Integrated Risk Management with GAMP 5 – manage ... - we.CONECT

Integrated Risk Management / July 2012
Integrated Risk Management with GAMP 5 –
manage risks effectively!
Autor:
Thomas Halfmann
Halfmann Goetsch Peither AG
With GAMP 5 in 2005, the risk-based approach was introduced into the validation of
computerised systems. Risk management was not a new discipline or technology in
this field, however GAMP5 went one significant step further than before: it took
current trends from the healthcare industry and implemented them into the practice of
validation. Today, the methods and procedures as described in GAMP 5 have long
since become everyday practice. The current challenge in validation is to effectively
manage compliance and risks in heterogeneous organisations with numerous
computer systems.
IT Compliance and Risk Management
The aim of validating computerised systems is to ensure that their operation does not
pose any risk to patients, the quality of the products or the integrity of the data. Due
to GxP requirements, the validation of computerised systems is, for most businesses,
only one of many demands placed upon IT compliance. In addition to GxP, there are
other requirements that must be met by the operators of the IT systems, for example
• data protection, e.g. use of personal data
• regulatory requirements, e.g. SOX
• information security, e.g. ISO 27000
• in-house compliance, e.g. quality management and internal audits.
In addition to other changes from the previous version of GAMP 4 in 2001, in
GAMP 5 the emphasis is much more on the following aspects of validation:
• focus on the risk to patients
• integration of validation activities into a quality management system
• greater involvement of the supplier in validation activities
• integrated risk management in all life cycle phases
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 1 of 6

Integrated Risk Management / July 2012
Risk management, as also required in GAMP 5, helps to meet compliance
requirements in a focussed and efficient way. GAMP 5 suggests a five-step risk
management process (GAMP 5, Appendix M3, Science Based Quality Risk
Management), whereby this article focusses mainly on the last two steps of the
process:
Figure 1: GAMP 5 risk management process
Based on the compliance frameworks (e.g. GxP, SOX etc.) and an appropriate risk
analysis, controls are specified that ensure the regular review and monitoring of
identified risks. In the classic approach, these controls are introduced and monitored
separately for all compliance frameworks.
Figure 2: Risk management for different compliance requirements
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 2 of 6

Integrated Risk Management / July 2012
Many of the controls, however, occur more or less identically in the various
compliance frameworks (GxP, SOX etc.), meaning that they are checked several
times in various cycles. Consequently, the introduction and maintenance of a change
process as a control, for example, occurs in almost all compliance requirements.
Added to this is that many controls are related to processes, which in turn apply to a
variety of computer systems, e.g. the change process.
Subsequently, we can therefore conclude that we have introduced appropriate risk
management processes to the fullest extent possible, but that these have been
implemented redundantly and at a considerable cost throughout the entire
organisation due to numerous compliance requirements and their application to a
number of IT systems.
Generally, this leads to high yet unnecessary additional costs for the specification
and implementation of the controls. It can even lead to contradictory evaluations of
individual controls, as these are not standardised throughout the various frameworks
and so are evaluated differently by the different departments. A lack of transparency
in the actual compliance status within the organisation then also contributes to the
system falling short of expectations.
The desired compliance is indeed achieved, but only at considerable expense and
the risk of unpleasant surprises during audits and inspections due to this complexity.
Integrated Risk Management
One solution for implementing these risk management processes in an efficient way
into the entire organisation is the introduction of an integrated risk management
system:
Figure 3: Integrated risk management
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 3 of 6

Integrated Risk Management / July 2012
Instead of specifying and monitoring controls for each individual compliance
requirement, the controls are summarised in a unified system. The challenges of an
integrated risk management system such as this are that the context and timing of
the requirements are not uniform, e.g. the SOX controls are reviewed at a different
time and possibly by other organisational units to the GxP requirements. The
integrated approach requires a certain degree of abstraction of the controls to make
them applicable to all compliance frameworks. These necessary abstractions can
lead to various interpretations by the different organisational units within the
business.
On the other hand, the integrated approach allows for a unified business-wide basis
for the controls, and thus a significant reduction in costs. Concurrently, this enables
the comparability of results across organisational and system boundaries and
achieves the necessary transparency.
In practice, we first specify the controls for the various frameworks and unify those
controls that occur in several frameworks. The specification and application of a
change process, for example, can be expected in all frameworks (GxP, SOX etc.).
Tool Support
In order to manage the controls efficiently, Microsoft Excel is available as a tool for
the simplest cases. Excel is ideal for organisations that only need to assess a few
applications for compliance. As soon as one has to manage a larger number of
applications, or wants to consolidate multi-organisational results, using Excel
becomes extremely time-consuming and/or no longer feasible.
Database applications specialising in risk & compliance management represent an
alternative to Excel. These provide an advantage over Excel, in that the entire risk
management work flow is displayed in an integrated tool:
• specification of the assessments and controls
• implementation of the assessments and evaluation of the controls
• identification of compliance deviations
• assessment of the risks
• management and monitoring of risk mitigation measures
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 4 of 6

Integrated Risk Management / July 2012
Another advantage is that the relevant reports and management dashboards are
integrated and do not have to be painstakingly pulled together from numerous Excel
spreadsheets:
Figure 4: Risk management tool dashboard (RicoLution)
If one carries out the assessments on an annual basis (keyword Periodic Review,
GAMP 5 Appendix 08), a tool allows access to the history of all previous
assessments. This means that trends can be quickly recognised and potential for
improvement easily identified. This would not be possible in this way with Excel.
The applied compliance framework generally has a wide range of uses combined
with these tools, meaning they are not limited to the compliance and risk
management system for IT systems and can, for example, also be used for
managing GMP compliance and risks.
Conclusion
When it comes to numerous processes and IT applications, the ‘classic’ approach to
managing risks and compliance becomes extremely expensive or even impossible.
Integrated risk management is a solution for meeting the compliance requirements of
businesses with complex organisational structures and numerous IT applications.
The use of suitable tools provides the view from above and the necessary
transparency, as well as efficient management of the controls and compliance
assessments – even in a multi-organisational context.
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 5 of 6

Integrated Risk Management / July 2012
References
1. GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems
ISPE 2008
2. GAMP Good Practice Guide: A Risk-Based Approach to Operation of GxP
Computerized Systems
3. GMP Manual Online
Maas & Peither AG GMP-Verlag
4. GAMP 5 Risk-Based Approach - Risiken global managen
Vortrag auf der Vision Pharma 2012 [Managing risks globally, paper presented
at the Vision Pharma, 2012], Karlsruhe
Thomas Halfmann
Author
Thomas Halfmann
Partner of the management consultancy Halfmann Goetsch Peither AG,
Switzerland, Germany ISPE 2009, Singapore
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 6 of 6