The conference provided a good overview of the new "A Risk-Based Approach to Operation of GxP Computerized Systems" Good Practice Guide (GPG), only spoiled by the fact that that GPG hadn't been printed yet and that it wasn't possible to review the new guide in detail. The guide is actually finished and is ready for printing and so should be available soon (keep an eye on the Publications section of http://www.ispe.org/ for details).
The new Good Practice Guide builds on the Operational Appendices in version 5 of the GAMP Guide and provides a process definition for each of 14 operational (maintenance and support) processes, along with key compliance issues that should be addressed by each process.
For those companies leveraging ITIL or CoBIT there is also a mapping appendix which builds on existing ITIL/CoBIT mappings and extends this to map against the GAMP processes.
A big plus for the new guide will be that it sets out good practice for each of these processes specifically in the Life Sciences industry and can also provide a process model which organizations can align around - this will be especially useful where Regulated Companies are outsourcing maintenance and support processes to third parties.
During the conference there was an interesting benchmarking process, where the delegates rated each of their processes against the criteria defined in the GPG and were then able to compare their own results against the overall results. Business & Decision's hosting and managed services processes came out very well, but that's not surprising considering that we've had some input to the new Good Practice Guide.
However, I left Strasbourg wishing that there had been more of an attempt to address issues around efficiency and effectiveness and not just compliance - the words were used but I had the feeling that the actual GPG won't actually provide much guidance on making processes more efficient or effective. Most companies want to ensure that their processes are not only compliant but also cost effective and while our own Lean IS Compliance assessment model and KPIs addresses both dimensions it appears that GAMP's 'good practice' still isn't reflecting industry 'best practice'.
However, from the results of the benchmarking process it appears that most companies still have some compliance gaps to address and the new GPG will certainly be a welcome additional to the library of other Good Practice Guides. I'd certainly recommend that Regulated Companies and their Suppliers obtain a copy of the guide and map their own processes against the GAMP processes, as recommended in our recent "Practically Applying GAMP 5 in the Operational Phase" webcast.
As soon as the actual guide is published we'll provide a more detailed review.
Posts
