1. What if There Were no Part 11?
A Value-Based Perspective
Mark P. Roache

2. An Introduction KMI/PAREXEL LLC Mark Roache CRO and Consulting
Life-Sciences
Multi-National
Business, Compliance and Validation Consulting
Mark Roache
Director, Account Management
Client Value and Strategy

3. Objectives Reset Perspective Recommendations for Industry
Suggestions for Useful Regulation

4. Our Industry is Being Squeezed
Price
Pressures
Business: M&A
Maturing
Time to
Market
Compliance
New Reg’s
SOX, HIPAA
Efficiency
Enforcement

5. IT Can Help Meet the Challenges
Data Capture,
Analysis
Knowledge
Transfer
Mfg Efficiency
Change,
AE’s
Documents&
Workflow
IT Infrastructure
Applications
Software
21 CFR Part 11
R&D
Clinical
Regulatory
Marketing
Scale-up &
transfer
Manufacture
& Distribute
Retire
Monitor and
Improve

6. Why Does Part 11 Get in the Way?
Technical focus on Compliance
Over-interpretation of regulation
Lack of perceived value
Inflated estimates of added costs

7. Getting Value from IT Business Processes Server Apps and Processes
Defined business process and requirements
(Predicate Rules)
Business Processes
Server Apps
and Processes
Client Footprint
Quality assurance on technical solution
(AKA Validation)
Operating Sys and Support Apps
Servers
Network
& RF
Workstations
& Handhelds
Physical Environment
Robust and complete procedures
(AKA Governance)
IT Asset Management Procedures

8. How do controls support value?
Control should be appropriate
Context based - Business Process & Technology
Documented - Active Exclusion
Scope and extent - Risk/Value

9. How to Quantify Risk and Value?
Failure
Discoverable?
High
Impact
Failure Modes
Regulations
Med.
Impact
System
Characteristic
Impact
Assessment
Low
Impact
Impact of
Failure
System
Barriers

10. Analysis of Risk and Value enables decisions now
The Pareto Principle
80% of the risk comes from 20% of the process
or….
80% of the value comes from 20% of the system
Benefits:
Cover what’s really needed
Avoid overspend and scope creep

11. There is insight in how we summarize risk and value… a longer-term view
IT Domain
Platform/ Performance
Security
Virus/ Patches
Backup
Change/Config
Ops Domain
QA Domain
Business Processes
ERP
LIMS
EDMS
Clinical
PDM/PLM

12. Essential Elements for Value & Compliance
Defined requirements
Optimized business practice
Governed by predicate rules
Acceptance & Validation
Driven by Risk/Value
Adequate & complete
Risk/Value Analysis
Determines scope and extent
Compliance and business risks
Active exclusion
IT Governance
Sustainability
Applicability

13. Essential Elements for Regulation
Defined requirements
Predicate Rules
Acceptance & Validation
Adequate & complete
Risk/Value Analysis
Should be required
Record process/rationale
Active exclusion essential
IT Governance
Just another quality system
Training
Documentation

14. What does it mean? Industry Regulators Focus on processes Operations
Refocus on value and ROI
QA, Compliance
Compliance in context IT
Implement Quality Systems
Regulators
Focus on processes
Implementation
Governance
Use Risk/Value as pivot
Shift Approach
Knowledgeable
Discretionary

15. Thank You! Mark P. Roache Director, Account Management
Cellphone: (650)