Decommissioning Case Study A Risk-based Approach to System Retirement and Data Migration Chris Clark Napp Pharmaceuticals Ltd Agenda Overview System Retirement Data Migration Annex 11 considerations Case Study Replacing EDMS at Napp Pharmaceuticals in Cambridge 1
Acknowledgement Thanks to Rob Stephenson for many of the images and concepts contained within this presentation System Retirement 2
Overview of Operation Phase Development Phases Reporting and Planning Release Release & Handover Potential retention, migration, destruction Specification Verification Retirement Configuration (& Coding) Changes Risk Management, Design Review, Change and Configuration Management, Traceability, Document Management Supporting Processes Concept Project Operation Retirement Supplier Involvement Phases and Supporting Processes Within Life Cycle Why Retire Systems? No longer meet current or emerging business needs / regulatory requirements No longer supported by the supplier Standardisation / reduction efforts e.g. following acquisitions / merger Site / Department closures 3
GAMP GPG Definitions Retirement System removed from active operations Decommissioning Controlled shutdown of a Retired System Disposal Data, documentation, software or hardware permanently destroyed Ref.: GAMP Good Practice Guide: A Risk-Based approach to the Operation of GxP Computerized Systems Retirement Decommissioning System Retirement Process Disposal 4
Data Migration Data Migration Transferring data between storage types, formats, or computer systems Triggered when system is: significantly modified or upgraded replaced with a similar system permanently retired Follow a project lifecycle 5
Data Migration Process Project Scoping and Planning Data Preparation and Mapping Translation and Verification Testing Final Planning and Migration Annex 11 Considerations 6
Risk Management 1. Risk Management Risk management should be applied throughout the lifecycle of the computerised system taking into account patient safety, data integrity and product quality. As part of a risk management system, decisions on the extent of validation and data integrity controls should be based on a justified and documented risk assessment of the computerised system. Project Phase 4. Validation 4.3 An up to date listing of all relevant systems and their GMP functionality (inventory) should be available 7
Validation 4. Validation 4.8 If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process. Operational Phase 7. Data Storage 7.1 Data should be secured by both physical and electronic means against damage. Stored data should be checked for accessibility, readability and accuracy. Access to data should be ensured throughout the retention period. 8
Other Considerations System Dispositions Archive Report Records archived to hard copy or.pdf Archive Physical to Virtual (P2V) Snapshot of system (application + database) captured Extract / Migrate Data extracted or system migrated to new Host Generally global systems ownership elsewhere Transition New System Owner becomes responsible No Retention Decommission and Disposal only 9
Guidance / Support Company Archive / Retention policies No need to retain electronic data if paper records are designated as the master record Virtualisation of Intel-based systems (with e-sigs) e.g. CDMS, EDMS Extraction of data to flat files from relational databases e.g. MRP Reports, automation systems source code Creating Retirement Implementation Protocols Detailed scripts for execution of retirement / decommission / disposal Including data / records archival Tasks to be performed Evidence to be retained to demonstrate compliance with Plans GxP systems approval by Quality Unit 10
Executing Retirement Implementation Protocols Tasks executed Evidence collected SMEs signed off at script level GMP Systems - Quality Unit final signatory of executed protocols Final Reports Create appropriate reports Confirm transfer of ownership of data and records All System Transition Change Controls completed Final Site Report issued if appropriate 11
Retirement & Data Migration Case Study Retirement & Migration Case Study Replacement of Electronic Document Management System Legacy system based on Documentum infrastructure Replacement based on SharePoint infrastructure 12
Data Migration Process 1. Qualifying the migration utilities to be used for the migration effort 2. Migrating specified documents and related metadata into the destination system 3. Migrating legacy document metadata to a human-readable archive and files to a secured file share Data Migration Overview Each process step is tested 13
Documentation, Documentation, Documentation! Data Migration Plan Data Migration Test Protocols Migration Tools Testing Post Load Verification Data Migration Report Migration Prequisites Initiate moratorium to freeze source system Formally install EDMS Production environment per approved IQ Protocol Formally configure EDMS Migration and Production repositories per approved application configuration specification 14
Disposal Recycle / reuse / scrap Modify network / infrastructure Configuration Items Update system descriptions Remove from Asset register Issues Encountered / Identified Error related to SharePoint parser Managing changes of field name and user responsibilities Imported documents inheriting default library permissions 15 x Test Protocol deviations Typographic errors Infrastructure configuration e.g. printers 15
Keys to Success Potential to impact existing systems, data and processes assessed and mitigated prior to retirement / migration Involvement of business, vendors, quality unit and IT SMEs Good preparation and planning Thorough testing Communication Thank You Questions? 16