Cloud Computing Comes of Age in Life Sciences

For a while now we have been saying the Cloud was coming of age in the Life Sciences industry.

Business & Decision,  along with a small number of other Providers have been providing Infrastructure-as-a-Service and Platform-as-a-Service for some time.

We also said that as far as Software-as-a-Service was concerned, we would see Life Sciences specialist vendors (e.g. LIMS, Quality Management, Learning Management etc) providing compliant Software-as-a-Service solutions - simply because they understand our industry both at the functional level and also at the regulatory level.

We are working with a number of such vendors to deploy their software on our Platform-as-a-Service solutions, leveraging virtualization to provision solutions that are inherently flexible, scalable and - perhaps just as importantly - compliant.

At the same time, we have just started to engineer our first compliant 'Cloud Anywhere' solutions - which allow us to deploy pre-engineered and pre-qualified Platforms (hardware, power, HVAC, storage, virtualization, operating systems, database servers and applications servers) anywhere in the world. This was an idea first developed with Oracle with their Exadata and Exalogic machines (for which Business & Decision developed standard Qualification Packs).

Based upon a wider and more affordable technology base ‘Cloud Anywhere’ allows Business & Decision to leverage our investment in our Quality Management System to provision compliant Private or Community Cloud solutions with the minimum of additional qualification activities. These can be installed on client sites, in third party data centres of in the data centres of our software partners.

As well as deploying the solution, these 'Cloud Anywhere' solutions also come complete with Managed Services from Business & Decision - meaning that clients, partners etc no longer need to worry about the management of the Platform. All of this is taken care of remotely by our own staff (with the exception of local power and network connections of course) and the solutions can also be engineered to automatically failover to a remote Disaster Recovery site.

In the last couple of years we have seen people asking "How long will it be before everything is in the Cloud?", but the reality is that this will never be case in Life Sciences. There will always be Life Sciences companies who need or want some infrastructure on their own sites (because of network latency issues or data integrity issues) and the reality is that we are moving towards a mixed-Model Cloud Environment.

We will see a mixture of non-clouded Infrastructure, Platforms and Software, and various Cloud models, including On-Premise & Off-Premise and Public & Private Clouds.

The coming of age of safe, secure multi-tenanted Software-as-a-Service and the availability of solutions such as 'Cloud Anywhere' means that Life Sciences companies now have the ability to mix'n'match their Cloud environments to meet their specific business needs - and address their regulatory compliance requirements.

It may not seem like it now, but in the next few years we will see these solutions move from leading-edge to mainstream and we will wonder what all the fuss about Cloud was for.

Social Networking in Health Sciences: Is Medical Devices Missing a Trick?

In yesterday's webcast "Social Networking in Health Sciences: Is Medical Devices Missing a Trick?", we shared a good volume of information with our viewers, but unfortunately we didn't have time to address everyone's questions.

We've therefore reproduced the questions below, along with our answers.

Q. How precisely can advertising be targeted on a platform such as Facebook?

Because platforms such as Facebook know a great deal about their users - based upon information provided by the users themselves (e.g. hobbies, likes, job, education, home location etc) it is possible for Facebook to 'target' advertising very precisely. When advertising on Facebook it is possible to narrow down the target audience by a number of criteria, such as location, language, education level and work role, age and gender and even likes, interests and connection status to other users.

Note however that Facebooks own advertising guidelines prohibit the advertising of pharmaceutical products and on-line pharmacies (but not medical devices!)

This can be useful when attempting to restrict advertising to appropriate target audiences and geographies but it certainly isn't foolproof

Q. Is it legal to set up patient social networks?

It depends upon the geography and applicable regulations, but in many cases it is acceptable to set up patient network groups on-line. However, when a medical device company effectively pays for or owns the media, careful control over the content must be maintained (as discussed in the webcast). Also as discussed in the webcast, it is much more difficult for medical devices companies to controlled earned media which is posted in a group, forum or page which they have set up.
Another allowable option in some geographies may be for medical device companies to support patient groups financially, who then set up their own social networks.
In all cases is good practice to provide transparency even where this is not required legally.

Q. How effective is social media for marketing purposes?

There is no doubt that using social networks can be effective, but this has to be part of a carefully planned multi-channel marketing strategy, coordinated through the use of a relationship management platform or system.
Our own experience (as a consultancy rather than as a CRO)  is that earned social media can be effective in terms of initiating relationships that can then lead to business. As a business we generally strive to achieve a balance between delivering value in our on-line interactions and promoting our business. Medical device companies are best advised to leverage this 'trusted advisor' status through the use of earned media, but it’s important not to underestimate the amount of time required to develop and maintain such trust.

Thanks to those of you who attended yesterday's event and we hope that this answers your questions. The webcast recording will be on-line for those of you you missed it and remember that you can always get in touch via e-mail or by using the 'Ask An Expert' form on the Business & Decision Life Sciences website.

Computer System Validation Policy on Software-as-a-Service (SaaS)

In a recent LinkedIn Group discussion (Computerized Systems Validation Group: Discussion "Validation of Cloud), the topic of Software-as-a-Service (SaaS) was widely discussed and the need to identify appropriate controls in Computer System Validation (CSV) policies was discussed.

The reality is that relatively few compliant, validated SaaS solutions are out there, and relatively few Life Sciences companies have CSV policies that address this. 

However, there are a few CSV policies that I’ve worked on that address this and although client confidentiality means that I can’t share the documents, I did volunteer to publish some content on what could be included in a CSV policy to address SaaS.

Based on the assumption that any CSV policy leveraging a risk-based approach needs to provide a flexible framework which is instantiated on a project specific basis in the Validation (Master) Plan, I've provided some notes below (in italics) which may be useful in providing policy guidance. These would need to be incorporated in a CSV Policy using appropriate language (some Regulated Company's CSV Policy's are more prescriptive that others and the language should reflect this).

"When the use of Software-as-a-Service (SaaS) is considered, additional risks should be identified and accounted for in the risk assessment and in the development of the Validation Plan computer system validation approach. These are in addition to the issues that need to be considered with any third party service provider (e.g. general hosting and managed services). These include:

• How much control the Regulated Company has over the configuration of the application, to meet their specific regulatory or business needs (by definition, SaaS applications provide the Regulated Company (Consumer) with little or no control over the application configuration)

o   How does the Provider communicate application changes to the Regulated Company, where the Regulated Company has no direct control of the application?

o   What if Provider controlled changes mean that the application no longer complies with regulatory requirements?

• The ability/willingness (or otherwise) of the Provider to support compliance audits

• As part of the validation process, whether or not the Regulated Company can effectively test or otherwise verify that their regulatory requirements have been fulfilled

o   Does the Provider provide a separate Test/QA/Validation Instance?

o   Whether it is practical to test in the Production instance prior to Production use (can such test records be clearly differentiated from production records, by time or unique identification)

o   Can the functioning of the SaaS application be verified against User Requirements as part of the vendor/package selection process? (prior to contract - applicable to higher risk applications)

o   Can the functioning of the SaaS application be verified against User Requirements once in production use? (after the control - may be acceptable for lower risk applications)

• Whether or not the Provider applies applications changes directly to the Production instance, or whether they are tested in a separate Test/QA Instance

• Security and data integrity risks associated with the use of a multi-tenanted SaaS application (i.e. one that is also used by other users of the system), including

o   Whether or not different companies data is contained in the same database, or the same database tables

o   The security controls that are implemented within the SaaS application and/or database, to ensure that companies cannot read/write delete other companies data

• Where appropriate, whether or not copies of only the Regulated Companies data can be provided to regulatory authorities, in accordance with regulatory requirements (e.g. 21CFR Part 11)

• Where appropriate, whether or not the Regulated Companies data can be archived

• If it is likely that the SaaS application is de-clouded (brought in-house or moved to another Provider)

o   Can the Regulated Companies data be extracted from the SaaS application?

o   Can the Regulated Companies data be deleted in the original SaaS application?

If these issues cannot be adequately addressed (and risks mitigated), alternative options may be considered. These may include:

• Acquiring similar software from an acceptable SaaS Provider,
• Provisioning the same software as a Private Cloud, single tenancy application (if allowed by the Provider)
• Managing a similar application (under the direct control of the Regulated Company), deployed on a Platform-as-a-Service (PaaS)"

Hopefully these ideas will help people to develop their approach to SaaS, but CSV Policies should also address the use of PaaS and IaaS within the broader context of outsourcing.

Successful and Compliant ERP Projects

Unfortunately we ran out of time in yesterday's webcast “Secrets to Success - Plan and Implement Compliant ERP Projects”.

That was partly my fault because I was late dialing in. (Apparently, Microsoft Exchange/Outlook still doesn't automatically recognize that the US and Europe change to daylight savings on different weekends - doesn't anybody validate this software?). My apologies for that, and for the fact that we ran out of time to answer all of your questions as fully as we would have liked.

During the webcast we discussed how small to medium-sized life sciences companies can plan for the successful implementation of their ERP systems. We looked at how to align project planning and validation planning activities, we reviewed the typical project activities that are the responsibility of the regulated company and we looked at the importance of assigning the right people to the project. Below are the questions we didn't have time to answer fully and our answers - we hope that you find them useful.

Q. How does implementing ERP in pharmaceuticals vary from other industries?

A. The main differences are that in many cases the system requirements represent mandatory regulatory requirements which have to be fulfilled. There is no option to defer these to a later release and so many of the software vendor's ‘accelerated’ implementations using out-of-the-box software configurations cannot be used. There is also the fact that requirements, design specifications and testing all need to be formally documented and there may also be the issue of electronic records and electronic signatures to consider.

Although it is possible to implement an ERP system in a small to medium business within 8-12 weeks, the above factors make this virtually impossible in the life sciences industry. The fastest that we have ever been able to implement an ERP system in life sciences has been 16 weeks and for small to medium business 6 to 8 months is more typical.

Q. Does the increased focus on formal project management have any benefits?

A. The focus on formal project management controls means that time and cost overruns are usually better controlled. The focus on the formal definition and documentation of requirements also means that systems are much more likely to meet the real requirements of the real users. While the time and cost of implementing in life sciences is greater than some other industries, the fact that the system more completely fulfills the user requirements generally provides a better return on investment.

As an industry we must do a better job in demonstrating return on investment in order to justify the increased time and cost when compared to other industries. Where case studies are available they clearly show that a formally defined project management process, documented requirements specifications and tests and the need to demonstrably confirm that user requirements have been fulfilled delivers an ERP system that is fit for purpose, better meet the needs of users and provides better return on investment over the life of the system.

Q. How realistic are regulated companies in their expectations when looking to implement ERP or CRM?

A. Clients can certainly be very demanding and their expectations can be difficult to manage, especially when those expectations are informed by software vendors and system integrators who don’t really understand the life sciences industry.

As a company constantly engaged in implementing ERP and CRM systems but also competing to win such projects we often see small to medium life sciences companies with unrealistic expectations with respect to the real project budget, how long it will take to implement the system and the level of commitment their people will need to devote to the project. This is natural where the procurement process doesn't really understand the need for regulatory compliance, under values the benefits of formal validation and focuses mainly on comparing costs and implementation timescales.

On the validation side of business we have worked with a number of system integrators who are inexperienced in the life sciences industry and as a result we’ve had to help a lot of regulated companies bridge the gap between their initial expectations and what is really required for a successful and compliant project.

The reality is that it takes a minimum amount of time and effort to successfully implement a compliant ERP or CRM system. Small to medium life sciences companies would be better served by starting projects with realistic expectations and thereby avoiding having to go back to stakeholders to ask for additional funding and to explain why the project is “late”.

Q. Where do most ERP implementations fail?

A. Failure is a relative term. Most projects go live and deliver acceptable return on investment but are often seen as challenging projects or having failed because of initial unrealistic expectations with respect to the level of effort required of the regulated company. As discussed during the webcast, it is important that regulated companies really understand the activities that they will be responsible for and the deliverables that they will have to produce.

These need to be resourced appropriately; funding needs to be available and realistic timescales need to be set. If realistic timescales were put in front of stakeholders at the beginning of a project far fewer projects would be considered to have ‘failed’. Key to this is involving experienced resources in the concept phase of the system life cycle and during the early stages of the project planning.

Such resources need to have experience of implementing and validating ERP (or CRM) systems in the life sciences industry and the experience and knowledge that they bring to the table is invaluable.

As ever, if anybody has any follow-up questions from the webcast they can comment on the blog will get in touch through a usual e-mail address life.sciences@businessdecision.com. If you missed the webcast and would still like to view it the recording is available here.

Aggregate Spend/Sunshine Act: Change is Inevitable….are you ready?

The Comment Period for the Physician Payments Sunshine Act closed last week.  Now everyone is waiting to see how it will play out and what will be included in the final legislation.  We, at Business & Decision Life Sciences are no exception.

In addition to the “nuts and bolts” of the changes i.e. what payments are now to be accumulated, payments made to which parties, how reporting will change, etc., I think it is relevant to consider the impact of change on the organization and the people who are required to incorporate the changes into their routines.  I think sometimes, the focus on the technical elements of change overshadows consideration of the impact of the changes on the people.  If the impact of how the change impacts the people is not considered, success of the change can be limited. 

Change experts often refer to the need to assess where the organization is in terms of readiness to make changes.  I found a great tool that assesses change readiness in the form of a brief questionnaire called The Change Readiness Audit (found in The Change Management Pocket Guide which can be purchased from the authors at http://www.changeguidesllc.com/). It can be used formally as a questionnaire completed by employees or informally as a discussion tool at the management level (don’t forget that input from employees can be very different than management’s perceptions!).

This Change Readiness Audit includes questions that cover a range of sub-areas including:

·         The Vision or Business Case for the change

·         Engagement of resources

·         Leadership involvement and commitment

·         How effective will the implementation of the change be

·         Sustainability of the change

As with many tools, this one can be tailored to fit a particular situation.  Regardless of how it is tailored, once completed, the assessment can help to pinpoint areas that need attention in preparation for the anticipated change, including, but not limited to, those related to the Sunshine Act.

Risk-Based Validation - How Are We Doing?

Yesterday, I posted a poll on LinkedIn asking the question

"How is Life Sciences industry embracing risk-based computer systems validation? Do we have the balance between risk assessment and risk mitigation right? Are we just rushing to reduce costs...?" 

People's responses are starting to come in and we're already starting to get some interesting comments on the question. If you're interesting in the poll and want to take part you can find it here (once you've answered the question you'll be able to see how everybody else has been voting).

Since I asked the question I guess it's only reasonable that I try and answer it and provide my own opinion. There is of course no single answer and even within a single Regulated Company there are different individuals and departments taking different approaches to risk-based validation. In many cases you have the business, and IT tried to reduce costs against a background of life sciences companies struggling to maintain profitability. At the other extreme you have the quality unit who are used to doing things the old-fashioned way and like to see every 'i' dotted and 't' crossed.

Hopefully, somewhere in the middle, you'll find some pragmatic validation practitioners genuinely trying to do their best to take a risk-based approach to validation and apply the appropriate resources to the highest areas of risk to patient safety, product quality and data integrity.

However, this is often thwarted by two obstacles:

1. The pragmatic practitioners in the middle are seldom the people with control of the budgets or with the power to effect real change. This often means that they'll pull from pole to pole at the behest of the business owners, the IT group and the quality unit who have different perceptions of how things should be done. In many cases these practical practitioners of the validation art are not recognised as true subject matter experts and they guidance, advice - and even wisdom - is ignored, often for the sake of point scoring and political expediency in large organisations.

2. Where practical and experienced practitioners are not available (often in small to medium sized organisations but also in organisations in emerging economies where computerised systems validation is a relatively new discipline) there is a genuine lack of understanding of how to take a practical approach to risk-based validation. in these cases and inability to invest in training and education is an obstacle to adopting risk-based validation.

I think therefore the what we will see is an industry which continues to adopt risk-based validation at a relatively slow pace. While some companies are using risk-based validation as an excuse to do less (and in some cases, too little) I think the majority of companies want to do the right thing but are hampered because of their own organisational structures or lack of experience, training and education.


From my experience as a consultant, and with my experience working with the small number of companies who are doing a good job with risk-based validation I genuinely do believe that taking a risk-based approach to validation has advantages both in terms of cost effectiveness but also in mitigating risk to patients. Regrettably, it's one of those things that most regulated companies will have to see for themselves before they believe, and they were set for themselves until they have gained the necessary experience.


As an industry I believe that we need to do a better job in publishing case studies demonstrating the effectiveness of risk-based validation, that we need to recognise the value of our internal and external subject matter expertsand he must be prepared to invest in training and education.

Cost Effective Validation of ERP and CRM - Your Questions Asnwered

In yesterday's webcast "Dissecting ERP and CRM Vendors for Cost Effective Validation" we discussed what regulated companies should be looking for when selecting ERP or CRM software and system integrators in the Life Sciences industry.

Specifically, we looked at how the choice of software vendor and system integrator affects the validation of the system, in terms of:

• Cost effective and efficient validation,
• Level of compliance achieved, both in terms of compliant business processes and compliant validation,
• The quality of the final solution delivered.

We also reviewed what regulated companies can do to ensure that projects obtain the right balance between project cost, timescales and quality.

Unfortunately we ran out of time to answers all of the questions submitted during the webcast and our apologies to the person whose question we didn't have time to get around to. As promised, here is our answers to your question.

Q. How current is your data on cost, time, and quality?

A. In the webcast we showed a slide that inferred that time and cost considerations are usually completely divorced from quality/validation, where of course they should be balanced. Our experience is that a small number of Life Sciences companies (mainly larger pharmaceuticals) have invested significantly in adopting GAMP 5 risk-based validation and have developed flexible SDLCs which can accommodate ERP/CRM implementation in a cost effective and efficient manner.

However, this is still a small minority and as the later vote showed, most companies are still struggling to achieve the proper balance between time, cost and quality.

We also mentioned that it is possible to reduce the cost of validation to around 2-3% of the overall project budget, but most projects are still around 10-15%. The 2-3% figure assumes a well-defined SDLC that is specific to the ERP/CRM system being validated and also a great deal of process repeatability. In the case of Business & Decision, we can achieve those figures because (a) with due modesty, we are experts in implementing ERP/CRM and are also experts in risk-based validation and (b) we have done this dozens and dozens of times before in Life Sciences.

Some large pharmaceutical companies are also quoting similar single digit figures for the cost of validation, but the reality is that they are being selective in the figures they are quoting i.e. they represent mature processes for validating the roll-out of new phases of an existing system, using a system specific, mature and well-understood SDLC.

For most companies implementing ERP or CRM for the first time, 10-15% is more realistic. 5-10% can be achieved if you engage a specialist who really knows ERP and CRM validation and you engage them early in the project planning. 10-15% is more likely if your own validation staff work it out with a less experienced system integrator.

These figure are based on experience over the last 3-5 years, since the publication of GAMP 5.

You can view the webcast and hear all the other questions - and answers - by viewing the recording of the webcast. We hope that people found the webcast useful and that you’ll be able to join us for the remaining webcasts in the ERP/CRM series – details of which can be found in the ‘webcasts’ page on the Business & Decision Life Sciences website.