Watch the on-demand recording here: bit.ly/GxPValidationwithCloud Cloud-based regulated systems greatly accelerate the GxP validation process, improving IT efficiency. By performing and documenting the installation qualification (IQ) and operational qualification (OQ) procedures, modern cloud applications ease the validation burden on IT teams and speed validation process. However, common misconceptions about the cloud prevent IT teams from taking advantage of a faster and better validation process. During this webinar, "Demystifying Cloud Systems and Validation Best Practices for Life Sciences", we discuss this topic and with PricewaterhouseCoopers (PwC). By watching, you will learn GxP validation best practices in a cloud environment and gain insights into: - How to evaluate various types of cloud-based quality systems - How traditional vs. cloud validation approaches impact your business - How to apply a tactical framework to validation

1. 1Copyright © Veeva Systems 2019
Demystifying Cloud Systems
and Validation Practices
for Life Sciences

2. Ashley Wentworth
Director, Quality Strategy, Veeva Systems
Managing Director, PwC
Robert Lorence
Senior Manager, Digital Quality, PwC
Jhumki Sen

3. 3Copyright © Veeva Systems 2019
Table of Contents
Emergence of Transformative Projects
1
Emergence of Cloud-based Regulated Systems
2
Benefits of the Industry Cloud
3
Cloud System Validation vs. Traditional Validation
4
Common Misconceptions and Best Practices
5
Q&A
6

4. 4Copyright © Veeva Systems 2019
Polling Question

5. 5Copyright © Veeva Systems 2019
Emergence of Transformative Projects
Emergence of
21 CFR Part 11
Replacing Home-
Grown Apps and
Manual
Processes
Remediation of
Specific
Compliance
Challenges
Aging,
Fragmented
Solution
Landscape
Transformative
Unification
Projects
Since 1990’s Today

6. 6Copyright © Veeva Systems 2019
Emergence of Cloud-based Regulated Systems
• Deployed Internally
• Single-Tenancy
• High Compliance
On-premises
Ease of Upgrade
Scalability
• Deployed Internally
• Single-tenancy
• Validation Burden

7. 7Copyright © Veeva Systems 2019
Emergence of Cloud-based Regulated Systems
• Deployed Internally and
Externally
• Single/Multi-tenancy
• Validation Burden
Hybrid Cloud
• Deployed Internally
• Single-Tenancy
• High Compliance
On-premises
Ease of Upgrade
Scalability
• Deployed Internally
• Single-tenancy
• Validation Burden

8. 8Copyright © Veeva Systems 2019
Emergence of Cloud-based Regulated Systems
• Deployed Internally and
Externally
• Single/Multi-tenancy
• Validation Burden
Hybrid Cloud
• Deployed Internally
• Single-Tenancy
• High Compliance
On-premises
Ease of Upgrade
Scalability
• Deployed Externally
• Single-tenancy
• Validation Burden
Hosted/
Private Cloud
• Deployed Internally
• Single-tenancy
• Validation Burden

9. 9Copyright © Veeva Systems 2019
Emergence of Cloud-based Regulated Systems
• Deployed Internally and
Externally
• Single/Multi-tenancy
• Validation Burden
Hybrid Cloud
• Deployed Internally
• Single-Tenancy
• High Compliance
On-premises
Ease of Upgrade
Scalability
• Deployed Externally
• Single-tenancy
• Validation Burden
Hosted/
Private Cloud
• Deployed Externally
• Multi-tenancy
• Compliance Risk
Public Cloud
• Deployed Internally
• Single-tenancy
• Validation Burden

10. 10Copyright © Veeva Systems 2019
Emergence of Cloud-based Regulated Systems
• Deployed Internally and
Externally
• Single/Multi-tenancy
• Validation Burden
Hybrid Cloud
• Deployed Internally
• Single-Tenancy
• High Compliance
On-premises
Ease of Upgrade
Scalability
• Deployed Externally
• Single-tenancy
• Validation Burden
Hosted/
Private Cloud
• Deployed Externally
• Multi-tenancy
• Compliance Risk
Public Cloud
• Deployed Externally
• Multi-tenancy
• Standardized Best Practices
Industry Cloud
• Deployed Internally
• Single-tenancy
• Validation Burden

11. 11Copyright © Veeva Systems 2019
Benefits of Multi-tenant Systems
On-premises / Hosted Multi-tenant
Infrequent and laborious upgrades Always current
Performance degrades as usage grows; user latency in
some regions
Built to scale and perform
Multiple software versions with different release
schedules
Single version
Security and administration is difficult; integrations
can be challenging
Secure
IQ and OQ must be performed by customer IQ/OQ pre-validated

12. 12Copyright © Veeva Systems 2019
Industry Cloud Benefits
• Built-in best practices for life sciences
• New industry features for evolving business
requirements
• Built to support regulatory compliance
• Secure, easy access on any device, from
anywhere
• Intuitive, requires less training
• Easily bring partners into the environment
• 100% multi-tenant SaaS, zero footprint
• Built-in industry best practices, storage, backup,
and archive
• Secure, different levels of access
• Configure to adapt
• On-demand scalability
• Single version, always current
• Pre-validated: IQ/OQ validated, PQ ready
For Business For IT

13. SaaS Validation
Approach
December 2019

14. 14Copyright © Veeva Systems 2019
Polling Question

15. © PricewaterhouseCoopers
PwC Confidential – For Client Use Only
Guiding Principles of SaaS Validation
15
Responsibility and
Accountability
Risk Based
Strategies
UAT Initial and Ongoing
Validation
Access and
Authentication Controls
Role-based Security
Encryption to Ensure
Data Integrity
Identify, Document and
Address Risk
Justify Validation
Rationale
Perform Comprehensive
Vendor Due Diligence
Client Responsibility
Comprehensive
Coverage Including
ERES
Focused on Business
Process and Intended
Use
Well-defined Change
and Release
Management
Support Procedures
(Vendor and Client)

16. © PricewaterhouseCoopers
PwC Confidential – For Client Use Only
SaaS Validation Approach & Combined Service Offerings w/Tech Vendor
16
Vendor Audit
Report
Regulatory Risk
Assessment
Validation Plan
UAT Traceability Matrix
UAT ScriptsUser Stories
Data
Migration Test
Scripts
Interface
Requirements
Data
Migration
Requirements
Interface Test
Scripts
Business
Requirements
(BRD)
Operational
Qualification
(OQ)
Traceability Matrix: BRD-OQ
Test Plan
Data Migration
Plan
Test Summary
Data Migration
Summary
Validation
Summary
Procedural Readiness
Verification
Installation
Qualification
Delivered app
Configuration
Specification
Installation Qualification:
Client app
Plan Validation Deploy SystemExecute Validation
On-going Validation
VendorClient Combination

17. © PricewaterhouseCoopers
PwC Confidential – For Client Use Only
What’s Different
Client Vendor Client Vendor
Traditional Validation SaaS Validation
17
Regulations Vendor
Reliance
Infrastructure
Upkeep
Vendor Due
Diligence
Scaled Down
Testing
Ongoing
Validation
Regulations Vendor
Reliance
Infrastructure
Upkeep
Vendor Due
Diligence
Scaled Down
Testing
Ongoing
Validation

18. © PricewaterhouseCoopers
PwC Confidential – For Client Use Only
Common Misconceptions
SaaS validation is the
vendor’s responsibility
I don’t have to do any
testing for a SaaS
implementation
This model is too risky for
my highly confidential
business processes and data
Health agency inspections
for SaaS systems are
vendor’s responsibility
Now I need to
validate/regulate how the
SaaS vendor operates ?
Now I need to
validate/regulate how the
SaaS vendor operates ?
3 releases a year is a lot
of year-on-year
validation burden
18
Cost of ownership is too
high for my organization

19. © PricewaterhouseCoopers
PwC Confidential – For Client Use Only
The Ideal Scenario
Ideal
Approach
• Risk-based approach grounded in applicable regulations and best practice
• Vendor due diligence
• Well-developed service management contracts
• Comprehensive user acceptance activities
Ideal
Solution
• Mature, innovative product roadmap
• Well-defined SDLC and release management processes
• Multiple offerings on a consolidated platform
• Robust and flexible integration capabilities
Ideal
Partner
• Substantial industry and product perspectives
• Proven toolkit to accelerate a risk-based validation
• Established partnerships with technology leaders
• Ability to build inspection and business readiness at deployment
19

20. 20Copyright © Veeva Systems 2019
Questions

21. 21Copyright © Veeva Systems 2019
Thank you

22. 22Copyright © Veeva Systems 2019
Polling Question #1
What type of technology is your organization using today for regulated
content and data management?
1. On-premise technology only
2. A mix of on-premise and cloud systems
3. Cloud systems only
4. Manual/paper-based processes only
5. Manual/paper-based processes with some technology

23. 23Copyright © Veeva Systems 2019
Polling Question #2
What is your top concern in validating a regulated cloud/SaaS application?
1. Data integrity
2. Regulatory compliance
3. Cost
4. Support and ongoing management
5. Strategy/approach to validation