Copyright © 2005, SAS Institute Inc. All rights reserved. Maintaining a Validated SAS Toolset Co-Presenters: Edward Helton and Patricia Halley

Copyright © 2005, SAS Institute Inc. All rights reserved. 2 db  LIS HIS lab, ADT, meds, source documents  display eCRF complete chart note Merged workflow: clinical trial data captured in initial CDA, re-used in chart note validation Proposed processes (single source) CLINICCRO ODM CDA & CDISC in Starbrite Trial CDA(1) CDA(2) Source: Liora Alschuler, Landen Bain, Rebecca Kush, PhD.

Copyright © 2005, SAS Institute Inc. All rights reserved. 3 Near-term Goal: Create means of conversion to minimize risk of ODM adoption

Copyright © 2005, SAS Institute Inc. All rights reserved. 4 Agenda  Part 11 and the Predicate Rules  Applying the Predicate Rules to Maintenance of a Validated SAS Toolset  Support from SAS (now and future)

Copyright © 2005, SAS Institute Inc. All rights reserved. 5 Common Threads of GxPs  Calibrate  Test  Validate  Standardize  Retain Records  Maintain Written Procedures

Update on Part 11 GMP by the Sea August 25, 2004 Rick Friedman, Team Leader Guidance & Policy Division of Manufacturing and Product Quality Office of Compliance, CDER

Copyright © 2005, SAS Institute Inc. All rights reserved. 7 FDA Regulation References - GCP  Strong New FDA Industry Guidances in GCPs  – ( c) – sponsors shall review and evaluate evidence related to safety and effectiveness  (a) – Records must be Accurate & Complete  (a,b,c) – Investigator Recordkeeping - drug disposition, case histories, record retention

Copyright © 2005, SAS Institute Inc. All rights reserved. 8 FDA Regulation References - GMP  (a) – Quality control unit has the authority to approve and reject  ( c) – Records shall be kept of maintenance, cleaning, sanitizing, and inspection  – Validation requirements of automated equipment  (a) - Written procedures for production and process control  (a), (b), and ( c) – Retention period for records

Copyright © 2005, SAS Institute Inc. All rights reserved. 9 FDA Regulation References - GLP  (b) – must maintain current summary of training for those engaged, or supervising the conduct of a non-clinical study  (b) – all experimental data… must be accurately recorded  (b) (4) – periodically submit a written status report noting problems and corrections  ( c) – records maintained of all inspections, maintenance records, testing, calibration and/or standardizing operations

Copyright © 2005, SAS Institute Inc. All rights reserved. 10 FDA Regulation References - Devices  21 CFR (a) & (b) - Records must be Accurate & Complete  21 CFR – must retain records required by 812

Copyright © 2005, SAS Institute Inc. All rights reserved CFR Part 11- Upcoming Amendment  Comments collected on the existing rule  Support for Part 11 in general  It is not going away – expect rewrite in future

Copyright © 2005, SAS Institute Inc. All rights reserved. 13 Standard Data / JANUS  Tools to receive, upload and analyze data  Unambiguous path of the source data to the analysis findings (metadata, derivations, flags, imputations, source code, analysis files)  Focus on standard data and standard analysis makes maintaining validation even more critical – valid interface, interaction between SAS systems  This makes your SAS configuration even more important!

Copyright © 2005, SAS Institute Inc. All rights reserved. 14

Copyright © 2005, SAS Institute Inc. All rights reserved. 15

Copyright © 2005, SAS Institute Inc. All rights reserved. 16 Standard Data / JANUS  Right now it takes analysis of many applications to find common trends.  One study took 10 person years.  We don’t have that kind of time to “find” the right data.  Standardization enhances the need for a validated SAS system.

Copyright © 2005, SAS Institute Inc. All rights reserved. 17 SAS Validation of SAS9 Customer Validation of SAS9 -- Toolset Validated System AERS Interim Analysis Integrated Safety Report Customer Validation of SAS9 -- Applications

Copyright © 2005, SAS Institute Inc. All rights reserved. 18

Copyright © 2005, SAS Institute Inc. All rights reserved. 19 Configuration Management  Identify functional and physical characteristics  Manage changes to those characteristics Source -- IEEE

Copyright © 2005, SAS Institute Inc. All rights reserved. 20

Copyright © 2005, SAS Institute Inc. All rights reserved. 21 Managing Changes

Copyright © 2005, SAS Institute Inc. All rights reserved. 22 Identify and Describe Changes  Sources of Information Tech Support SAS Notes Mail & File Lists (TSNEWS-L) Monitoring Tools  Sources of SAS Updates Hot Fixes Service Packs

Copyright © 2005, SAS Institute Inc. All rights reserved. 23 Identify and Describe Changes - Future Electronic Software Downloads Automatic Alert Notification

Copyright © 2005, SAS Institute Inc. All rights reserved. 24 Request and Approve Changes  Classify Change  Submit Request  Obtain Approval

Copyright © 2005, SAS Institute Inc. All rights reserved. 25

Copyright © 2005, SAS Institute Inc. All rights reserved. 26 Implement and Verify Changes  Test environment  SASIQ/SASOQ  Data Migration

Copyright © 2005, SAS Institute Inc. All rights reserved. 27 Copyright © 2003, SAS Institute Inc. All rights reserved. SASIQ/SASOQ  Automated  Tested  Repeatable  Reports and Stores Results (XML) support.sas.com/rnd/migration/planning/validation /

Copyright © 2005, SAS Institute Inc. All rights reserved. 28

Copyright © 2005, SAS Institute Inc. All rights reserved. 29

Copyright © 2005, SAS Institute Inc. All rights reserved. 30 Data Migration  Proc Migrate  Migration Macros  Guidance and tools available at

Copyright © 2005, SAS Institute Inc. All rights reserved. 31 Implement and Verify Changes – Future  IQ/OQ Enhancements  Install Enhancements  Less media (1 instead of 19)

Copyright © 2005, SAS Institute Inc. All rights reserved. 32 Document  Initial Change Requests  IQ/OQ Output  SAS Logs  SAS Registry (Future)  Design / Configuration Specification Change Log

Copyright © 2005, SAS Institute Inc. All rights reserved. 33

Copyright © 2005, SAS Institute Inc. All rights reserved. 34 Security  Physical  Logical Operating System Level Account Maintenance Internet Security SAS Management Console

Copyright © 2005, SAS Institute Inc. All rights reserved. 35 Business Continuity  Backups  Redundancy  Environmental Controls  Disaster Recovery

End-to-End Seamless Integration; Semantic Interoperability Pharma Medical & Statistical Reviewers Approval Open Data Model - XML based, CDISC compliant Patients Subject CDMS Op DB Investigator Physician ODMSDTM LABADaM Source: Dave Iberson-Hurst

Copyright © 2005, SAS Institute Inc. All rights reserved. 37 Copyright © 2005, SAS Institute Inc. All rights reserved. 37