Hosted by

From Regulation To Desperation

A Life Sciences case study in compliance

Richard Scannell, GlassHouse

Hosted by

Background

IT affecting regulations are increasing in number and visibility

Most organizations are ill-prepared to respond and react

Vendors have finally found their next Y2K

Audits shift from faith-based to evidence-based

Failures are well-publicized; successes are unknown

Hosted by

Introduction

A Pharmaceutical Case Study

Understanding the business lifecycle

Mapping to the data lifecycle

The Audit Process

Classifying Datasets

Mapping to technical requirements

Hosted by

Who are your regulators? Why?

Pharmaceutical World

FDA – Keep Bad Products Off Market

• Regulating Companies processes in bringing products to

market

• Companies have to provide documented evidence that

their products meet quality standards

Companies – Get Products To Market

• FDA Approval Times Increases

• Declining Profitability

Hosted byThe New Drug Development Process

Short-Term

Long-Term

Accelerated Development Review

Treatment IND

Parallel Track

Phase 1

Phase 2

Phase 3

PRE-CLINICALRESEARCH CLINICAL STUDIES NDA REVIEW

SYNTHESISAND PURIFICATION

ANIMALTESTING

INSTITUTIONALREVIEW BOARDS

INDUSTRY TIMEFDA TIME IND SUBMITTED NDA SUBMITTED REVIEW

DECISION

SPONSOR ANSWERSANY QUESTIONSFROM REVIEW

SPONSOR/FDA MEETINGS ENCOURAGED

ADVISORY COMMITTEES

EARLY ACCESS:SUBPART EE

E

E

E

Source: www.fda.gov

Hosted by

Data Requirements

InternalData

Contract Service Organizations

Pre-Clinical Research

BiotechnologyPartners

Clinical Trials(Phase 2)

New Drug Application (NDA)

InternalData

Electronic Submission

Investigational New Drug Application (IND)

• Animal studies• Clinical tests• Drug components• Manufacturing process

Hosted by

Governance: Validation and qualification

Movement of data up or down the value chain

Architecture: Hardware/software

requirements

Processes and standards

Align Value with Cost

Occupancy: Appropriately congregate data

by value and rationalize storage requirements at each phase

Hosted by

Data placement based on device management rather than data management

No alignment between business value of data and infrastructure

Unknown or high TCO

Very little focus on Process Management

More Typical Approach

Hosted by

Audience Response

1. I understand the business lifecycle and corresponding data lifecycle of my business.

2. I know how we manage data but I don’t have much appreciation how this ties to our business performance.

3. I’m the IT guy; the business never talks to me.

4. I keep the lights on; what more do you want?

Hosted by

Hosted by

Regulations & Audits

21 CFR Part 11 – Electronic Records and Electronic Signatures

50% of all FDA Inspections include some aspect of

computer system quality and compliance

Computer Systems Compliance one of most common

reasons for a 483 (Violation)

Expectation is that companies implement global

procedures – major IT implications

Hosted by

Validation – The Missouri Factor

Validation - documented proof that a product or process will repeatedly produce a product to the stated specifications, i.e., Prove a Process Works.

"Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its pre-determined specifications and quality attributes". 

FDA Guidelines on General Principles of Process Validation, May 1987.

Specifications; Qualifications; Verifications; Calibrations; Certifications

Hosted by

Noted Recent Issues in FDA Inspections

Insufficient Change Control

Lack of or Inconsistent documentation

• System Overviews

• GMP applications used over a network

Failure to control and archive GMP information communicated via e-mail

System security and user authorization

Insufficient GMP training of IT Staff

Hosted by

Data Classification Maps to Technology

Define Classifications • Location in the Lifecycle

• Requirements and Attributes

Regulatory issues

Policies

• Storage

• Backup/Restore/DR

• Archive

• Security

Hosted by

Risk

Pre-ClinicalData

Pre Clinical Clinical Submission

IND NDA

(3.5 – 6 yrs) (7m-1yr) (~ 3 yrs)(m-2yrs)

Pate

nt A

pp

lication

(Approx 2.5 yrs)

Pre-ClinicalData

Phase 1 Clinical TrialsINDPre-Clin

Phase 2Clinical TrialsPhase 1 INDPre-Clin

Phase 3 Clinical TrialsPhase 2 and 1INDPre-Clin

NDA SubmissionAnd ApprovalClin DataINDPreclin data Production

All Data

Retirement

Value

Cost

Production

Hosted by

Define:1.Logical Data Classes2.Occupancy 3.Data Management Policies

Dat

a C

lass

ific

atio

nA

rch

itec

ture Physical

Mapping & Tier Design

System Policies

R-H

Regulated Business Critical OtherHigh Med Low

R-M R-L B-H B-M B-L O-H O-M O-L

High Med Low High Med Low

R-H B-H R-M R-L B-M O-H B-L O-M O-L

TIER1TIER1 TIER2TIER2 TIER3TIER3 TIER4TIER4

Arc

hit

ectu

re Tape Based

Backup on RAID set

Multiple SNAP copies

Tape Based Backup on RAID

set

Remote replicationMultiple SNAP

copiesTape Based

Backup on RAID set

Technical implementatio

n on standardized technology

Data Classification Maps to Technology

Hosted by

Data Classification Model

• Drives procedures for managing data

Documentation

• Policies and Procedures for Backup/Restore/Archive; Disaster Recovery; Change Control; Security; Configuration Management

• Validation Documentation

Training

Validation/Process Training

• Maintenance of Training Records

Risk Audit

• Requirements are on-going

Implementing Data Quality

Hosted by

Analysts can help you understand requirements.

Vendors are talking about compliance, but there is little vertical capability in MOST suppliers.

E-mail management and archiving has the most focus (Sarbanes Oxley).

Process management will become as important as technology management.

Establishing policies and evidence trails will be key to audit success.

What Does All This Mean To You?

Hosted by

Creating the Business Case (Pharma)

“The organization Pharmaceutical Research and Manufacturers of America estimates that only five in 5,000 compounds that enter preclinical testing make it to human testing, and only one of those five may be safe and effective enough to reach pharmacy shelves.”

Gartner estimates that 30% of research in Life Sciences is duplicated due to poor information sharing

“Just keeping a drug pipeline full involves investing $2 billion to $5 billion a year in research, and that doesn’t include production and distribution costs.”

Source: “Mastering the Value Chain: An Interview with Mark Levin of Millennium Pharmaceuticals”, Harvard Business Review

Violations in an FDA audit will slow down time to market – for a blockbuster drug that’s worth up to $2M per day. Based on patent timeframes and generic manufacturing pressures, that revenue is likely unrecoverable

Failure on a given audit will impact not only that submission but other submissions in process also.

At its most extreme, businesses shut down, executives go to jail and patients die.

The StickThe Carrot

Hosted by

Thank You

Richard.Scannell@GlassHouse.com