Navigating the Complexity of Life Science Compliance: A QAD Regulatory Primer Pete Schaubach October 10, 2011

2 Pete Schaubach Business Development Director, Life Sciences Previously… -CIO, AGA Medical -CIO, ev3 -Business Systems Integration Director, Medtronic -Information Services Director, SCIMED/BSC -… Introduction

3 Integrating regulatory compliance into your systems and processes while maintaining business flexibility is a challenge for every Life Sciences company. What can we do about this? Subject

4 Overview of business challenges My experiences at ev3 How QAD can help Interaction welcome! Agenda

5 External -Margin pressures from competitors and customers -Increased regulatory pressure on all aspects of product lifecycle Internal -Cost management/efficiency -Information Technology management Business Challenges

Key Issues -Increased competition -Healthcare reform -Customer consolidations -Group Purchasing Organizations -Revenue exposure in chargebacks & fees -Higher raw material & supply chain cost Margin Pressures External challenges 6

7 cGMP - current Good Manufacturing Practice Track & Trace Electronic records management - European Commission Annex 11 - US-FDA 21 CFR Part 11 Increased regulatory pressure External challenges

Key Issues -Regulations governing drug or device safety -Monitoring of adverse events -Managing global supply chain and supplier quality Greater Focus on Quality and Safety External challenges 8

9 Regulatory Agencies cGMP External challenges Poland Japan China USA Canada Mexico Europe Australia

10 Organization and personnel Buildings and facilities Equipment acquisition and maintenance Control of components & products Production and process controls Packaging & Labeling Identification and traceability Holding and distribution Records & Reports Returns and Complaints cGMP External challenges

11 US FDA Regulations -Finished Pharmaceuticals (human and animal products): 21 CFR 210 and 21 CFR CFR CFR 211 -Biological products: 21 CFR CFR 600 -Blood and blood-derived products: 21 CFR CFR 606 -Medical devices (“Quality System Regulation”): 21 CFR CFR 820 -Dietary supplements (published by FDA in June 2007): 21 CFR CFR 111 cGMP External challenges

FDA Quality System Requirements External challenges 12

Annex 11 This annex applies to all forms of computerised systems used as part of a GMP regulated activities. A computerised system is a set of software and hardware components which together fulfill certain functionalities. The application should be validated; IT infrastructure should be qualified. – Commission Europeenne Deadline June 30, 2011 Electronic Records Management External challenges

21 CFR Part 11 All production and/or quality system software, should have documented requirements that fully define its intended use, and information against which testing results and other evidence can be compared, to show that the software is validated for its intended use – United States Food & Drug Administration Electronic Records Management External challenges

15 Contents -Electronic system as replacement of Paper -Security -Data Transfer -Audit Trails -Electronic Signatures -Computer System Validation -Training -Supporting Procedural Infrastructure 21 CFR Part 11 External challenges

Key Issues -Increased product and compliance costs -Product commercialization Global expansion Operating in emerging markets Meeting revenue & growth targets -Continued focus on Lean principles -Increased leverage of shared services Cost management/efficiency Internal challenges 16

Key Issues -Reliability -Scalability -Cost predictability -Flexibility -Upgrade barriers Customizations Resources Time Information Technology Management Internal challenges 17

18 So what can we do to overcome these challenges?

19 Build a $1B global medical device company from scratch -Focus on three markets Cardiovascular (heart) Neurovascular (brain) Peripheral (legs) -Acquire and integrate quickly -Establish direct operations in global markets -Leverage centralized management and services ev3 My story

20 We chose QAD for core reasons -Reputation based on BSC and Medtronic experiences -Support for regulatory requirements -Solid supply chain functionality -Ease of implementation Selection criteria ev3

21 One source of the truth -Single instance -Standard processes -Strong data governance -Easy access to information Strong alignment between business and IT -Core process focus -Ability to execute -Flexibility Key strategies ev3

22 Leveraged strong QAD capabilities -Compliance module controls -Forward and backward traceability -EAM for CFR Part 820 and ISO Part 11/SOX change control requirements -Simple risk-based assessment with every request -Compliance requirements in every project plan Standard SDLC/change management -Standard process  continuous improvement -Reduced risk/fear of change Compliance ev3 strategies

23 Operate at the pace of business Steady delivery of high-value improvements Project duration: 3 days, 3 weeks, 3 months -3 Days: Single function affected Report modification -3 Weeks: Single organization Kaizen event opportunity, process change -3 Months: Multi-organization New process, acquisition integration Flexibility ev3 strategies

24 Europe implemented in 2 months -EU distribution center, 7 sales offices US implemented in 2 months -US distribution, sales & manufacturing Subsequent rollouts -Japan distribution and sales office -Multiple manufacturing sites in US and EU $40MM to >$440MM in six years From 40 to 800 users today Results ev3

25 Leverage QAD compliance capabilities Take advantage of on-demand Use the Validation toolkit Leverage QAD Reporting Framework and BI What if I had to do it again?

26 cGMP Compliance What if… Organization and personnel Process Maps Buildings and facilities EAM Equipment Acquisition and Maintenance EAM Control of component & products QAD EA Production and process controls QAD EA Complia nce PCC Packaging and labeling QAD EA Holding and distribution QAD EA WMS Records and reports QAD EA Returns and complaints SSM E- Controls WMS

27 Avoid multiple data center expenditures Avoid redundant support personnel Leverage resources and expertise for qualified environments and upgrades Provide remote site application support -Europe -Asia Leverage Hybrid environment for emerging markets On Demand What if…

28 Global Coverage On Demand Services United Kingdom Brierley Hill Belgium Antwerp Italy Milan The Netherlands Schiphol Rijk Japan Tokyo Thailand Bangkok China Shanghai India Mumbai South Africa Durban Spain Barcelona Brazil Sao Paulo Mexico Mexico City United States California Australia Sydney Poland Wroclaw United States Illinois United States New Jersey United States Georgia United States Utah QAD Support and Data Centers = Local Presence, Global Reach

29 On Premise vs. On Demand On Premise Your Data Center Typ. ~95% Availability Your Support Hours Some Languages Your Upgrade Cycle Backup? Disaster Recovery? Dedicated Personnel? On Demand SAS 70 Secure Data Center >99.5% Availability 24 x 7 Multi-Language Support Always Current Version Constant Database Admin Usage Analysis & Reporting Failover & Recovery Site Off Site Backup Guaranteed Capacity 300+ Certified Personnel What if…

30 What if…

Implement Rapid Implementation Best Practices Fixed Fee Transition Environment Migration Transition Management Fixed Fee Transformation Upgrade Application Conversion Best Practice DeliverManage Easy On-Boarding Service Components What if…

32 Proven, best-practice methodology Built-in continuous improvement Pre-defined reports and validation scripts Validation toolkit What if…

Validation Master Plan Installation Qualification Hardware Installation Software Installation Installation Qualification Report QAD Purchase Delivery Installation User Requirements Specification GXP Requirements Design Qualification System Acceptance Data Installation Qualification Execute Performance Qualification Write Performance Qualification Plan Execute Operational Protocols Operational Qualification Plan Configuration Fit to Business Operational Qualification Performance Qualification Installation Qualification Baseline Configuration Document Define Functional Requirements Traceability Matrix Risk Assessment Operational Qualification Protocols Performance Qualification and Stress Test Operational Qualification Protocol Summary Report Disaster Recovery Protocols Validation Report = Deliverables Performance Qualification Protocol Summary Report Data Migration Data Installation Qualification Protocol Summary Report Strategic Validation Methodology What if…

Installation Qualification Protocol (IQ) Operational Qualification Protocol (OQ) -Distribution -Master Files -Manufacturing Performance Qualification Protocol (PQ) Functional Requirements Risk Analysis Traceability Matrix Validation Toolkit includes: What if…

Security Sales Orders Routings Compliance Quality Management Inventory Control Distributed Orders Item-Site Master Records SSM Purchasing Physical Inventory Formulas Product Change Control Processes Work Order Shop Floor Control Product Structures Validation Scripts What if…

36 Leverage QAD Reporting Framework and BI -Minimize the use of forms packages -Easily create alerts and automatic delivery of reports -Avoid long development time of ETL processes and custom BI data marts Reporting What if…

37 Upgrade Convert to a new version Unwind customizations -Convert to new standard functionality -Mitigate complex customizations with ICT Convert to On Demand Validation Problems  Solutions How can we help?

© QAD Inc Q & A Thank you – please complete your survey 38

Life Sciences On Demand Sample Customers On Demand Life Sciences 39 Brazil

Regulatory uncertainty and inconsistency -Serialization (EMEA, China, Turkey, US) Unit level serialization Rx Track & Trace International, Federal, and State rules differ California ePedigree (2015) Federal Buyer & Matherson FDA Serialization (2011) EU -EFPIA (European Pharmaceutical Industry Association) – Plans for Pilot Mass Serialization project -Italy – Bolini, Turkey – Jan 1, Greece – National Registration Number + Sequential Number -Spain – Start to Define Serialization China (2009) Serialization Legislation Business Requirements

41 E-Pedigree Planned Schedule Business Requirements