IT SOPs for Controlled Systems in Life Sciences
Emerging life sciences companies often select a quality system (document management, deviations/NCMRs, CAPAs) or an ERP system (accounting, financial reporting, procurement) as their first controlled, off-the-shelf (OTS) system.
Which system comes first largely depends on the experience of the folks in the functional areas or if the company is, or recently went, public and needs to meet Sarbanes-Oxley (SOX) compliance requirements.
If it’s a quality system, the system will most likely need to be validated to meet 21 CFR Part 11 requirements. (See SaaS System Validation: Validating for Intended Use)
Either way, these first systems drive the need for a suite of IT SOPs to govern the controlled systems and should take into account not just the initial needs of the first system, but the broader needs of functional and enterprise systems that will be implemented as the company moves toward commercialization.
This suite of SOPS should include the following (or some variation thereof) :
— IT change control including configuration management
— IT security including password controls and cybersecurity
— Data management and integrity including data privacy and protection
— IT system operation and maintenance including SaaS vendor management and oversight
— Backup, restoration, business continuity, and disaster recovery
— IT deviation management (or incident management)
— Electronic signatures
This assumes that basic Quality SOPs are already in place to support these IT specific procedures and include references to IT related systems:
— Quality policy and system
— Training
— Good documentation practices
— Document management
— Internal and external audits
— Records retention
Once a life sciences company has implemented and adopted the basic IT related system SOPs, and begins to select and implement more controlled systems, the following SOPs should be in place:
— Computer validation (CSV or CSA)
— System (software) development lifecycle (SDLC)
Since IT is often outsourced in earlier stage life sciences companies, IT related systems and procedures are often an afterthought. This is a risky game to play and leaves the company with an unknown level of risk. It could be acceptable to management, but if it’s unknown, how does management determine what’s acceptable?
Software (SaaS) vendors and implementation partners see this as a customer or client responsibility and never build these into the workplan or scope of work.
As you might expect, Finance and Quality sit in very different parts of a life sciences organization. Both have different business and compliance drivers that on the surface can appear unrelated. When it comes to IT related systems, they are often surprised by the overlap even if they use different words and language.
It doesn’t have to be complicated and the SOPs can evolve over time.
Earlier this year I wrote Quality and Compliance are Corporate Initiatives to drive home the importance of centralizing quality and compliance so that a company can have a unified approach to meeting these requirements, reducing duplication or contradiction of processes, and streamlining compliance for the end users.
This can and should start with IT SOPs that govern systems subject to regulations such as 21 CFR Part 11 or Sarbanes-Oxley thereby increasing ease of adoption and reducing overall risk.
Still Have Questions or Require Assistance?
Feel free to reach out to me with any questions you might have via email at terri.mead@solutions2projects.com or through my website SolutionsProjects, LLC.
About the Author
Terri Hanson Mead is a technology and compliance strategist for biotech, pharma, medical device, diagnostic, and digital health companies. Through her companiy, Solutions2Projects, she helps life sciences companies align technology roadmaps with corporate objectives and meet IT compliance requirements in a complex and regulated industry.
