Risk Based Approach
- The number of risks embedded in the project requires strong project management, especially with respect to the risk management that was deeply connected with the validation life cycle, which should be executed in order to mitigate risks in the GxP environment. The risk based approach is key and must be applied to the life cycle: A risk based approach must be used to select the scope of the project:
- The scope should be limited to the upgrade of SAP ECC to S4HANA in an outsourced “on premise” IT infrastructure: any possible cloud adoption is required for a 2nd phase of the project;
- The approach to the update of the process is limited to the mandatory simplifications that S4HANA introduced;
- Consolidation in a unique life cycle multiple roll out / changes and documentation that from 2009 to 2020 constituted a weak validation baseline: a new solid life cycle provided the occasion to introduce compliant processes such as Logical Security and Audit trail review.
- A risk based approach in the selection of the partner (system integrator) to lead such a complex and fundamental project;
- A risk based approach in the migration verification (SUM, SAP Upgrade Manager used to drive the activity);
- A risk based approach in the overall validation exercise focusing the attention on the customization impacted by the change.
Figure 1: SAP HANA System Architecture (PRD = production environment, QUA = Quality Environment, TST = Test Environment, DEV = Development Environment)
Figure 2: SAP Architecture
Project Validation Deliverable
The project life cycle took 12 months for implementation, including the unique release in all the sites in a unique solution.
Key success factors were the application of the concept of a Global Information System (see also GAMP5 Guideline: GPG Global information System Control and Compliance, see reference 1) and therefore the entire life cycle structure is based on a core level documentation that is used as leverage for the following roll outs:
Figure 3: Validation Life Cycles
Functional Risk Assessment
The cornerstone of the entire validation life cycle is the Functional Risk Assessment that is intended to drive the OQ/PQ testing phase for each site in scope.
A risk based approach included in the validation life cycle includes the standard FMEA approach to the focus:
- Criticality of the process (in the sense of Patient Safety, Product Quality and Data Integrity);
- Occurrence (it is fundamental to focus on the technical complexity of the upgrade including the cases defined in Table 1);
Type of Transformation
Standard to standard (without functional modification)
To this category belongs all the transactions that were standard in the SAP ECC and have been kept as standard, including in the new SAP HANA. All the SAP objects linked to the function have also been maintained for the new ERP system environment.
Standard to standard (with functional modification)
To this category belongs all the transactions that were standard in the SAP ECC and have been replaced by another standard function in SAP HANA. The environment could be partially affected by this change, but the potential failures are still easily detectable.
Back to standard
To this category belongs all the transactions that were customized in the SAP ECC and that have been replaced by a new standard function of the SAP HANA system. The environment could be heavily affected by this change and the business process in which the function is involved may need a modification. The ability to detect potential failures is lower than the previous category.
Custom to custom/New Custom
This complex category encompasses all the transactions that were customized in the SAP ECC and that have been replaced by a new custom function or that were missing in SAP ECC and have been created from scratch. The environment is heavily affected by the new customization and related linked object. The ability to detect potential failures is very limited.
GxP Risk Mitigation
As result of a combination of the three factors (criticality, occurrence, detectability), the analysis is allowed to focus on the activities of validation -- Risk Mitigation actions derived directly from risk strategy included in the Functional Risk Assessment and driving the OQ/PQ activities:
(*) = note: the % the classification of the transactions is to be intended specifically for this case study and not as general assumption.
Validation is an exercise that constitutes a project unto itself in the overall implementation project, requiring dedicated timelines, resources and dependencies.
A cost effective implementation and validation was executed focusing the validation exercise on the most significant risks that were mitigated. Otherwise, the overall implementation plan would not have been achievable.
The case study had a successful conclusion even though the company decided to plan, for the following years, some technological transformations on the S4HANA system and the Quality Management system in general:
- Implementing a cloud based IT infrastructure platform: the processes of backup and restore, disaster recovery and high availability will be sensitively improved with a cost effective solution;
- Introducing an application life cycle system (ALM) to leverage the cost of test preparation and execution, possibly interfaced with an automated tool to run automatic regression tests for the changes that the company intended to implement.
These evolutions are included in the mainstream of the digital transformation. Current guidelines are already captured in the new edition of GAMP5 - A Risk-based Approach to Compliant GxP Computerized Systems (see reference 2).
- Good Practice Guide: Global Information Systems Control and Compliance, second Edition
- GAMP5 A Risk based approach to Compliant GxP Computerized systems, second Edition