Five Takeaways for Modernizing RIM System Validation

Life sciences companies are rethinking their approach to system validation in response to the FDA’s draft guidelines on Computer Software Assurance (CSA). Moving from the decades-old, documentation-focused Computer Systems Validation (CSV) approach to modern, risk-based CSA practices allows organizations to make system changes more quickly and with less administrative overhead. It also increases their ability to benefit from continuous innovation offered by true SaaS based technology providers.

At the Veeva R&D and Quality Summit Connect, Pratyusha Pallavi, senior director of Vault RIM strategy, led a roundtable discussion on why and how to modernize RIM system validation. Here are five practical takeaways from her conversation with Craig Gassman, senior director of corporate information systems at Vericel; Mike Martelli, head of global regulatory sciences and informatics at Blueprint Medicines; and Matt Neal, senior director of regulatory affairs operations at Atara Biotherapeutics.

Many biopharmas apply the same rigorous validation standard to RIM systems as they do classic GxP systems, like safety and quality. The panelists offered an alternative to this default position. They categorized the RIM system as a business operations tool that centralizes and reports on data generated in upstream GxP systems. As such, they endorsed a GxP lite approach in which the RIM system is still controlled with auditable changes, but validation efforts focus on what matters most.

If a new functionality or feature set won’t impact patient safety or system quality, it doesn’t warrant rigorous validation. Martelli shared Bluepoint’s framework for the changes that require full validation and change control—like integrations and new workflow configurations—and those that don’t, such as new objects, reports, and picklist values. By differentiating between minor and major changes, RIM leaders can strike a balance between rapid innovation and a structured approach to compliance and audit readiness.

Atara and Vericel both use Vault RIM to record and report on every change made to the system. Neal described how Atara leverages the service request functionality configured in Vault RIM as a self-contained, built-in change management tool. This tracks a system change request through its lifecycle states, from the initial request, through review and approval, to implementation. Users add notes, attachments, screenshots, videos, and emails to the record to further document the change. The result is a searchable, defensible audit trail that is easily shared with inspectors using Vault RIM reporting and dashboards.

All panelists encouraged viewers to have open conversations with IT and QA on challenging the status quo of a conservative approach, backed by clearly documented SOPs. When implementing Vault RIM at Vericel, Gassman made a concerted effort to educate and earn the trust of IT via multiple rounds of such conversations. By helping IT understand the nature and intended use of the RIM system, Gassman was able to bring Vault RIM in as a non-GxP system.

By modernizing their approach to RIM system validation, all three companies can now deliver new features—and business value—faster. Atara’s Neal called the move a “game-changer,” saying his team was able to roll out Action UI three months earlier than his GxP counterparts. Gassman said classifying Vault RIM as a non-GxP system has allowed Vericel to “institute change rapidly for very quick and easy updates to production.” And Martelli credited risk-based RIM validation with accelerating time to market for new drugs. “We had 500 submissions at Blueprint last year and four global approvals because we were able to move fast and efficiently with a GxP lite RIM system,” he said.

To watch the full recording of this Summit session visit veevaconnect.com.