that minimizes IT input and enables users to integrate the solution into their own work schedules. An ECM solution that requires extensive IT involvement, professional developers, or consultants to set up new sites and workflow processes leaves many business needs unresolved, even though the organization has invested in the technology to meet those needs. A solution with a manageable learning curve and minimal IT reliance is an important element of successful deployment. By making records management an extension of users' existing workflow, a system can distribute the responsibility for ECM more evenly across the organization. Making the users who are most familiar with the records responsible for record-keeping and document organization makes sense also from the standpoint that those users will derive the greatest benefit from the system and have the greatest personal investment and interest in making sure records are updated day-to-day. In addition to enabling users to be self-reliant and minimizing IT support calls, a solution that is well integrated enables IT personnel to manage a larger system in a centralized manner. Centralized deployment enables the IT department to administer the system consistently across all areas using common tools and deployment models, which is an equally important time-saver for IT. 8

9 3.3 Meeting Diverse Organizational Needs Finding a suitable ECM system can involve a lot of consideration. Ideally, after the choice is made, that solution will suit the ECM needs of an organization for many years. Understanding the long-term goals for an ECM solution is essential; the initial requirement for ECM development might be limited to a single business function or process, but choosing a solution that is scalable and that can meet future needs makes sense. With a well-integrated solution, an organization is free to ease its users into the content management process by, for example, starting with a records management initiative that performs the double duty of ensuring compliance and getting users accustomed to the system. As users realize the benefit of the records management system, the organization can proceed to deploy regulated document management components. A unified solution is important in this scenario because it enables the second and third deployments to occur smoothly without extensive IT investment or user retraining. The goal of a single, coherent ECM architecture is inherent in this overall approach. At a high level, meeting diverse needs means selecting a solution that is easily configurable and a deployment that fits into the organization s culture. If the organization works most effectively in teams, a departmental or team-based deployment might be an effective starting point, followed by a larger overall deployment. In a culture of this type, teams will be more likely to embrace an organizational rollout if they first witness the success of a solution within their department. Conversely, if an organization is centralized and accustomed to large systems, a rollout throughout the enterprise might be most effective from the start. Choosing a system that is extensible enough to be deployed in either manner provides the greatest flexibility. Another reality of an organization s IT environment is the multitude of applications that are currently in place to support different business processes. An ECM solution that integrates easily with a company s existing applications, using industry standards, will have the best chance of success. An organization can continue to benefit from applications already in place that serve specific functional areas as it deploys an ECM solution. Lastly, while an out-of-the-box solution will handle most functions, organizations will need to build capabilities that are specific to their vertical or compliance requirements. It is important to have a solution that can be configured and customized without excessive deployment costs or IT and developer training. 9

10 4. The 2007 Microsoft Office System and Enterprise Content Management in the Life Sciences Industries Microsoft Office SharePoint Server 2007 comes with comprehensive ECM capabilities. The Microsoft ECM offering provides organizations with a solution that can be used to manage the lifecycle of different types of content, including documents, forms, images, messages, instant messages, and others. User acceptance and adoption will be fostered by a user interface that is integrated with Microsoft applications such as Office Word 2007 and Office Outlook 2007 as well as many Web browsers. Integration with familiar tools enables users to make ECM an extension of their day-to-day workload without having to change the way they work. 4.1 Microsoft ECM Design Goals The Microsoft vision for ECM in Office SharePoint Server 2007 differentiates its offering from other offerings in the market today. The vision is based on the following tenets. Designed for Widespread User Adoption The Microsoft ECM offering has been designed with ease-of-use in mind, based on tools and a user interface that are familiar to users and that do not require a lot of training. By basing its ECM solution on the Windows SharePoint Services environment, Microsoft offers users a recognizable, browser-based interface that is the same irrespective of the type of content with which users work. Integration with the Microsoft Office environment makes the Microsoft ECM solution a natural extension of the authoring process and provides users with the means to adopt and support an organization s ECM strategy. With this integration, the adjustment users need to make will be minimal. They will be adding to the work they do with documents routinely rather than having to learn new processes. Although ECM capabilities are accessible using previous versions of the Microsoft Office system, the 2007 system has a number of new integration points with productivity applications designed for information workers. These include starting a workflow from the File menu of a client application, notifying users of a pending workflow task within a document, exposing document properties through a document information panel, displaying site policies on the document, and taking library files offline in Microsoft Outlook. Designed to Deliver an Integrated ECM Solution The philosophy behind the Microsoft ECM solution is to create an integrated solution based on a common framework of components and technologies, designed for scalability, interoperability, and stability. The unified architecture provides a common set of services such as the Web Part framework, integrated search, integrated user management and user rights, digital rights management, workflow, a security model, and collaboration as well as a unified storage infrastructure for storing ECM objects of all types and sizes, including documents, messages, forms, images, discussion threads, lists, Web links, and more. This architecture, shown in the following figure, ensures integration and consistency across the various ECM components, such as document management, records management, and forms management. The Microsoft unified ECM architecture also supports the work of individuals, teams, and business units on intranet, extranet, and Internet sites without requiring the use of disparate systems for these different scenarios. New functionality can be gradually and easily added without the need to redesign the underlying infrastructure. 10

11 A conceptual organization of the ECM components and services in Office SharePoint Server 2007 supported by Windows SharePoint Services and the 2007 Office system Because of this common architecture, users can reuse applications, code, and site content, enabling a common development and deployment experience for developers and IT professionals respectively. It also means rapid deployment, low training costs, and a minimal burden on IT departments to deploy and maintain multiple solutions for different business functions. The storage infrastructure of the Microsoft ECM solution is common across all ECM components. This infrastructure uses the familiar Windows SharePoint Services constructs of items, lists, sites, and site collections to define the repository structure for storing different types of content. The benefit of this approach is that an organization s IT department has a consistent way of deploying and managing content repositories irrespective of the solution or type of content. In addition, the 2007 Microsoft Office system and the Windows SharePoint Services platform provide capabilities that can help corporations better ensure that the right content remains authoritative. Some examples are as follows: SharePoint libraries are integrated with Office Outlook 2007 and Exchange 2007, allowings users to easily declare as records from their Office Outlook 2007 client for long term retention in Office SharePoint Server Microsoft Enterprise Search exposes identical copies of the same document, which allows for a programmatic way to eliminate redundant content. Office SharePoint Server 2007 supports the automatic creation of slide libraries from stored Microsoft Office PowerPoint slide decks. This support enables centralized control of corporate content and styles and helps users assemble individualized presentations from reusable slides stored within the slide libraries. If an individual slide needs to be updated, it needs to be done only once in the central library; changes are automatically pushed to the individual presentations that make use of that slide. Designed for Heterogeneous Environments Coexistence and interoperability with the myriad of systems available to customers today is fundamental to the Microsoft design philosophy. Microsoft is committed to open architecture through its publication of 11

12 APIs, support for a design philosophy based on common protocols and open standards such as XML and SMTP, or support for Web services. Integration with customer hardware, software, and network environments is and always will be a critical requirement. Microsoft enables customers to use their existing IT investments by providing integration points and hooks for interoperability. Of course, Microsoft will continue to add to the extensive list of Web Parts for integration with widely used applications such as SAP so that an ECM solution can extend smoothly into every aspect of an organization s working life. Designed for Extensibility Although Microsoft is committed to delivering a comprehensive set of out-of-the-box ECM capabilities, Microsoft product teams have devoted substantial efforts to understanding the specific needs of industries and organizations and have tailored product extensibility to support them. For example, the requirements for what should occur when a document expires seem to differ from customer to customer. Instead of making an inflexible design decision, Microsoft treats document expiration in its ECM solution as an extensible event. Similarly, organizations can build their own content types, policies, and workflows within the Microsoft ECM framework. This extensibility ranges from configurability of built-in capabilities to customization by using development environments such as Microsoft Office SharePoint Designer and Visual Studio Third-party client applications can also access Microsoft ECM functionality using Web services. Microsoft supports a network of partners and independent software vendors (ISVs) who can provide applications and solutions for specific needs. 4.2 Enterprise Content Management Capabilities for the Life Sciences Industry in the 2007 Office System The Microsoft ECM offering consists of a set of common services including workflow, metadata, policies, library services, security, collaboration, and search that are available across the various ECM components. The same review/approval workflow is available to users working collaboratively in a document management environment and authors who are developing content in a Web content management environment. Similarly, functionality such as check-in/check-out, versioning, retention and auditing policies, and search are all available in a consistent manner whether the organization is implementing a document management, a records management, or a forms management solution. This approach requires less training of users as new ECM components are deployed, and any extensions added by an organization (such as new workflows, policy templates, or search interfaces) can be reused. 4.3 Lifecycle Management The Microsoft ECM offering provides an extensible platform to address the lifecycle requirements for regulated content management. The following illustration is an example of a simple diagram of content lifecycle management. The Microsoft ECM solution provides capabilities for managing content in each stage. 12

13 The 2007 Microsoft Office system and the Windows SharePoint Services platform can address each stage of the content management lifecycle. Roles Based Access Control The majority of ECM systems on the market today are set up to control access to content based on access control lists and groups. This model is powerful, but it is not flexible enough to cover the needs of a dynamic organizational structure or to provide detailed control of content. Roles Based Access Control (RBAC) is designed to address this requirement. A simple example that addresses the problem is the socalled 3C model: Controller-Contributor-Consumer. Many regulated industries use this model to control access to objects. Let s take an example derived from standard operating procedure (SOP) authoring and approval: a restricted set of knowledge workers (Controllers) have access to SOP-related content. These workers usually have the rights to author SOPs and approve changes. A larger group of workers (Contributors) have the right to request changes to SOPs and to initiate change request workflows, but the changes have to be approved by a user within the Controller group. An even larger set of workers (Consumers) need access to the released SOPs, but they can only consume the information and cannot request changes. This model is simplified but variations of it are used effectively in many business scenarios. The roles for knowledge workers will change over time within an organization, and roles also depend on the content type: the same worker will be a Controller for one type of content and a Contributor for another. The technology foundation in the 2007 Office system is extensible enough to support RBAC under the Controller-Contributor-Consumer model. Digital Signatures and SAFE In the 2007 Microsoft Office system, organizations can control who signs documents by issuing certificates to authorized personnel. In addition to a certificate, a Smart Card containing a user s pass phrase protected certificate can be used to sign documents. This provides added security by allowing only the signer to apply his or her signature to the document. Also, documents cannot be altered once they are digitally signed. These capabilities help support FDA 21 CFR Part 11 requirements that only authorized personnel sign a document and that the signer s name, signing date, and the meaning of the signature for any signing event (for example, approval or rejection) be recorded. The digital signatures capabilities of the 2007 release can also be extended to support SAFE signing capabilities (an emerging life sciences standard for identity assurance and digital signatures.) 13

14 Digital Rights Management IP Protection Securing enterprise content and protection of IP assets is of paramount importance to corporations, and essential for compliance. In today s environment, content is relatively secure as long as it is within the confines of a repository. Life sciences companies have typically relied on rendering documents to PDF so that released documents cannot be edited. This approach addresses only part of the problem because it does not prevent obsolete documents from staying in circulation. The 2007 system has native capabilities to render documents to PDF. Microsoft Office technology also allows content that is outside the repository to be secured on the basis of policies as well by using the Rights Management Server. An access control policy set up for a SharePoint site can also be maintained for documents on the desktop. These rights also extend to expiration, printing, forwarding, and copying, thereby ensuring a higher level of content security than has been possible with traditional approaches. Structured Content Authoring and Single Source Publishing Structured content authoring has long been identified as a need by the life sciences industry. However, few initiatives have succeeded due to the high cost and complexity of such systems, and through a lack of user adoption. The 2007 system will move structured content authoring into the mainstream. The OpenXML format also makes it easy to apply industry schemas such as SPL and PIM to the authoring environment. In addition, some common content types, such as the Dublin Core Standard Document, are available out of the box. The Microsoft Office OpenXML format, combined with server-side functionality for specifying content types, gives an organization the ability to set up an environment that facilitates the reuse of content and that enables authors to create documents with a consistent look and feel. For example, the Office OpenXML format enables an organization to define templates using an XML schema that suits their organization and is based on their business requirements. A template can be associated with a content type and its related workflow and information management policies in the document library. A template enables an organization to control which fields in the document can be modified and which are protected from change. Reuse of content is facilitated because the content is tagged with the appropriate XML and can be programmatically processed for document assembly, distribution, and conversion. Standardized content can be populated programmatically based on metadata, a mechanism that will enhance productivity and also promote effective content reuse. The XML capabilities in Office also make it possible to connect documents to databases (for example, data from clinical databases into clinical study reports) so that relevant data can be inserted into the document during the authoring phase. The authoring experience becomes more of a forms-based data entry process because documents can be structured with editable and non-editable areas. The problems of breaking templates and reformatting documents will also largely disappear with the move to an XML format. Comprehensive Metadata Management The management of metadata is a primary issue in ECM. Legacy ECM systems store metadata in separate data tables and associate the metadata with documents. This model works as long as documents reside in the legacy repository. However, there is no way to associate custom metadata for offline content. Some companies are using document properties in Office to add metadata, which is then synchronized with the content repository. This approach is often cumbersome, however, and requires customization. The 2007 system offers extended metadata capabilities that are tightly integrated and synched with SharePoint when a document is checked in or out. The 2007 system also addresses the need to validate metadata against corporate data dictionaries. The 2007 system has a metadata panel a Microsoft Office InfoPath form that enables intelligent binding to back-end data dictionaries. In addition, the new XML format of documents in the 2007 system, coupled with the capabilities of the InfoPath Document Information Panel, helps document authors turn the traditional process on its head. Users can now select the relevant 14

15 metadata and content type, and their selection automatically creates the document template based on reusable content. The 2007 system also enables programmatic document numbering through its metadata capabilities and InfoPath. Document Assembly, Publishing, and Delivery The new ectd requirements have brought a fundamental shift in the concept of publishing. The FDA now requires an ectd-compliant electronic submission, which is essentially an XML backbone with associated detailed documents and metadata rather than the monolithic PDF publications that were previously used. ectd is more about content lifecycle management than publishing. ectds are typically assembled by using third-party tools, using a pull approach: the content is sourced from a repository, the ectd is built, sent to the FDA, and then archived back to the repository. Some of the leading ECM vendors are starting to build ectd capabilities into their systems, where the ectd hierarchy is created within the repository, and then pushed out as an FDA submission. However, the publishing process is still dependent on the creation of the correct hierarchy. A better approach is to use the metadata capabilities of the 2007 system s authoring environment to enable an on-demand publishing engine to assemble the ectd based on metadata. The XML format of the 2007 system also supports building sophisticated link management capabilities, enabling corporations to move from a batch approach to a concurrent approach. Links can be set in Office and rendered to PDF, and they will work the same way from within the PDF file. Authors can set source and target anchors within Office documents during the authoring phase and render these documents to PDF when compiling ectd submissions. This approach ensures referential integrity of all links published to PDF. Finally, XML also enables the content to be repurposed to a variety of content delivery formats: A4 paper layout, PDF, XPS, HTML, and mobile devices. Conversion of Legacy Content and Metadata Enrichment One quandary for managing content in the life sciences industry is the need to take structured data, convert a large portion of it to unstructured data that is required for FDA submissions, and then convert it to structured data again. The XML format of the 2007 release will help streamline this process. In addition, it will also be possible to convert legacy binary formats in batches to a structured 2007 system format and apply text mining and metadata enrichment techniques to the legacy content currently filling up file systems in most companies. This ability not only reduces the compliance risk of legacy content, it also enables an organization to derive enterprise knowledge and value from it. Long-Term Archiving The need to archive content extends beyond moving documents to cheaper storage media based on lifecycle rules. Under FDA guidelines, long-term archiving of regulated content is also mandatory. Several industry organizations have long proposed XML-based formats for long-term archiving. The main benefit of XML is its open nature and human-readable format. Until now, the problem was that content had to first be rendered into XML; because of a lack of standards, it was difficult to convert the content back to its original format in full fidelity. The XML Paper Specification describes the XPS Document format, which produces a paginated representation of an electronic document in an XML-based format. The XPS Document format is an open, cross-platform document format that enables users to create, share, print, and archive paginated documents. XPS Documents use a file container that conforms to the Open Packaging Conventions. The 2007 Microsoft Office system also uses the Open Packaging Conventions for organizing data into files. This enables businesses to manage documents created with the 2007 Microsoft Office system and XPS Documents in the same manner. The support for XPS in the 2007 release enables long-term archiving of documents in a neutral human-readable format. 15

16 5. Components of the Microsoft ECM Offering The main components of the Microsoft ECM solution document management/collaboration, records management, and forms management are provided on a unified platform based on Windows SharePoint Services. IT maintenance time is reduced because the solution can be deployed and managed using common tools and services, and end users can take a more active role in activities such as authoring and publishing content and declaring business documents as records. This section will summarize the capabilities of each component and provide some sample screen shots of the 2007 system user interface. 5.1 Document Management The Microsoft ECM solution helps organizations realize their document management goals by enabling appropriate policies at every step of the lifecycle of the document. Document management capabilities in Office SharePoint Server 2007 and Windows SharePoint Services harness the collective expertise of the organization and facilitate collaboration through document check-in and check-out, version control, and out-of-the box workflows to automate the approval and review processes. Centralized repositories improve information discovery. Policies can be set that facilitate a document s tracking throughout the organization by using labels and barcodes. Additionally, centralized and managed storage results in an increased ability to predict storage requirements and better protect information assets against unauthorized use and inadvertent loss through item level security and Information Rights Management. Capture Content Successful ECM solutions depend on the ability to capture content, whether paper or electronic, and bring it into a managed environment. Integration with third-party scanning and imaging vendors allows paper content to be saved in electronic formats within the library along with the required metadata for proper processing. In order to encourage users to store and retrieve content from a centrally managed location, organizations can customize the Open and Save dialog boxes to promote these storage locations. Categorize and Organize Content In order to be useful to users within the organization, content must be categorized, saved, and organized appropriately. The Document Center is a special template designed to be the central repository for a division or the entire organization. These large-scale sites are generally designed, deployed, and managed by a professional IT staff and provide a consistent way for all business units to organize and categorize information. 16

17 The Managed Document Repository is the central location for storing organizational content Most organizations produce sets of documents that play a distinct role in the business and share common characteristics that describe them, the policies that apply to them, and the processes they undergo. For example, pharmaceutical companies create clinical trial reports and manufacturing companies produce specifications. Content types enable users to define document sets based on their shared behaviors and apply consistent metadata for categorization. Each content type can specify a document template, a schema, edit and display forms, policies, workflow processes, and even customized behaviors. Some common content types, such as the Dublin Core Standard Document, are available out of the box. Using content types provides a way to standardize these characteristics across different libraries and sites throughout an organization and provides a way to categorize content in a standard manner. The only way for this process to be successful, however, is for end users to consistently enter the metadata that is defined for a particular content type. To help users do this, a customizable Document Information Panel is displayed at the top of the document that allows for entry of metadata and other pertinent information as required by that content type. 17

18 End users can easily enter metadata from a 2007 system client application Find and Retrieve Relevant Information One goal of moving information into a managed environment is to enable users to more easily find the relevant information they need and to facilitate the reuse of knowledge in an organization. The Microsoft ECM offering has an integrated search engine that uses the latest search algorithms from Microsoft research to return fast and relevant search results. Users can find information not only from the content repository but also from sources such as enterprise resource planning (ERP) systems and file shares. A search can include results for various file types and data sources using extensibility mechanisms and can find information and data in addition to people who are experts in the search topics. These experts are found and organized by their degrees of separation from the user based on the user s known contacts. Document Collaboration When multiple authors are likely to be working on the same document, check-out and versioning features are helpful for smoothing out collaboration. The Microsoft ECM solution facilitates collaboration on documents by enabling library functions such as check-in/check-out and major/minor versioning. Requiring authors to check out a document before making changes ensures that everyone collaborating on a document knows who is making edits at any given time. With major and minor versioning, authors can distinguish a major revision that includes substantive changes from a minor revision of only spelling and wording. The version compare feature adds further checks to this process by enabling users to compare the differences between any two versions of a document. Item level security ensures that 18

19 appropriate rights (such as modify, read, and so on) are given to the various people who are collaborating on the document In order to facilitate collaboration there are several out-of-the-box workflows available. These include the approval/review and signature collection workflows. To initiate a review or approval process, for example, an information worker selects the appropriate workflow from the File menu within Microsoft Office Word 2007 and fills out the form to indicate who should participate in the workflow and how long they have to complete the workflow task. This process posts the document to the server if it is not already stored there, creates a task for each of the participants, and sends them an message to let them know about the task. When participants receive a notification and open the document, they can click the workflow task in the document and fill in the review or approval completion form. Participants can follow the progress of a workflow by checking the status page associated with the workflow. In addition to standard status information such as outstanding tasks, the status page also includes history information that is specifically designed by the workflow author. Tracking of a review/approve workflow for a document Organizations can create custom workflows using Visual Studio 2005 or Office SharePoint Designer. After a workflow is deployed to a site collection, it appears in the list of workflows that list administrators can add to content types, lists, or libraries. When a workflow is added to a document library or list, the workflow is then available so that end users can start the workflow for any item in that list. More information on the workflow foundation capabilities can be found at: 19

20 Set Policies to Audit Usage and Track Information When documents leave the repository (as paper printouts or individual files distributed through , for example), contextual properties should be included in those documents. Labeling and barcode policies enable users to reference important information, such as approvals and associated documents, within a document. Label policies can be set to specify which document properties should be included in the label and how the label should be formatted. When a user creates a document that is subject to those policies, the Office application inserts the label into the document content and will update the label as needed when the properties change. The Microsoft document management solution helps users close the loop between managed documents and printed copies by automatically assigning individual barcodes to documents. When users work with printouts of documents that include barcodes, they can easily locate the original document by searching using the barcode. After they ve retrieved the original, they can determine whether their printed copy is out of date or read additional document information stored in the SharePoint library. For many organizations, it is critical to be able to audit and record events that occur with the content in the organization s document management server. The Microsoft document management solution provides several features that enable companies to create and analyze audit trails for their ECM systems, starting with audit policies and a robust audit log that records events such as when content is viewed, edited, published, and so on. Site administrator actions can also be audited to keep track of local changes to computer configurations that might be used for malicious activities. Reporting on audit logs can help organizations verify and document regulatory compliance or investigate potential concerns. It is challenging to implement consistent information management policies across a broad organization with a wide variety of sites. To help organizations overcome this challenge, Microsoft helps policy decision-makers such as IT staff, records managers, or compliance officers to define site policies that information workers can apply without worrying about the specific details of the policy. While the out-of-the-box policy features support many common policies, organizations can have unique needs that require additional policy features. For example, an organization might have a policy that requires files to be saved in a specific format. The policy framework enables organizations and independent software vendors to author custom information management policies that will appear on the policy settings page. Protect Information To protect information in a repository, library owners can set specific security permissions on individual folders or files to ensure that only authorized people have the right to view, change, or delete content from this library. To protect documents after they have left the repository (for example, when someone downloads a file to a laptop), administrators can set an Information Rights Management (IRM) policy on a library that is applied to a document when it leaves the repository. This ensures that sensitive formation is not inadvertently sent outside the organization or stolen from a laptop. A recycle bin enables end users to retrieve documents that they might have accidentally deleted. 20