Pacific Coast Information Systems

1. Pacific CoastInformation Systems Innovative Solutions. Individual Service.

2. Presented by: Paul King Director, Life Sciences 604.844.7558 paulking@pcis.com www.pcis.com

3. Using Technology to Reduce Time-to-Market and Attract Partners • The FDA's current approach to 21 CFR Part 11 and what companies need to do • How to reduce time-to-market by implementing an electronic submission program • Selecting the right technology tools for your biotech • Developing an IT strategy to accurately plan for upcoming challenges • How your IT strategy can attract partners and increase investment

4. The FDA's current approach to 21 CFR Part 11 and what companies need to do • Conduct a Risk Assessment • Internal - conduct inventory of all software systems • External - what software do our contactors use? • What does the company consider to be “source documents”? • the paper or electronic version? • does it directly affect human life? • does it directly affect the product? • do we make critical decisions using this information?

5. The FDA's current approach to 21 CFR Part 11 and what companies need to do • Internal Risk Assessment Matrix Example • Impact of the systemvs. • Type of system (infrastructure, configured, off the shelf, built) • Programs • Word, Excel, Oracle • Applications • spreadsheets • databases

6. Risk Assessment – Types of Systems • Tier One (IT) • Hardware, Operating Systems, Infrastructure • Tier Two (IT, QA) • General Purpose Off The Shelf Software Packages (Excel) • Tier Three (QA, IT, Dept) • Commercial Configurable Software Packages / Tools • Tier Four (IT, Dept, QA) • Custom Developed Systems and Applications (spreadsheets)

7. Risk Assessment - Criticality of the system • High • Complete validation within 4 months • Medium • Complete validation within 12 months • Low • Complete validation within 24 months • Not Applicable

8. Risk Assessment Example • High (33) • Complete validation within 4 months • Medium (145) • Complete validation within 12 months • Low (235) • Complete validation within 24 months • Not Applicable (20)

9. Risk Assessment • Balance between doing too much and not doing enough • Assemble a team (budget commitment, staff, training) • Conduct an assessment • Document your approach • Do what you say (or at least document the actual timeline)

10. The FDA's current approach to 21 CFR Part 11 and what companies need to do • External Risk Assessment Matrix Example • Similar approach as internal • “Our vendors are Part 11 compliant” • Does not matter if the data is down the hallway or down the highway • Audit the vendor / supplier / CRO in the same way the FDA will audit you!

11. Computer System Validation Documentation

12. European Union • Expanded requirements in some areas: • Implementation of eSignatures • registry of qualified certificate providers • legal equivalence of handwritten signatures in some E.U. countries • Physical security considerations • protect data from accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access • Disaster recovery • conduct and document an analysis that identifies the time-critical processes supported by the computer system, the maximum response time for these processes and the business plans enabling all required processes to be completed within response times • Manual system replacement • system should be run in parallel for one complete cycle • Management of critical data • When critical data is entered manually, there should be an additional check on record accuracy FDANews, September 2003

13. How to reduce time-to-market by implementing an electronic submission program “By the year 2002, the FDA is mandated to have the ability to receive fully electronic submissions. This is not the date by which the industry must make all submissions electronically, nor has a date been determined yet. Currently, all electronic submissions are voluntary.” http://www.mastercontrol.com

14. Electronic Submissions – The Agency • The mandate of the Agency is for faster, more efficient submission reviews • NDA Electronic Submission Training Manual • http://www.fda.gov/cder/regulatory/ersr/nest.pdf • "Once the [drug application] reviewers see what they can do with a good electronic submission, it's hard to go back to the paper.“ – Randy Levin, FDA

15. Electronic Submissions - Joint Benefits • Greatly reduced physical storage requirements • Enhanced submission quality, organization and completeness • Increased accessibility through creation of a long-term, easily accessible archive of all submission documents • More efficient review - transparency • Centralized processing at the FDA • Ease with which reviewers can locate and view referenced documents, through use of electronic bookmarks, hyperlinks and indexing • No need for traditional reviewer aids because all electronic items are provided in guidance-compliant form for archiving • Less time spent in manual processing of data

16. Electronic Submissions “Let’s copy everything onto a CD!”

17. (The Real) Electronic Submission Process

18. Are Companies Doing e-Submissions? • 1999 - 250 • 2000 - 500 • 2001 - 1,400 • 29% paper, 35% hybrid, and 36% fully electronic • 2002 - Agency must be able to accept and review e-subs • 2003 - electronic plus a paper copy for legal purposes • 75% fully electronic (Randy Levin, FDA) • 2005? - only electronic version needed/accepted

19. Developing an IT strategy to accurately plan for upcoming challenges Stage 5: Service Drives the Business Strategy • Stage 4: Service is Integral to the Business Strategy Stage 3: Service Supports the Business Strategy Value Stage 2: Service Supports the IT Strategy Stage 1: Service Supports Products Cost Cost-Effective ROI ROA Revenue Generation

20. Selecting the right technology tools

21. Developing an IT strategy to accurately plan for upcoming challenges • Data is a valuable corporate asset and should be managed as such, like cash, facilities or any other corporate asset • Centralized steward of corporate data and is responsible for managing it over its life cycle - from its generation to its appropriate destruction • Responsible for controlling access to and use of data, as determined by governmental regulation and corporate policy • Responsible for preventing the inappropriate destruction of data • Responsible for bringing technological knowledge to the development of data management practices and policies • IT partners with executives to develop and execute the organization's data management policies • Not responsible for maintaining the accuracy of data

22. Selecting the right technology tools • Trend to move away from in house developed applications to Commercial Off The Shelf • Since data flows between applications there is a need for a strong IT Strategic Plan • IS Steering Committee • How will your systems communicate? • Impact on the validated state? • Records retention plan? • Contact similar sized companies

23. How your IT strategy can attract partners and increase investment • Biotech firms’ value-creating activities are based on managing Intellectual Capital • 1 million a day opportunity cost • 12 year development cycle • Create an appropriate strategy for organizing, retaining, restoring, and utilizing electronic data • Documented processes instill confidence

24. Further Information • Institute of Validation Technology http://www.ivthome.com/ • General information www.fdanews.com • 21 CFR Part 11 Discussion – June 11th, 2004http://www.fda.gov/OHRMS/DOCKETS/98fr/04n-0133-nm00001-vol1.pdf

25. Thank-you!