GxP Applications

1. GxP Applications Validation Status and Recommendations

2. Overview/Objective • There is no process owner for Computer System Validation (CSV) • This void has led to questionable validation status of major GxP applications supporting the ASP business: • Dataflo & Service Alliance: Not considered validated • EzDOC: Considered validated, but requires optimization • This poses regulatory risk to the ASP business • The cost to fully remediate Dataflo, Service Alliance and EzDoc is ≈$3.3 Million • The cost to mitigate Dataflo & Service Alliance, and fully remediate EzDOC is ≈ $150,000 • The approach taken needs to be weighed against the risk of: • Probability of FDA audit around these applications • Impact of any FDA finding on the ASP business • I/T application strategic roadmap • Need to answer • What level of remediation should we undertake and in which areas? • Who should be the owner of CSV?

3. Recommendation Summary • Dataflo • Centralize existing documentation in EzDOC • Create metadata to help identify what exists • Approximate cost $15,000 • Service Alliance • Centralize existing documentation in EzDOC • Create metadata to help identify what exists • Approximate cost $15,000 • EzDOC • Retire ITPR-101107, still effective in EzDOC; Replace with SDLC • Collect signatures on missing documentation • Configure EzDOC to accommodate all SDLC deliverables • Optimize SDLC system documentation • Scan all documentation in DCC and store in EzDOC • Approximate cost $120,000 • Computer System Validation Owner • To be consistent with most MD&D Companies, owner should be in Quality • This may change over time as the MD&D Quality Organization evolves

4. Dataflo • System implemented in 1995 with no validation documentation. • In 2007, outside firm engaged to create an SRS and some testing documentation. • Since 2007, changes have been tracked in binders, changes have been tested, but starting from a validated base. • Of 15 required SDLC deliverables, only 1 exists. • Level of effort required to fully remediate is significant: 9 people for a year dedicated to documentation and testing. • System planned retirement in 24 months. • Short term risk mitigation: • Centralize existing documentation in EzDOC • Create metadata to help identify what exists • Approximate cost $15,000

5. Service Alliance • System implemented in 2003 with SRS created in 2008. • Changes made since that time have not been documented consistently or incorporated into the SRS. • Of 15 required SDLC deliverables, only 1 exists. • Level of effort required to fully remediate is significant: 7 people for a year dedicated to documentation and testing. • System planned retirement in 12 months. • Short term risk mitigation: • Centralize existing documentation in EzDOC. • Create metadata to help identify what exists. • Approximate cost $15,000

6. EzDOC • System implemented in 2007 as per methodology at time (ITPR-101107). Documentation included: • Validation strategy URS, testing, traceability matrix & validation report • Independent review conducted by QA • Since SDLC adoption in 2009, required deliverables have been created by project, rather than for system. • All documentation is stored in EzDOC & binders in DCC. • Performed gap analysis of all EzDOC documentation. System should be considered validated. Details of analysis attached. • No replacement scheduled in near future. • Risk mitigation: • Retire ITPR-101107, still effective in EzDOC; Replace with SDLC • Collect signatures on missing documentation • Configure EzDOC to accommodate all SDLC deliverables • Optimize SDLC system documentation • Scan all documentation in DCC and store in EzDOC • Approximate cost $120,000