A paperless solution not only reduces printing costs; it also streamlines the entire life sciences regulatory submission and approval process, from CSV validation across the value chain.

1. • Cognizant 20-20 Insights
e-Signatures: Making Paperless
Validation a Reality
A paperless solution not only reduces printing costs; it also
streamlines the entire life sciences regulatory submission and
approval process, from CSV validation across the value chain.
Executive Summary paper-based CSV processes and enables life
sciences companies to create electronic signa-
Global life sciences companies are increasingly
ture-based approvals for submission to external
storing documentation in electronic formats to
regulatory agencies.
improve operational efficiencies. The industry’s
embrace of a paperless environment is also This white paper demonstrates how companies
driven by cost-cutting objectives and green IT using this solution can significantly reduce paper
principles. As such, organizations are adopting printing costs, minimize the transportation of
electronic records to establish validation of appli- wet-ink authenticated artifacts and reduce the
cations during computer systems validation (CSV) time taken to complete the entire documentation
processes. approval, including security measures for main-
taining paper-based records for the specified
As life sciences companies transition to electronic
archival period.
documentation, regulators have enacted security
policies and practices to guard electronic infor-
Need for Electronic Signatures
mation. The U.S. Food and Drug Administration’s
(FDA) Title 21 Code of Federal Regulations Part Stringent regulations enforced by various global
111 and EudraLex Annex 112 regulations mandate regulatory authorities require life sciences
adequate control of electronic records and companies to validate and demonstrate
signatures that are used as objective evidence compliance of prescribed information systems
of a validated state of applications. To comply or applications used to support core business
and protect themselves from financial penalties, processes. This demonstration of fitment is called
companies use robust security measures to computer systems validation (CSV).
preserve electronic information. HP Quality
Paper-based validation projects consume an
Center is the tool of choice for managing
average of 300 pages of printed copies of scripts.
electronic documents, as it facilitates the efficient
Scanning these scripts for subsequent manual
storage and retrieval of controlled copies for
authentication multiplies the project cost. Added
future audit purposes.
to those expenses is the incremental cost of
We have developed an e-signature solution, maintaining these documents in a physical state
iAuthorize,™ that does away with traditional for the stipulated archival period, which includes
cognizant 20-20 insights | march 2013

2. Validation’s Paper Volume
Wet Signature Wet Signature Wet Signature Wet Signature
3,030
900 Pages 450 Pages 990 Pages 690 Pages = Pages!!
Approver 300 Pages 150 Pages 330 Pages 230 Pages
Reviewer 300 Pages 150 Pages 330 Pages 230 Pages Total
Pages
Creator 300 Pages 150 Pages 330 Pages 230 Pages
Printed
330 Pages 230 Pages
300 Pages 150 Pages
Across
Two Environments
BRD Design Validation IQ Scripts OQ Scripts IQ Logs OQ Logs Summary User
Document Document Plan Report Manuals
50 Pages 50 Pages 60 Pages 10 Pages 80 Pages 20 Pages 120 Pages 20 Pages 80 Pages
Lifecycle
Test
Lifecycle FHS
Document
Risk
Assessment
Test
Strategy
PQ Scripts Traceability
Matrix
PQ Logs Screen
Shots
Defect
Reports
Other
Mandatory
Document Docs
80 Pages 30 Pages 30 Pages 40 Pages 20 Pages 30 Pages 160 Pages 30 Pages 100 Pages
Analysis Design Execution Closure
Figure 1
storage in weather-resistant cabinets. A simple records to ensure that the signatures cannot be
validation project with mandatory documentation excised, copied or otherwise transferred to falsify
and wet approvals can consume more paper than an electronic record by ordinary means. It also
imaginable. states that electronic signatures must be “unique
to one individual and shall not be reused by, or
Figure 1 represents a sample from a simple assigned to, anyone else.” They may be based on
validation engagement with two levels of review biometrics or an identification code/password
and approval. Over 3,000 pages are printed for one combination.
review and approval cycle to meet the mandatory
documentation required for validation. EudraLex Annex 11, which is applicable to
companies doing business in the EU, modified its
Regulations PIC/S-11 to Annex 11 in June 2011. The provisions
The first and most significant regulation that was state: “For critical data entered manually, there
initiated in this respect was the FDA’s Title 21 Code should be an additional check on the accuracy
of Federal Regulations (CFR) Part 11. Various other of the data. This check may be done by a second
geographies, such as the European Union (with operator or by validated electronic means. The
EudraLex) and Japan (with the Pharmaceuticals criticality and the potential consequences of
and Medical Devices Agency, or PMDA), base their erroneous or incorrectly entered data to a system
mandates for electronic document controls pre- should be covered by risk management.”
dominantly on the 21 CFR Part 11 guidelines.
Complying with these two critical pieces of legis-
According to 21 CFR Part 11, “Persons may use lation allows life sciences organizations to meet
electronic records in lieu of paper records the compliance requirements of major geogra-
or electronic signatures in lieu of traditional phies, as they form the superset of guidelines for
signatures, in whole or in part, provided that control of electronic documents.
the requirements of this part are met,” and that
a docket stating a company’s intent has been Granting approval to use electronic records and
submitted to the FDA. Subpart B on the usage of electronic signatures, 21 CFR Part 11 and EudraLex
electronic records establishes the system controls Annex 11 represent a paradigm shift by allowing
that must be in place if electronic records and major efficiency improvements in the business’s
signatures are to be used. operations. Life sciences companies, therefore,
need an electronic authentication mechanism
The mandate stipulates that electronic signatures that demonstrates both functional and regulatory
should be linked to their respective electronic compliance.
cognizant 20-20 insights 2

3. Cognizant’s e-Signature Solution: of test management processes, such as require-
iAuthorize ments management, test plan, test execution and
defect management modules commonly found in
To better manage and control their electronic
test management tools. It does this by enforcing
documentation and meet the requirements of
workflow with electronic signatures across the
21 CFR Part 11 and EudraLex Annex 11 provisions,
spectrum of test management
we developed iAuthorize to complement test
processes. Built-in flexibility iAuthorize can
management tools used in the electronic storage
enables compatibility with both
of validation artifacts. This solution negates
regulated and non-regulated
potentially save up
the need for printing documents solely for the
projects (see Figure 2). to 15% of the cost
purpose of capturing a handwritten signature,
thereby establishing a fully electronic process. of validation for life
While our solution is aimed
Based on our assessment, deploying this solution primarily at life sciences sciences organizations
can potentially save up to 15% of the cost of companies, it can also be used and enable them
validation for life sciences organizations and
enable them to embrace environmentally friendly
in other industries where
to embrace
regulatory documentation
“green” policies. mandates and compliance leg- environmentally
Solution Demystified
islation requires electronic friendly “green”
iAuthorize is built on top of HP-Quality Center, the
signatures and digital authenti-
policies.
cation of electronic documents.
most widely used test management tool across
regulated industries, which forms the repository Salient features of iAuthorize include:
of controlled copies of validation documents. It
is a closed system, as mandated by regulatory • Ease of customization of workflows: Helps
enable users to customize levels of authenti-
guidelines, where access is controlled by individu-
cation, thereby providing the scalability and
als responsible for the content and control of the
flexibility to customize workflows according to
electronic records.
need.
iAuthorize integrates with any lightweight • Support for bulk approvals: Supports bulk
directory access protocol (LDAP) or user authen- approval of all artifacts, which are duly reviewed
tication system to provide digital authentication. and signed off from a regulatory perspective.
It enables “end-to-end” authentication support
iAuthorize Overview
Checks in
Testing Artifact
HP ALM Workflow
HP ALM Modules
Customization
Validation
Analyst
System Triggers Mail Requirements
iAuthorize
Tool Add-in
Reviews and Test Plan
Approves
Validation
Lead
Electronic Signature Test Execution
System Triggers Mail LDAP/User
Authentication
Module
Defects
Reviews and
Approves
Validation
Lead
Electronic Signature
Figure 2
cognizant 20-20 insights 3

4. • End-to-end support of test management password is used for managing the approval
activities: Supports test management process- process.
es such as the requirements, test plan, test lab
and defects modules of HP QC 10 and HP ALM 11. While ensuring that regulatory compliance is the
primary focus of the digital signature process, this
• Generation of downloadable validation solution also provides an ideal platform for life
summary reports: This out-of-the-box feature sciences organizations that want to move toward
enables generation of downloadable validation paperless validation and completely discard the
summary reports in PDF or HTML formats. use of printed versions of validation artifacts. In a
• Audit trails: Provides detailed audit trails for nutshell, this solution provides a secure and con-
stakeholders and regulatory organizations. figurable approval process for use in regulated
environments by electronic signatures.
• Applicability in other industries: Suitable for
other regulated industries, such as healthcare, iAuthorize has been systematically validated in
food products, health supplements, etc., that line with our CSV framework (aligned with GAMP
mandate electronic signatures. guidelines) to meet adequate documentation and
Detailed audit trails and automated review and objective evidence regulatory requirements (see
approval mechanisms ensure compliance with Figure 3).
21 CFR Part 11 and EudraLex Annex 11 guidelines.
Notification to individual owners and stakehold- Integration with HP Quality Center
ers about status and state transitions is enabled iAuthorize provides ready integration with HP
through automatic e-mail notification function- Quality Center, helping clients save time and effort
ality. The solution is readily adaptable through related to protocol design for tool validation and
configurable workflow customization, aligned to development of add-ons to the test management
the individual organization’s validation processes. tool. As this solution is built over HP ALM 11.0/HP
The security and authentication mechanisms are QC, it enables clients to leverage existing invest-
in line with 21 CFR Part 11 and EudraLex Annex ments in tool licenses. The active version of the
11 requirements, which warrant dual authentica- solution framework currently works with HP
tion credentials. This solution currently uses the Quality Center on both HP ALM 11.0 and HP QC
User-LDAP authentication feature of HP Quality 10.0 as the test management tool.
Center, wherein a unique user ID and associated
iAuthorize Benefits
Regulatory Compliance Faster Turnaround Time
Demonstrated Automated process
compliance with reduces manual
life sciences intervention and
predicate rules. removes inefficiencies.
Hassle-Free Audits Cost Benefits
Archiving functionality Achieves up to 10%
to store documents cost benefits
and test assets in a compared with a
single place with paper-based validation
detailed audit trails. model.
Effective Test Secure Access
Management Electronic encryption
Built in adapter for HP function for higher
QC Test Management security of electronic
tool for straight- signatures.
through QA-related
data transmission.
Figure 3
cognizant 20-20 insights 4

5. Footnote
1
“Guidance for Industry: Part 11, Electronic Records; Electronic Signatures – Scope and Application,” U.S.
Department of Health and Human Services, August 2003, http://www.fda.gov/downloads/Drugs/Guid-
anceComplianceRegulatoryInformation/Guidances/ucm072322.pdf.
2
“EudraLex Annex 11: Computerised Systems,” European Commission Health and Consumers Directorate-
General, http://ec.europa.eu/health/files/eudralex/vol-4/annex11_01-2011_en.pdf and http://ec.europa.eu/
health/files/eudralex/vol-4/pdfs-en/anx11_en.pdf.
About the Authors
Rangarajan Rajamani is a Consulting Manager in Cognizant’s Quality Engineering & Assurance Services
business unit and has over 11 years of experience in consulting and developing solutions along the themes
of regulatory compliance and operational excellence in the life sciences industry. Rangarajan was a
key member of the team that developed iAuthorize. He has worked in global pharma regulations, CSV
lifecycle, pharmaceuticals manufacturing and compliant supply chains, sales and channel management,
solution prototyping and back-end support for business development. Rangarajan has supported over
25 QMS and process audits and five vendor code of conduct (CoC) audits across industries. He can be
reached at Rangarajan.Rajamani@cognizant.com.
Sagar Mundada is a key member of Cognizant’s Quality Engineering & Assurance Services business unit
and has over 10 years of experience in HP test tools administration (TD 7.6, QC 10.0, HP ALM 11.0, HP
QTP, PC). Sagar was the quality center expert who created the e-Signature workflow architecture built
on HP QC and has developed tools and utilities to automate the HP QC administration activities. He has
also created reports using HP Delivery Dashboard and integration with third-party tools. Sagar worked
on projects connected with various GXP and 21 CFR Part 11 compliance used in life sciences, imple-
mentation and maintenance of frameworks that replace traditional paper-based manual CS processes,
enabling electronic signature-based approval for submission to many global pharmaceutical and biotech
companies. He can be reached at Sagar.Mundada@cognizant.com.
G. R. Ragesh is a key member of Cognizant’s Testing Center of Excellence R&D team, with over seven
years of experience developing innovations, tools and frameworks related to test automation. He is
responsible for developing the electronic signature framework that runs on top of the HP QC LDAP
authentication process. Ragesh can be reached at Ragesh.GR@cognizant.com.
Rahul Deshpande is a Senior Manager in Cognizant’s Quality Engineering & Assurance Services business
unit. Rahul has over 13 years of experience in test consulting and designing innovative solutions for the
life sciences industry. He manages the QA delivery and client relationships of Cognizant’s life sciences
industries in North America. Rahul led the team that developed iAuthorize from concept to product
rollout. In his current role, Rahul provides thought leadership and implementation assistance to clients
as they transition in QA maturity. He can be reached at Rahul.Deshpande@cognizant.com.
About Cognizant
Cognizant (NASDAQ: CTSH) is a leading provider of information technology, consulting, and business process out-
sourcing services, dedicated to helping the world’s leading companies build stronger businesses. Headquartered in
Teaneck, New Jersey (U.S.), Cognizant combines a passion for client satisfaction, technology innovation, deep industry
and business process expertise, and a global, collaborative workforce that embodies the future of work. With over 50
delivery centers worldwide and approximately 156,700 employees as of December 31, 2012, Cognizant is a member of
the NASDAQ-100, the S&P 500, the Forbes Global 2000, and the Fortune 500 and is ranked among the top performing
and fastest growing companies in the world. Visit us online at www.cognizant.com or follow us on Twitter: Cognizant.
World Headquarters European Headquarters India Operations Headquarters
500 Frank W. Burr Blvd. 1 Kingdom Street #5/535, Old Mahabalipuram Road
Teaneck, NJ 07666 USA Paddington Central Okkiyam Pettai, Thoraipakkam
Phone: +1 201 801 0233 London W2 6BD Chennai, 600 096 India
Fax: +1 201 801 0243 Phone: +44 (0) 20 7297 7600 Phone: +91 (0) 44 4209 6000
Toll Free: +1 888 937 3277 Fax: +44 (0) 20 7121 0102 Fax: +91 (0) 44 4209 6060
Email: inquiry@cognizant.com Email: infouk@cognizant.com Email: inquiryindia@cognizant.com
©
­­ Copyright 2013, Cognizant. All rights reserved. No part of this document may be reproduced, stored in a retrieval system, transmitted in any form or by any
means, electronic, mechanical, photocopying, recording, or otherwise, without the express written permission from Cognizant. The information contained herein is
subject to change without notice. All other trademarks mentioned herein are the property of their respective owners.