From Regulation To Desperation

1. From Regulation To Desperation A Life Sciences case study in compliance Richard Scannell, GlassHouse

2. Background • IT affecting regulations are increasing in number and visibility • Most organizations are ill-prepared to respond and react • Vendors have finally found their next Y2K • Audits shift from faith-based to evidence-based • Failures are well-publicized; successes are unknown

3. Introduction A Pharmaceutical Case Study • Understanding the business lifecycle • Mapping to the data lifecycle • The Audit Process • Classifying Datasets • Mapping to technical requirements

4. Who are your regulators? Why? Pharmaceutical World • FDA – Keep Bad Products Off Market • Regulating Companies processes in bringing products to market • Companies have to provide documented evidence that their products meet quality standards • Companies – Get Products To Market • FDA Approval Times Increases • Declining Profitability

5. PRE-CLINICAL RESEARCH CLINICAL STUDIES NDA REVIEW Phase 1 E Phase 2 E SYNTHESIS AND PURIFICATION Phase 3 Accelerated Development Review ANIMAL TESTING Treatment IND E Short-Term Parallel Track Long-Term INSTITUTIONAL REVIEW BOARDS INDUSTRY TIME FDA TIME IND SUBMITTED NDA SUBMITTED REVIEW DECISION SPONSOR/FDA MEETINGS ENCOURAGED EARLY ACCESS: SPONSOR ANSWERS ANY QUESTIONS FROM REVIEW SUBPART E ADVISORY COMMITTEES E The New Drug Development Process Source: www.fda.gov

6. Data Requirements Pre-Clinical Research Clinical Trials (Phase 2) Internal Data New Drug Application (NDA) Contract Service Organizations Internal Data Electronic Submission • Animal studies • Clinical tests • Drug components • Manufacturing process Biotechnology Partners Investigational New Drug Application (IND)

7. Align Value with Cost Occupancy: • Appropriately congregate data by value and rationalize storage requirements at each phase Architecture: • Hardware/software requirements • Processes and standards Governance: • Validation and qualification • Movement of data up or down the value chain

8. More Typical Approach • Data placement based on device management rather than data management • No alignment between business value of data and infrastructure • Unknown or high TCO • Very little focus on Process Management

9. Hosted by Audience Response • I understand the business lifecycle and corresponding data lifecycle of my business. • I know how we manage data but I don’t have much appreciation how this ties to our business performance. • I’m the IT guy; the business never talks to me. • I keep the lights on; what more do you want?

10. Regulations & Audits • 21 CFR Part 11 – Electronic Records and Electronic Signatures • 50% of all FDA Inspections include some aspect of computer system quality and compliance • Computer Systems Compliance one of most common reasons for a 483 (Violation) • Expectation is that companies implement global procedures – major IT implications

11. Validation – The Missouri Factor Validation - documented proof that a product or process will repeatedly produce a product to the stated specifications, i.e., Prove a Process Works. "Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its pre-determined specifications and quality attributes".  FDA Guidelines on General Principles of Process Validation, May 1987. Specifications; Qualifications; Verifications; Calibrations; Certifications

12. Noted Recent Issues in FDA Inspections • Insufficient Change Control • Lack of or Inconsistent documentation • System Overviews • GMP applications used over a network • Failure to control and archive GMP information communicated via e-mail • System security and user authorization • Insufficient GMP training of IT Staff

13. Data Classification Maps to Technology • Define Classifications • Location in the Lifecycle • Requirements and Attributes • Regulatory issues • Policies • Storage • Backup/Restore/DR • Archive • Security

14. Clinical Production Submission Pre Clinical (3.5 – 6 yrs) (7m-1yr) (m-2yrs) (~ 3 yrs) (Approx 2.5 yrs) NDA Submission And Approval Clin Data IND Preclin data Patent Application Production All Data Risk Phase 3 Clinical Trials Phase 2 and 1 IND Pre-Clin Phase 2 Clinical Trials Phase 1 IND Pre-Clin Retirement Cost Phase 1 Clinical Trials IND Pre-Clin Pre-Clinical Data Pre-Clinical Data IND NDA Value

15. High High High Med Med Med Low Low Low TIER1 TIER2 TIER3 TIER4 R-H B-H R-M R-L B-M O-H B-L O-M O-L Data Classification Maps to Technology Define: 1.Logical Data Classes 2.Occupancy 3.Data Management Policies Regulated Business Critical Other Data Classification R-H R-M B-H B-M B-L O-H O-M O-L R-L Physical Mapping & Tier Design Architecture System Policies Remote replication Multiple SNAP copies Tape Based Backup on RAID set Multiple SNAP copies Tape Based Backup on RAID set Technical implementation on standardized technology Tape Based Backup on RAID set Architecture

16. Implementing Data Quality • Data Classification Model • Drives procedures for managing data • Documentation • Policies and Procedures for Backup/Restore/Archive; Disaster Recovery; Change Control; Security; Configuration Management • Validation Documentation • Training • Validation/Process Training • Maintenance of Training Records • Risk Audit • Requirements are on-going

17. What Does All This Mean To You? • Analysts can help you understand requirements. • Vendors are talking about compliance, but there is little vertical capability in MOST suppliers. • E-mail management and archiving has the most focus (Sarbanes Oxley). • Process management will become as important as technology management. • Establishing policies and evidence trails will be key to audit success.

18. “The organization Pharmaceutical Research and Manufacturers of America estimates that only five in 5,000 compounds that enter preclinical testing make it to human testing, and only one of those five may be safe and effective enough to reach pharmacy shelves.” Gartner estimates that 30% of research in Life Sciences is duplicated due to poor information sharing “Just keeping a drug pipeline full involves investing $2 billion to $5 billion a year in research, and that doesn’t include production and distribution costs.” Source: “Mastering the Value Chain: An Interview with Mark Levin of Millennium Pharmaceuticals”, Harvard Business Review Violations in an FDA audit will slow down time to market – for a blockbuster drug that’s worth up to $2M per day. Based on patent timeframes and generic manufacturing pressures, that revenue is likely unrecoverable Failure on a given audit will impact not only that submission but other submissions in process also. At its most extreme, businesses shut down, executives go to jail and patients die. The Carrot The Stick Creating the Business Case (Pharma)

19. Thank You Richard.Scannell@GlassHouse.com