Sage X3 FDA Compliance Validation

The Challenge

A medical technology company was upgrading their enterprise resource planning (ERP) software system to the latest Sage X3 platform in order to improve their efficiencies in accounting, distribution, and manufacturing.  They would be implementing the Sage X3 platform as a SaaS (Software as a Service) with a browser-based interface.  The scope of the system implementation was to include warehouse, customer care, field service, purchasing, planning, manufacturing, document control, handheld scanner, and quality control components.  Computer System Validation would be required to bring the system into FDA GxP compliance.

The company contracted Performance Validation (PV) to create a Computer System Validation (CSV) package for their new system.  As a previous client, the company’s stakeholders were happy with the templates, format, and content of the validation package delivered by PV.  At the client’s request, PV worked remotely to develop system documentation that would comply with the client’s internal procedures.  The client also requested that on-site test execution would be performed, as necessary, to qualify peripherals and to get additional assistance from the client’s Subject Matter Experts (SME).

The PV Advantage

PV established reoccurring meetings with the client stakeholders to gain information for the creation of a validation plan and to complete assessments (Risk and 21 CFR Part 11).  On completion of the system documentation, the PV team accelerated their effort toward writing of the test protocol to ensure adherence to the client’s timeline for implementation.

The following components detail the PV solution:

1. PV created a Validation Plan to outline the validation deliverables and the strategy for qualification testing. This document included:
   1. A System Risk Assessment was performed and documented following the ISPE GAMP 5 Guide. The software was assessed as a GAMP Category 4 (configured software), with low risk for both likelihood and severity of system component failures. Based on the results of the assessment, PV was able to right-size the qualification phase to focus on integrated testing of standard workflows and configured functionalities, rather than detailed quality testing of individual low-level software component details.
   2. 21 CFR Part 11 compliance assessment.  PV understood the regulations, the FDA Guidance, and the preamble requirements.  This assessment outlined areas of the software that needed to be addressed with a procedure (i.e. gaps) and was also used to create user requirements. A summary of how the gaps were addressed was also generated to include with the validation package.
   3. User roles and responsibilities were defined including limitations, exclusions, and assumptions.
   4. Requirements for procedural documentation governing security, business continuity, training, and overall validation management were listed.
2. PV created a User Requirements Specification document.  The document was develop based on a client-provided spreadsheet list which listed the software requirements to support the business process of each affected department within the organization (example: accounting, warehouse, purchasing, etc..) as well as a list of the “end-to-end” processes.
   1. Requirements were developed over several rounds of stakeholder reviews and updates to sort out redundancies and refine the specific required software functionality. The PV team’s extensive years of experience in writing requirement documents for computer systems enabled them to write testable, concise, and repeatable requirements.
   2. At the client’s request, the PV team gave additional focus to requirements for several key user roles within organization. A user roles and permissions table was generated and included with the User Requirements Specification to ensure that system permissions satisfied the customer’s business processes, and that these permissions would be tested.
   3. Although the Sage EM software platform is web-based and provided as a Software as a Service “SaaS”, PV identified several peripheral client access components to be included for validation.
3. PV generated initial drafts of the test protocols by exploring the software, help menus, and forums initially.  The team then began scheduling time with individual SMEs for respective business areas for support in drafting the test scripts in a manner that ensured that the testing would be reproducible.  Final drafts of all test protocols were entered into client’s document management system to be routed for approval.
4. PV sent a team member out to the clients’ location to execute on-site testing and to provide guidance, to facilitate review of executed test scripts, and to ensure expedient execution for the remaining user acceptance scripts.  A second PV team member simultaneously performed off-site remote testing from the PV office location.
5. PV created a Requirements Traceability Matrix to document where each user requirement was qualified as evidenced by either testing or vendor documentation.
6. Concerns regarding the system and documentation were brought to the attention of the Quality Assurance department in a timely manner to ensure they were appropriately addressed as early as possible to avoid further remediation.
7. PV provided regular project status updates on progress of the validation deliverables, project budget, and risks to the project and schedule.
8. The team delivered a Validation Summary Report to record the delivery of all the planned validation deliverables and to detail how the clients’ documentation satisfied regulatory requirements.

The Results

The Sage X3 ERP validation was completed ahead of schedule, meeting the customer’s overall system implementation deadlines.  The company gained awareness of gaps in their procedures and security and resolved them.  PV completed the validation effort by practicing excellent documentation standards, testing processes, and a focus on the customer needs.  This medical device company now has an ERP system that is compliant with FDA regulations for computerized systems.

The Benefits

Performance Validation provided the client with consultation through understanding the software, the stakeholders, and their needs, and proposing the best fitting validation strategy for an Enterprise Resource Planning solution.  Performance Validation’s experience with creating testable User Requirements from various inputs helped expedite that portion of the project.  Experience testing user roles was also valuable to streamline the testing documentation.

Have a question about computer system validation? 

For more information, please, schedule a call with one of our subject matter experts.

Kevin Marcial
Sr. Validation Engineer