2014 SAP AG or an SAP affiliate company. All rights reserved. GSK Vaccines: Easing Compliance with SAP Process Control
GlaxoSmithKline Vaccines Industry Life sciences pharmaceuticals Products and Services Vaccines Web Site www.gsk.com SAP SAP Process Control application GlaxoSmithKline Vaccines, a division of global giant GlaxoSmithKline, has established a strong control monitoring and audit framework to help guarantee product quality, protect patient safety, safeguard shareholder investment, and ensure compliance with regulatory requirements. An essential goal of this framework is to provide management and regulators with objective evidence that internal controls are operating effectively. With the SAP Process Control application, the company made compliance easier to ensure and to prove. 2 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
Protecting human kind GlaxoSmithKline (GSK) is one of the largest pharmaceutical companies in the world, with almost 100,000 employees and 26.4 billion (US$39.8 billion) in revenues. Its Belgium-headquartered GSK Vaccines division has over 2,600 scientists working on the development of new vaccines. A world leader in vaccine innovation and manufacturing, it distributes more than 900 million vaccine doses to 170 countries annually. The group has discovered 11 world-first vaccines and has one of the strongest pipelines in the industry with over 15 vaccines in clinical development, including for diseases such as malaria, tuberculosis, and cancer. GSK Vaccines is committed to providing vaccines to everyone who needs them, no matter where people live. The company is a primary supplier for international organizations such as GAVI and UNICEF. It provides vaccines to some of the most disadvantaged regions of the world at preferential prices. In 2012, over 80% of its vaccine doses were distributed to these regions. Additionally, GSK Vaccines collaborates with policymakers to establish vaccination policies and ensure vaccines are available to all. >1 million SAP software transactions generated daily GSK Vaccines employs SAP software for all aspects of running its business. It leverages the SAP Business Suite applications and a variety of other analytics solutions from SAP at its eight major sites worldwide as key assets to support growth and globalization. The 10,000-plus users who have access to SAP software systems generate over 1 million transactions daily. 3 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
A single solution for risk and compliance Pharmaceuticals companies are among the most heavily regulated in the world, and GSK Vaccines is no exception. Every country where the company does business has a health authority that enforces regulations to protect patients and consumers, such as the Food and Drug Administration in the United States and the European Medicine Agency in the European Union. The regulations that these agencies enforce are known collectively as GxP, which stands for a number of specific types of quality guidelines such as Good Manufacturing Practices, Good Clinical Practices, and Good Laboratory Practices. The goal of GxP is to ensure that processes involved in developing, producing, and distributing drugs do not negatively affect product quality or efficacy, or patient safety. GSK Vaccines must comply not only with these regulations but with many others, such as financial regulations, including those embodied in the Sarbanes-Oxley Act (SOX) and the Data Protection Directive, which regulates the processing of personal data within the European Union. The company has instituted a strong internal control framework with the objective of ensuring that these regulations are complied with but also that its significant risks are properly mitigated, thereby protecting patient safety, employees, the environment, and company assets and reputation, as well as helping achieve business objectives and safeguarding shareholder investment. The vision of GSK Vaccines was therefore to implement an IT solution that would not only allow ensuring control effectiveness but also aligning controls with the company s risks and objectives, easing the shift to a more proactive rather than reactive approach. 4 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
SAP Process Control delivers functionality and integration Ensuring independent monitoring of compliance against defined standards such as regulations, guidelines, policies, and procedures to measure compliance is a key element of the control framework, because it allows providing management and regulators with tangible evidence that controls are operating effectively. The objective of GSK Vaccines was to implement a single and integrated solution to support control monitoring and testing, therefore building trust in its internal control process, reaching the next level of efficiency through automation, and capitalizing on its IT assets. In SAP Process Control, GSK Vaccines found a solution that meets this objective and its business requirements. Preventing compliance issues entails the use of a proper internal control system that guarantees our significant risks are effectively mitigated. Our vision was to implement an integrated framework empowering users to identify, assess, and treat risks, but also to ensure the effectiveness of controls and, when appropriate, automate their monitoring, explains Christophe Louis, IT project manager for GSK Vaccines. System integration and landscape simplification play a pivotal role in our IT strategy. The major business processes of GSK Vaccines are run using SAP software, so the integration of SAP Process Control, together with the capabilities it offered, made it the best candidate in this context. We wanted a single and integrated solution for ensuring the effectiveness of our internal control process, and that s exactly what we found in SAP Process Control. Christophe Louis, IT Project Manager, GlaxoSmithKline Vaccines 5 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
Fast deployment without assistance The IT staff at GSK Vaccines conducted its own implementation of SAP Process Control, with no need for system integration help. The initial implementation, focusing on IT processes and controls, went smoothly and finished on schedule and within budget in six months. This allowed the team to familiarize itself with the solution and build its own experience. Adapting the application for master-data controls, aiming to guarantee the accuracy and integrity of master data involved in the company s critical processes, went more quickly, taking just three months, because the solution was already deployed and because knowledge was in-house. Finally, the implementation of the core functionalities for a subset of processes in the scope of financial compliance was also an expeditious three-month project. This strong basis will help enable a successful rollout of remaining processes and controls. 6 months Initial deployment, on schedule 6 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
Systematically hurdling compliance challenges SAP Process Control is now the strategic solution used by GSK Vaccines to help ensure the efficiency of its internal control process within IT and finance. In those departments, it contributed to achieving the following objectives: Harmonize and standardize the catalog of internal controls Provide a clear overview of the status of compliance initiatives Enforce accountability Reduce the effort required to monitor activities of internal control groups Automate control testing and monitoring where possible Increase proactivity, identifying and addressing issues on a timely basis Streamline audits, ensuring all required evidence is available and easily accessible Additionally, GSK Vaccines leveraged the automated monitoring functionality of the software to address a completely different need. SAP Process Control was configured to automatically check the compliance of master data involved in the company s critical processes against predefined business rules. By proactively detecting and addressing master-data deficiencies before processes are negatively impacted, the company made it possible to improve business process efficiency and overall quality. 7 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
Easier, faster, more transparent compliance With SAP Process Control as an integral part of its strategy, GSK Vaccines could achieve new levels of efficiency in internal control monitoring. Individuals roles, responsibilities, and accountabilities are more clearly defined and understood. Whenever potential compliance issues arise, the right people are notified and can take action sooner to achieve resolution. Automated testing, where it can be implemented, allows experts to focus on real issues when they occur rather than spend time searching for them. SAP Process Control also helped to build trust in the internal control environment of the company, as information is more visible than ever before and easier to find with only one place to look. Since data is centralized within a single repository, it is easier to identify recurring issues and perform trending analyses or benchmarking. The proof required by external auditors that controls addressing regulatory requirements are effective is now much easier to produce, because it is part of the reports the application generates. GSK Vaccines now also has a streamlined process to manage master-data integrity controls. It effectively identifies data inconsistencies and reports them before they negatively affect business processes, which results in improved efficiency, drives betterinformed decision making, and contributes to quality objectives. With SAP Process Control, it is easier not only to ensure compliance but to prove it. Christophe Louis, IT Project Manager, GlaxoSmithKline Vaccines 8 / 9 2014 SAP AG or an SAP affiliate company. All rights reserved.
GSK Vaccines A never-ending quest GSK Vaccines plans to make further use of SAP Process Control and extend its coverage in the future. But the company s ambitions go far beyond this single application. The objective is to provide our users with a truly integrated risk and compliance framework, says Louis. With the SAP Process Control and SAP Risk Management applications, we embedded two major components of this framework. We must now focus on strengthening their integration to realize the full benefit of our initiatives. There is a lot more to be done, Louis concludes, but we are very pleased with what we have achieved so far. SAP Process Control has not only contributed to building trust in our internal control system but has also demonstrated its robustness to our external auditors. Moreover, we have freed up time for our experts to focus on value-added tasks. CMP20704 (14/03) 2014 SAP AG or an SAP affiliate company. All rights reserved. 9 / 9
2014 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG (or an SAP affiliate company) in Germany and other countries. Please see http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP AG or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP AG or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP AG or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP AG s or its affiliated companies strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP AG or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.