WEBVTT
1
00:00:00.160 --> 00:00:08.949
Full. One of the biggest challenges
for the life sciences companies are those regulatory
2
00:00:08.990 --> 00:00:13.990
compliance requirements right that that are perceived
and must be meant to produce their products
3
00:00:14.029 --> 00:00:17.230
and their therapies and met devices and
drugs to get them on the market,
4
00:00:17.309 --> 00:00:20.710
that there's more hoops to go through. So there are those requirements that they're
5
00:00:20.710 --> 00:00:23.539
really just part of doing business in
life sciences and everyone's aware of that.
6
00:00:23.699 --> 00:00:28.260
But the necessity for of his vital
right to keep people safe and ensure the
7
00:00:28.780 --> 00:00:32.939
products are not harming anyone on the
qualities high. But you know, as
8
00:00:32.939 --> 00:00:37.289
as I mentioned, for many years
it's a business ingrained belief that the innovations
9
00:00:37.329 --> 00:00:40.969
such as cloud and automation and moving, you know, through into the digital
10
00:00:41.130 --> 00:00:46.369
transformation world, they create more owners
compliance burdens and as you'll see as we
11
00:00:46.490 --> 00:00:49.090
go through that that's just not the
case anymore. With it, with the
12
00:00:49.130 --> 00:01:00.240
new technologies they are around. Welcome
to life sciences accelerated, a podcast where
13
00:01:00.240 --> 00:01:07.709
we discuss experiences and groundbreaking innovations in
compliance and technology from molecule to market.
14
00:01:07.150 --> 00:01:12.790
Tune in for in depth interviews with
wellknown thought leaders and renowned subject matter experts
15
00:01:12.870 --> 00:01:19.500
with unparalleled knowledge in the technology and
life sciences industry innovative, helpful and thought
16
00:01:19.579 --> 00:01:29.060
provoking. This is life sciences accelerated. Welcome back to what's our second episode
17
00:01:29.219 --> 00:01:33.730
of life sciences accelerated. I'm your
host, Ryan Carmel, and today we're
18
00:01:33.769 --> 00:01:38.129
talking about cloud based systems and the
heavily regulated life science industry. Now,
19
00:01:38.209 --> 00:01:42.489
two thousand and twenty is already proven
to be a game changing year for cloud
20
00:01:42.569 --> 00:01:47.200
technologies in the life sciences arena,
with a large number of companies across all
21
00:01:47.280 --> 00:01:51.959
areas, including medical device, pharmaceutical
biotech, all beginning to leverage the power
22
00:01:52.040 --> 00:01:57.519
of the cloud. Plus the upcoming
release of the FDA's computer software assurance guidance,
23
00:01:57.920 --> 00:02:02.750
and now the state of the global
pandemic focusing companies on deploying remote workforces.
24
00:02:04.189 --> 00:02:07.629
There's never been a better and more
critical time for cloud and digital transformations
25
00:02:07.789 --> 00:02:12.949
in life sciences. So my guest
today is David Blewett, and David is
26
00:02:12.990 --> 00:02:16.580
the vice president of cloud compliance at
US dum life sciences. He's an accomplished
27
00:02:16.620 --> 00:02:22.379
life sciences regulatory and I as compliance
professional with more than twenty five years of
28
00:02:22.419 --> 00:02:28.180
experience and the pharmaceutical, medical device, biotech and blood blood management industries,
29
00:02:28.659 --> 00:02:32.289
specifically in the fields of computer systems
validation, risk management and quality assurance,
30
00:02:32.409 --> 00:02:38.689
software development, product life cycle management
and compliance, roadmap development. David,
31
00:02:38.930 --> 00:02:43.050
thanks for joining us. Thank you, Ryan, I'm on a breath reading
32
00:02:43.330 --> 00:02:49.520
your bio this morning. Yes,
sorry about that. You are well accomplished
33
00:02:49.560 --> 00:02:52.639
in the space, which is why
we're so happy to have you on today.
34
00:02:52.759 --> 00:02:55.879
So thanks again for for saving a
little time for us and Pul I
35
00:02:55.879 --> 00:03:00.069
might meet along in the tooth as
well. Ones. All right, so
36
00:03:00.189 --> 00:03:05.710
let's just get right into this.
It seemed crazy that we're talking about cloud
37
00:03:05.789 --> 00:03:09.590
computing as an innovative and critical need
for business continuity since, well, this
38
00:03:09.750 --> 00:03:15.139
technology really has been around for what, well, over a decade now,
39
00:03:15.340 --> 00:03:19.620
and large companies such as Google,
Amazon, they've been doing this sort of
40
00:03:19.659 --> 00:03:23.539
cloud computing thing for for a long
time as well, and it's really the
41
00:03:23.939 --> 00:03:28.530
new way. People are increasingly accessing
software and computer power and files over the
42
00:03:28.610 --> 00:03:31.810
Internet instead of their desktops. But
am I wrong to say that the life
43
00:03:31.889 --> 00:03:37.210
sciences industry in general is just a
bit slow to adapt to this whole thing?
44
00:03:37.289 --> 00:03:40.560
Yeah, I think. I think
it's not wrong. It's, you
45
00:03:40.639 --> 00:03:44.680
know, certain companies obviously a lot
more conservative than others, and some of
46
00:03:44.719 --> 00:03:49.039
the companies, the biggest names in
the industry, just for the nature of
47
00:03:49.120 --> 00:03:52.120
the type of business it is,
have to have been around for a very
48
00:03:52.199 --> 00:03:54.199
long time to get to where they
are. You know, a drug takes,
49
00:03:54.240 --> 00:03:58.030
you know, over ten years to
go from start to finishing, and
50
00:03:58.229 --> 00:04:00.069
so if big companies have got a
lot of drugs out there since the reason
51
00:04:00.069 --> 00:04:02.389
they've been out for a long time
and they've got a lot of policies and
52
00:04:02.469 --> 00:04:08.550
procedures and people on board that are, you know, more conservative and less
53
00:04:08.629 --> 00:04:13.340
likely to be looking forward to to
changing their methodologies then others. So you
54
00:04:13.419 --> 00:04:17.259
know, really one of the biggest
challenges for the life sizes companies are those
55
00:04:17.300 --> 00:04:23.459
regulatory compliance requirements right that that are
perceived and must be met to produce their
56
00:04:23.500 --> 00:04:27.050
products and their therapies and made devices
and drugs to get them on the market.
57
00:04:27.129 --> 00:04:30.250
That there there's more hoops to go
through. So there are those requirements
58
00:04:30.290 --> 00:04:32.329
that they're really just part of doing
business in life sciences and everyone's aware of
59
00:04:32.370 --> 00:04:36.529
that. But then necessity for them
is vital, right to keep people safe
60
00:04:36.569 --> 00:04:42.560
and ensure the products are not harming
anyone on the qualities high but you know,
61
00:04:42.759 --> 00:04:46.279
as I mentioned, for many years
there's a business ingrained belief that the
62
00:04:46.439 --> 00:04:49.519
innovations such as cloud and automation and
moving, you know, through into the
63
00:04:49.519 --> 00:04:55.750
digital transformation world, they create more
owners compliance burdens. And as you'll see
64
00:04:55.790 --> 00:04:59.069
as we go through, that's just
not the case anymore with with the new
65
00:04:59.110 --> 00:05:01.470
technologies that are around. But as
an IT consultant, you know, in
66
00:05:01.509 --> 00:05:04.550
this industry for a long time now, I spend a lot of my time
67
00:05:05.110 --> 00:05:10.259
even now dispelling those beliefs that have
played the industry for a while. You
68
00:05:10.300 --> 00:05:13.699
know, I've been I've been working
with the cloud exclusively for about eleven years
69
00:05:13.819 --> 00:05:16.459
now and I still hear it all
the time. So the history of compliance,
70
00:05:17.139 --> 00:05:23.089
you know, and technology has a
long history of fears of FDA observations
71
00:05:23.170 --> 00:05:27.810
and warning letters and Cybersecurity hacks,
you know, those kinds of cultural behaviors
72
00:05:27.850 --> 00:05:31.889
that create barriers to innovation and moving
forward rapidly. And too much works done
73
00:05:32.329 --> 00:05:38.680
because of that fear of regulatary punishment
instead of fear of putting a poor quality
74
00:05:38.720 --> 00:05:42.120
product on the market. And that's
really and then balance that, some of
75
00:05:42.199 --> 00:05:46.399
the the new SECSA guidance from the
FDA is trying to address you know,
76
00:05:46.480 --> 00:05:48.480
that's that's where we're trying to get
to, is get to that that proper
77
00:05:48.600 --> 00:05:53.029
balance of what should be done,
what needs to be done and what's what's
78
00:05:53.029 --> 00:05:56.589
going to benefit the industry the most. MMM, yeah, that makes sense.
79
00:05:57.389 --> 00:05:59.350
Do you have a sense of that? I'm sure you do. But
80
00:05:59.589 --> 00:06:06.259
how many of these life sciences companies
are still using these on prem systems versus,
81
00:06:06.459 --> 00:06:10.459
you know, cloud based systems?
Is it? Is it most still
82
00:06:10.660 --> 00:06:13.620
are a kind of where we add? Yeah, it's certainly a lot.
83
00:06:13.819 --> 00:06:15.500
You know, still in the majority, I'd say, have a have some
84
00:06:15.740 --> 00:06:21.250
forms of regulated systems on in House
and hosted. You know, newer companies,
85
00:06:21.290 --> 00:06:25.730
emerging companies, they tend to go
straight to the cloud. It's obviously
86
00:06:25.889 --> 00:06:28.930
that. You know, the benefits
are very apparent. You know, there's
87
00:06:28.930 --> 00:06:31.879
not so much management of technology and
and people that have to manage these things.
88
00:06:32.480 --> 00:06:35.319
But where you have these established companies
that have been around a long time
89
00:06:35.399 --> 00:06:39.720
and have historically, you know,
had to use on premise because there was
90
00:06:39.879 --> 00:06:43.519
no other options, it's harder to
move away from those, you know,
91
00:06:43.639 --> 00:06:46.709
with that that perceived conservative fears we've
mentioned. So the majority, you know,
92
00:06:46.870 --> 00:06:50.310
sixty percent or so more more,
still have some sort of on prem
93
00:06:50.430 --> 00:06:54.829
system that needs to migrate to the
cloud. You know, you can be
94
00:06:54.949 --> 00:06:58.949
you know, earp systems and document
management systems, things like that are going
95
00:06:58.949 --> 00:07:00.860
to be, you know, things
they rely on. They may be built
96
00:07:01.180 --> 00:07:04.579
even themselves. They could be bespoke
systems to that company or they're built them
97
00:07:04.579 --> 00:07:09.579
on a specific platform they bought fifteen
years ago and it's been very, very
98
00:07:09.620 --> 00:07:14.339
well tailored to to their business so's
harder to move away. MMM. So
99
00:07:14.459 --> 00:07:17.490
I assume it's barely common knowledge,
even in life sciences, that the cloud
100
00:07:17.610 --> 00:07:24.529
offers car saving, storage benefits,
things like that. There's advantages, obviously,
101
00:07:24.610 --> 00:07:29.089
I'm sure. But what about out
things like data security and infrastructure concerns,
102
00:07:29.170 --> 00:07:32.800
or be naging system updates, as
that a giant headache, or or
103
00:07:32.879 --> 00:07:35.600
what are what are these companies getting
into and they when they go down this
104
00:07:35.720 --> 00:07:41.079
road? Yeah, no, it's
a great question. It again, it
105
00:07:41.199 --> 00:07:44.350
comes down to the type of company
it is and the type of people are
106
00:07:44.430 --> 00:07:46.550
in the organization and flatly, from
the quality side of things. You know
107
00:07:46.670 --> 00:07:51.029
how conservative or how open the after
new ideas and new regulations and how they're
108
00:07:51.029 --> 00:07:56.269
interpreting them. You know there are
you know, their historically at least has
109
00:07:56.350 --> 00:08:00.779
been fears around data security in the
cloud, whereas, if you really think
110
00:08:00.819 --> 00:08:03.139
about it, you know if you
using, you know, single ten or
111
00:08:03.139 --> 00:08:07.540
multitenant systems in the cloud, that
the cloud company, the vendor that's producing
112
00:08:07.620 --> 00:08:09.699
that, as long as you've done
your due diligence and selected them correctly,
113
00:08:11.220 --> 00:08:15.009
they are actually going to be far
better at doing data security on their systems
114
00:08:15.009 --> 00:08:18.889
and their infrastructure then you could be
on your own hosted, pront on premise
115
00:08:18.930 --> 00:08:20.769
systems. You know, if you're, if you especially be talking about you
116
00:08:20.850 --> 00:08:24.410
know, multitenna systems, that the
data scattered throughout, you know, throughout
117
00:08:24.449 --> 00:08:28.839
the different various data centers and stacks, then it's much harder to get data
118
00:08:28.839 --> 00:08:31.960
out of a cloud system than it
is from a if you hack into an
119
00:08:33.000 --> 00:08:35.279
on prem system. So data securities
really, if you think about that,
120
00:08:35.600 --> 00:08:39.519
you know it's handled by their professionals. They do it day and day out.
121
00:08:39.559 --> 00:08:43.429
That said, job same with infrastructure. Now, you know, your
122
00:08:43.470 --> 00:08:48.909
job as a ABC farm or ABC
Biotech Company is is really to produce drugs
123
00:08:48.909 --> 00:08:52.990
or medical devices or, you know, whatever that may be, not to
124
00:08:52.110 --> 00:08:58.500
manage infrastructure and servers and server rooms
and you know relative humidity and haylight systems
125
00:08:58.580 --> 00:09:01.340
and this kind of thing. You
know, that's that's taking away from what
126
00:09:01.419 --> 00:09:05.940
you're really core business is trying to
do. So transferring that to a company
127
00:09:05.980 --> 00:09:11.850
that does that day in, day
out and it's their core competency it just
128
00:09:11.970 --> 00:09:15.690
makes sense right. Professionals can do
that better than you can. And lastly,
129
00:09:15.730 --> 00:09:18.169
you talk about the the frequency of
the system updates. You know,
130
00:09:18.289 --> 00:09:24.480
from a system development life cycle perspective, having a system that's currently and and
131
00:09:26.200 --> 00:09:30.720
will be at the cutting edge of
the latest and greatest technology, that it's
132
00:09:30.840 --> 00:09:35.480
greatest ideas in the business just simply
makes sense right to start using those systems
133
00:09:35.519 --> 00:09:37.669
and to keep on top of those
that you know, as another initial fear
134
00:09:39.070 --> 00:09:41.070
of this system is going to change
every month or every two months or every
135
00:09:41.149 --> 00:09:45.830
three months or every week or even
every day. How do I possibly keep
136
00:09:45.830 --> 00:09:50.710
it up to date and valid from
a compliance perspective when, once I've established
137
00:09:50.710 --> 00:09:54.340
it, next week it's going to
be different? And that's all being done
138
00:09:54.379 --> 00:09:56.740
right now. It's been done for, you know, a number of years
139
00:09:56.779 --> 00:10:01.779
now the USDM where, but definitely
managing that for hundreds of clients these days,
140
00:10:01.059 --> 00:10:05.860
where there are systems that are being
chains on various different cadences and we
141
00:10:05.899 --> 00:10:09.409
have technologies and processes and tools in
place to handle that, whether it be
142
00:10:09.970 --> 00:10:15.649
automated testing, always on regression testing
that's happening, or can be, you
143
00:10:15.730 --> 00:10:20.610
know, manual assessments of changes that
come through specific to customer specific environments and
144
00:10:20.649 --> 00:10:24.159
then testing those, those pequ tests, in their in their environs to make
145
00:10:24.240 --> 00:10:26.600
sure they haven't broken anything. So
there's a lot going on that we're doing.
146
00:10:28.000 --> 00:10:31.080
We're actually developing. Well, we
developed and continue to use, for
147
00:10:31.279 --> 00:10:37.350
from a lot of customers now,
some tools for for continuous regression testing for
148
00:10:37.789 --> 00:10:41.230
content, major system that's used in
the in the cloud world and their life
149
00:10:41.269 --> 00:10:48.029
sciences industry for managing collaboration of documentation
and processes where it's changing on a daily
150
00:10:48.070 --> 00:10:52.220
basis. So once you've established a
compliance state, it's then kicked over and
151
00:10:52.299 --> 00:10:56.620
we're testing that twice a day every
day and producing raw ports and trends and
152
00:10:56.659 --> 00:11:01.860
we actually find issues much, much
more quickly than you would on a traditional
153
00:11:01.940 --> 00:11:05.330
old approach where you're looking at doing
manual assessments and testing and risk assessments and
154
00:11:05.970 --> 00:11:11.730
manual testing subsequent to thou as well. So the risk actually goes down rather
155
00:11:11.809 --> 00:11:16.129
than up because you find issues.
You find issues in both approaches, but
156
00:11:16.289 --> 00:11:18.759
with the the the continue automated aggression
testing, you find them much mouch more
157
00:11:18.759 --> 00:11:22.799
rapidly can roll them back if there
are any. So M so you were
158
00:11:22.879 --> 00:11:28.360
doing this a long time now,
over twenty years. How's this conversation changing
159
00:11:28.639 --> 00:11:31.159
for you? What was it like? I mean, I don't know if
160
00:11:31.159 --> 00:11:35.070
the cloud was around twenty years ago, but you know, in the end
161
00:11:35.110 --> 00:11:41.269
the early stages of this versus versus
today were how are those conversations changing?
162
00:11:41.389 --> 00:11:45.029
Or Handy changed? Yeah, I
might. Certainly the last three months has
163
00:11:45.029 --> 00:11:46.379
been, you know, a big
change. But you know, just over
164
00:11:46.419 --> 00:11:50.820
the last seven or eight years people
have started to embrace the cloud more.
165
00:11:50.860 --> 00:11:56.500
They've realized that the you know,
the security concerns and that the infrastructure pieces
166
00:11:56.539 --> 00:12:01.139
and you know, the benefits are
simply far outweighing that the you know,
167
00:12:01.220 --> 00:12:03.769
they perceived, you know, concerns
that they had. So we're looking at
168
00:12:03.889 --> 00:12:09.769
having, you know, companies that
either already had effective classes is in place.
169
00:12:09.330 --> 00:12:13.289
When, you know, for example, things like covid nineteen come along,
170
00:12:13.610 --> 00:12:16.480
they're much more flexible. They can
suddenly say, okay, you know,
171
00:12:16.759 --> 00:12:20.840
companies that work from home or have
the ability to work from home because
172
00:12:20.840 --> 00:12:24.399
everything's in the cloud, are suddenly
less disrupted than companies that had everything on
173
00:12:24.480 --> 00:12:28.720
prayer and they're scrambling now to find
a way to meet their business needs.
174
00:12:30.309 --> 00:12:33.029
have to implement systems extremely rapidly,
or the having to do things for a
175
00:12:33.269 --> 00:12:37.710
period of time wouldn't necessarily always be
considered the best way of doing their business
176
00:12:37.750 --> 00:12:41.830
and it's not necessarily going to be
compliant with regulations. So they have to
177
00:12:41.070 --> 00:12:45.740
scramble very, very fast to overcome
those needs and put work arounds in place.
178
00:12:46.340 --> 00:12:50.299
And you know what? Example,
obviously, where we experienced overnight huge
179
00:12:50.379 --> 00:12:54.460
jump in the need for systems was
in the e signature world. Right,
180
00:12:54.500 --> 00:12:58.769
people have to suddenly work from home. That's great. You maybe you had
181
00:12:58.450 --> 00:13:03.690
systems where you can collaborate your documentation, but having them approved across the globe.
182
00:13:03.889 --> 00:13:09.610
Suddenly everyone's now working in their home
offices or from wherever, having those
183
00:13:09.649 --> 00:13:13.600
approvals and there's those not just approvals
but qualified part of eleven and x eleven
184
00:13:13.720 --> 00:13:20.320
compliant approvals being done. was suddenly
a huge spike in that in that need,
185
00:13:20.799 --> 00:13:24.879
and one of the things that I
did at at US DM was we
186
00:13:24.320 --> 00:13:31.470
introduced to methodology, which helped customers
adopt and use those types of technologies and
187
00:13:31.669 --> 00:13:35.429
become fully compliant with the configured to
them system, you know, less than
188
00:13:35.509 --> 00:13:39.389
seven days. So they can actually
go from from start to finish and get
189
00:13:39.629 --> 00:13:43.860
compliant on sending those documents around the
world and signing them with with, you
190
00:13:43.940 --> 00:13:48.100
know, compliant signatures. So it's
a way of adapting. You know,
191
00:13:48.139 --> 00:13:50.620
obviously, US, DM is,
we're very virtual company already. We the
192
00:13:50.740 --> 00:13:54.809
impact to us from a technology perspective
has been minimal, so we're able to,
193
00:13:56.330 --> 00:14:00.450
you know, flex and move with
the Times they're but we're also able
194
00:14:00.490 --> 00:14:03.370
to recognize that some companies weren't that
built that way and how we have to
195
00:14:03.450 --> 00:14:07.970
help them and come up with strategies
for helping them do that. And you
196
00:14:07.090 --> 00:14:13.200
mentioned that. We've seen this big
spike and e signature solutions, in particular
197
00:14:13.320 --> 00:14:16.440
with art we and all these people
working from home. Now, with that,
198
00:14:16.759 --> 00:14:20.480
set that aside for a second,
would that be a normal starting point
199
00:14:20.519 --> 00:14:24.710
or a good starting point for a
company that is starting to move into this
200
00:14:24.909 --> 00:14:28.269
cloud based technology? No, absolutely, yeah, definitely. It's, you
201
00:14:28.350 --> 00:14:33.389
know, it's a relatively inexpensive,
you know, type of software. It's
202
00:14:33.429 --> 00:14:35.149
fairly simple as easy to understand.
In fact, a lot of companies,
203
00:14:35.190 --> 00:14:41.179
a lot of customers and end users
have seen these types of system already in
204
00:14:41.620 --> 00:14:45.659
a non kind of regulated guys right. So everyone's already familiar with them.
205
00:14:46.019 --> 00:14:48.940
If you bought a house in the
last ten years, you're likely to have
206
00:14:48.059 --> 00:14:52.169
seen electronic signatures being used for the
and all the contracts and things, always
207
00:14:52.210 --> 00:14:56.090
just using, you know, three
or four pens before they run out.
208
00:14:56.090 --> 00:14:58.529
So that's that's typical. You know, it's easy to adopt, it's easy
209
00:14:58.529 --> 00:15:03.809
to pay for, it's easy to
get the basic functionality up and running very
210
00:15:03.850 --> 00:15:07.159
rapidly. And what that does is
then it drives in a land and expand
211
00:15:07.279 --> 00:15:11.080
kind of method. At the companies. That's where it's been put in.
212
00:15:11.360 --> 00:15:15.159
We often see that the footprint is
initially, you know, a few people
213
00:15:15.200 --> 00:15:18.080
within the company, but then word, word gets around those systems there and
214
00:15:18.399 --> 00:15:22.269
the usage really, you know,
explode. And then subsequent to that they
215
00:15:22.309 --> 00:15:26.149
realize, you know, we we
USDM and and the company that we working
216
00:15:26.230 --> 00:15:31.389
with will visit there at the requirements
list, not just the initial I need
217
00:15:31.590 --> 00:15:35.460
this immediately because everyone's working from home, but the future requirements. You know,
218
00:15:35.539 --> 00:15:39.019
how am we going to use this
in the future, whether the people
219
00:15:39.019 --> 00:15:41.620
are at home or in the office. What other systems and technology can I
220
00:15:43.299 --> 00:15:46.899
integrate to or can I start using? Because my perception has changed of the
221
00:15:46.980 --> 00:15:52.730
cloud? Now I can maybe think
about using a cloud storage solution or or,
222
00:15:52.250 --> 00:15:56.929
you know, a cloud crm solution
or a ctms solution that can then
223
00:15:56.970 --> 00:16:02.690
be linked to my signature and my
my self solution things. So everything can
224
00:16:02.730 --> 00:16:06.879
all be, you know, linked
together, integrated very well in a simple
225
00:16:06.879 --> 00:16:11.480
fashion to accomplish a lot more business
use cases them was initially in a kind
226
00:16:11.480 --> 00:16:15.960
of thought of when they when they
implemented the initially signature solution. So it
227
00:16:15.080 --> 00:16:19.629
just drive adoption. It's great introduction. It helps people realize that, you
228
00:16:19.750 --> 00:16:22.830
know, this cloud is not the
big bad werewolf of the world. It's
229
00:16:22.830 --> 00:16:27.070
actually helping, it's less expensive and
it's, you know, it's really easy
230
00:16:27.110 --> 00:16:33.139
to use an adults. Okay,
so in our last podcast we talked about
231
00:16:33.179 --> 00:16:38.179
the FDA's upcoming guidance for computer software
assurance and how the FDA is encouraging the
232
00:16:38.299 --> 00:16:44.580
use of automation and more advanced technologies. How do you think this will impact
233
00:16:44.659 --> 00:16:49.570
life science companies willingness to adopt cloud
systems. This is would good thing or
234
00:16:49.649 --> 00:16:53.570
bad thing. Without I think it
should help. I mean if people,
235
00:16:53.809 --> 00:16:59.129
you know, are aware of the
guidance and the understanding that the FDA has,
236
00:16:59.929 --> 00:17:02.399
they've been looking at this. I
mean the Guy Guidance from the FDA
237
00:17:02.480 --> 00:17:04.559
doesn't just happen overnight. It takes
a lot of time, you know,
238
00:17:04.640 --> 00:17:08.559
many, many years of going back
and forward, and that's that's a result
239
00:17:08.599 --> 00:17:15.119
of customers and companies you know,
that have had audits, observations or have
240
00:17:15.240 --> 00:17:18.789
talked to people the FDA in various, you know, forums that that are
241
00:17:18.869 --> 00:17:22.069
said, look, this is this
is two owners. We can't we can't
242
00:17:22.109 --> 00:17:26.670
innovate when we can't take advantage of
the technology this out there because we're scared
243
00:17:27.309 --> 00:17:30.099
that what we do, this these
other things are going to be, you
244
00:17:30.180 --> 00:17:33.220
know, there to bite as.
And the FDA's never been saying that.
245
00:17:33.380 --> 00:17:37.980
It's always been, you know,
since you know, the early two thousands,
246
00:17:37.019 --> 00:17:41.900
has been around a risk based approach. That's that's been developed to meet
247
00:17:41.940 --> 00:17:45.690
those regulations. You know, gamp
has been around for over twenty years now
248
00:17:45.769 --> 00:17:52.089
and it's been advocating this. This
approach is risk based computer systems validation approach.
249
00:17:52.410 --> 00:17:56.529
But what's new is some of the
clarity has come from the FDA and
250
00:17:56.730 --> 00:18:02.880
and some of the methodologies that you
could now employ to really take advantage of
251
00:18:02.920 --> 00:18:06.640
the cloud to say, okay,
I'm not going to just implement this in
252
00:18:06.799 --> 00:18:10.000
this particular fashion, in this particked
away and make it compliant and that way
253
00:18:10.079 --> 00:18:12.630
and document it that way because the
FDA needs me to do so, when
254
00:18:12.710 --> 00:18:17.549
that doesn't really do anyone any favors. It doesn't help the business, it
255
00:18:17.670 --> 00:18:19.869
doesn't help, you know, the
patient. And what's the real point of
256
00:18:19.990 --> 00:18:23.309
doing that? The idea of the
companies are out there to produce the drugs,
257
00:18:23.349 --> 00:18:25.990
are going to help the people.
They help, you know, the
258
00:18:26.029 --> 00:18:29.740
MED devices, and so so the
FDA is coming up, come back and
259
00:18:30.140 --> 00:18:33.500
and in a really pragmatic fashion and
said, look, what we need to
260
00:18:33.579 --> 00:18:38.380
do is shift to focus on to
what helps the business, what helps the
261
00:18:38.460 --> 00:18:41.690
customer, rather than what needs to
be in place for us to audit you.
262
00:18:42.130 --> 00:18:47.529
What I mean by that is there's
a lot of testing and risk mitigation
263
00:18:47.569 --> 00:18:52.410
activities that have judicially been in play
that customers thought they needed to put in
264
00:18:52.569 --> 00:18:56.000
play because they were scared of,
you know, the FDA will be scared
265
00:18:56.000 --> 00:18:59.640
of you know, the conservative people
in the organization or whatever it might be,
266
00:19:00.720 --> 00:19:03.759
so that that that testing effort was
way too much. You know,
267
00:19:03.799 --> 00:19:07.680
they were taking screenshots of everything and
they were taking hundreds of hundreds of pages
268
00:19:07.720 --> 00:19:11.750
of testing to do a very simple
process. And it's been flipped around.
269
00:19:11.750 --> 00:19:15.309
Now what we're saying is, rather
than doing in a kind of eighty percent
270
00:19:15.430 --> 00:19:18.589
testing, it's now kind of twenty
percent testing, but we're actually folk using
271
00:19:18.589 --> 00:19:22.390
the testing in the right area.
Or Documentation. Ashes eighty percent documentation of
272
00:19:22.430 --> 00:19:26.140
your testing and twenty percent of actual
system. This other way around. Now
273
00:19:26.259 --> 00:19:32.539
right were actually testing system or but
we're documenting it less. Because here's the
274
00:19:32.579 --> 00:19:37.140
key. We're now can unlocking the
potential and the history of that vendor.
275
00:19:37.259 --> 00:19:41.529
So if you select the right vendor
that has a great stlc in place,
276
00:19:41.930 --> 00:19:47.410
they can then leverage the clients,
can leverage all of the activities that that
277
00:19:47.569 --> 00:19:52.650
vendor is is performing on a routine
basis based on established procedures that have been
278
00:19:52.650 --> 00:19:56.000
audited many times. To say I'm
not going to test that. You Know
279
00:19:56.279 --> 00:20:02.319
Two plus two equals four, because
you know the vendors already tested that many,
280
00:20:02.359 --> 00:20:04.000
many times and it's proven that to
be the case and I'm not touched
281
00:20:04.079 --> 00:20:08.029
that. So I'm going to leverage
that activity in my traceability effort. I'm
282
00:20:08.029 --> 00:20:11.670
going to say I didn't need to
test all these pieces here because they're already
283
00:20:11.670 --> 00:20:18.470
been tested by XYZ vendor. So
it becomes a piece of your methodology or
284
00:20:18.549 --> 00:20:22.940
cloud strategy to select the right person, the right vendor, that you can
285
00:20:22.940 --> 00:20:30.579
actually have leverageable risk medigation activities in
place. HMMMM. Any final advice you
286
00:20:30.660 --> 00:20:34.769
have for our listeners that are going
through their digital transformation activities now or even
287
00:20:34.809 --> 00:20:40.569
considering moving in this direction? Yeah, so, I mean, as I
288
00:20:40.650 --> 00:20:42.529
just said, you know, obviously
one of the key things is that that
289
00:20:42.769 --> 00:20:45.930
vendor piece. Make sure that you're
looking at the right vendors, and I
290
00:20:47.089 --> 00:20:52.359
just picking one the that's there.
You know, based on a few criteria
291
00:20:52.400 --> 00:20:55.200
around, you know, financials and
and time and things like that. But
292
00:20:55.319 --> 00:21:00.079
look at their the industry or the
the vendors knowledge, how experience they are
293
00:21:00.200 --> 00:21:03.589
working in the gisp world. You
know, how much of their IP are
294
00:21:03.630 --> 00:21:08.029
they willing to share if you have
to leverage their effort? How much of
295
00:21:08.069 --> 00:21:11.789
that is available to you? Is
it? Is it something they're very willing
296
00:21:11.990 --> 00:21:14.950
and open to say? You know, as we have this testing, his
297
00:21:15.069 --> 00:21:18.150
little testing we have you can you
can see that we do that every week
298
00:21:18.190 --> 00:21:22.299
or every day or every three months
or whatever, because that investment is going
299
00:21:22.339 --> 00:21:26.140
to pay off for you to reduce
the burden at the end users perspective,
300
00:21:26.579 --> 00:21:30.660
to do that work yourselves. And
it's important that you see that when you
301
00:21:30.740 --> 00:21:34.490
do that vendor selection activity, that
you see that's really in place. And
302
00:21:34.569 --> 00:21:38.930
that was really something that's I've been
driving at for a few years now and
303
00:21:40.410 --> 00:21:42.730
the Yes, the the CSA guidance
is now speaking to as well. Right.
304
00:21:44.089 --> 00:21:48.240
So we're trying to take that that
effort off the client put it onto
305
00:21:48.279 --> 00:21:51.240
the vendors shoulders. And then,
of course there's going to be, you
306
00:21:51.319 --> 00:21:56.319
know, pieces that you need to
make a compliant and validate on your end,
307
00:21:56.480 --> 00:21:59.640
but you need to try and take
all the core pieces, that the
308
00:21:59.720 --> 00:22:03.349
common elements, away and focus on
your actual real key business needs. And
309
00:22:03.470 --> 00:22:07.710
the secondly, consider offloading the compliance
piece. Right, that's not your core
310
00:22:07.750 --> 00:22:12.309
confidency either. Neither it, you
know, whereas infrastructures not in testing is
311
00:22:12.390 --> 00:22:15.940
not and neither is the compliance in
the it piece. So you know,
312
00:22:17.180 --> 00:22:21.380
select companies that can help you do
that, can actually help you maintain the
313
00:22:21.460 --> 00:22:23.980
system. They have processes and experienced
and you can, you know, get
314
00:22:25.019 --> 00:22:29.500
on with your business and kind of
have a nice fire and forget process where
315
00:22:29.539 --> 00:22:33.410
you get your system implemented in someone
else takes it. That's a compliance on
316
00:22:33.490 --> 00:22:36.809
your on the shoulders for you.
All Right, David blew it, thanks
317
00:22:36.849 --> 00:22:41.009
for coming on the show. All
right. Thank you all right, and
318
00:22:41.130 --> 00:22:44.680
we want to invite you to check
out some of David's other content that he's
319
00:22:44.759 --> 00:22:48.680
produced. He's an accomplished author.
We have several white papers that David is
320
00:22:48.720 --> 00:22:53.160
done on in the past and one
recently on this very subject that we talked
321
00:22:53.160 --> 00:22:56.920
about today. There's some webinars on
there that David is done, as well
322
00:22:56.960 --> 00:23:02.190
as some blogs. So head to
our website, US DMCOM and head to
323
00:23:02.269 --> 00:23:07.150
the insight section that's in the upper
right hand corner of the the main page
324
00:23:07.150 --> 00:23:10.309
of the website. In the meantime, thank you so much for joining us
325
00:23:10.390 --> 00:23:12.660
and we hope you'll tune in next
time to life science is accelerated. In
326
00:23:12.740 --> 00:23:22.180
the meantime, have a great day. You've been listening to life sciences accelerated.
327
00:23:22.380 --> 00:23:26.420
If you enjoyed this episode, please
subscribe and leave us a review if
328
00:23:26.460 --> 00:23:30.369
you'd like. To learn more about
strategies to digitally transform your company and ways
329
00:23:30.410 --> 00:23:37.730
to streamline your organizations compliance processed.
Visit US, dmcom. That's you asked
330
00:23:37.890 --> 00:23:41.960
dmcom. Thanks so much for listening. Until next time,
1
00:00:00.160 --> 00:00:08.949
Full. One of the biggest challenges
for the life sciences companies are those regulatory
2
00:00:08.990 --> 00:00:13.990
compliance requirements right that that are perceived
and must be meant to produce their products
3
00:00:14.029 --> 00:00:17.230
and their therapies and met devices and
drugs to get them on the market,
4
00:00:17.309 --> 00:00:20.710
that there's more hoops to go through. So there are those requirements that they're
5
00:00:20.710 --> 00:00:23.539
really just part of doing business in
life sciences and everyone's aware of that.
6
00:00:23.699 --> 00:00:28.260
But the necessity for of his vital
right to keep people safe and ensure the
7
00:00:28.780 --> 00:00:32.939
products are not harming anyone on the
qualities high. But you know, as
8
00:00:32.939 --> 00:00:37.289
as I mentioned, for many years
it's a business ingrained belief that the innovations
9
00:00:37.329 --> 00:00:40.969
such as cloud and automation and moving, you know, through into the digital
10
00:00:41.130 --> 00:00:46.369
transformation world, they create more owners
compliance burdens and as you'll see as we
11
00:00:46.490 --> 00:00:49.090
go through that that's just not the
case anymore. With it, with the
12
00:00:49.130 --> 00:01:00.240
new technologies they are around. Welcome
to life sciences accelerated, a podcast where
13
00:01:00.240 --> 00:01:07.709
we discuss experiences and groundbreaking innovations in
compliance and technology from molecule to market.
14
00:01:07.150 --> 00:01:12.790
Tune in for in depth interviews with
wellknown thought leaders and renowned subject matter experts
15
00:01:12.870 --> 00:01:19.500
with unparalleled knowledge in the technology and
life sciences industry innovative, helpful and thought
16
00:01:19.579 --> 00:01:29.060
provoking. This is life sciences accelerated. Welcome back to what's our second episode
17
00:01:29.219 --> 00:01:33.730
of life sciences accelerated. I'm your
host, Ryan Carmel, and today we're
18
00:01:33.769 --> 00:01:38.129
talking about cloud based systems and the
heavily regulated life science industry. Now,
19
00:01:38.209 --> 00:01:42.489
two thousand and twenty is already proven
to be a game changing year for cloud
20
00:01:42.569 --> 00:01:47.200
technologies in the life sciences arena,
with a large number of companies across all
21
00:01:47.280 --> 00:01:51.959
areas, including medical device, pharmaceutical
biotech, all beginning to leverage the power
22
00:01:52.040 --> 00:01:57.519
of the cloud. Plus the upcoming
release of the FDA's computer software assurance guidance,
23
00:01:57.920 --> 00:02:02.750
and now the state of the global
pandemic focusing companies on deploying remote workforces.
24
00:02:04.189 --> 00:02:07.629
There's never been a better and more
critical time for cloud and digital transformations
25
00:02:07.789 --> 00:02:12.949
in life sciences. So my guest
today is David Blewett, and David is
26
00:02:12.990 --> 00:02:16.580
the vice president of cloud compliance at
US dum life sciences. He's an accomplished
27
00:02:16.620 --> 00:02:22.379
life sciences regulatory and I as compliance
professional with more than twenty five years of
28
00:02:22.419 --> 00:02:28.180
experience and the pharmaceutical, medical device, biotech and blood blood management industries,
29
00:02:28.659 --> 00:02:32.289
specifically in the fields of computer systems
validation, risk management and quality assurance,
30
00:02:32.409 --> 00:02:38.689
software development, product life cycle management
and compliance, roadmap development. David,
31
00:02:38.930 --> 00:02:43.050
thanks for joining us. Thank you, Ryan, I'm on a breath reading
32
00:02:43.330 --> 00:02:49.520
your bio this morning. Yes,
sorry about that. You are well accomplished
33
00:02:49.560 --> 00:02:52.639
in the space, which is why
we're so happy to have you on today.
34
00:02:52.759 --> 00:02:55.879
So thanks again for for saving a
little time for us and Pul I
35
00:02:55.879 --> 00:03:00.069
might meet along in the tooth as
well. Ones. All right, so
36
00:03:00.189 --> 00:03:05.710
let's just get right into this.
It seemed crazy that we're talking about cloud
37
00:03:05.789 --> 00:03:09.590
computing as an innovative and critical need
for business continuity since, well, this
38
00:03:09.750 --> 00:03:15.139
technology really has been around for what, well, over a decade now,
39
00:03:15.340 --> 00:03:19.620
and large companies such as Google,
Amazon, they've been doing this sort of
40
00:03:19.659 --> 00:03:23.539
cloud computing thing for for a long
time as well, and it's really the
41
00:03:23.939 --> 00:03:28.530
new way. People are increasingly accessing
software and computer power and files over the
42
00:03:28.610 --> 00:03:31.810
Internet instead of their desktops. But
am I wrong to say that the life
43
00:03:31.889 --> 00:03:37.210
sciences industry in general is just a
bit slow to adapt to this whole thing?
44
00:03:37.289 --> 00:03:40.560
Yeah, I think. I think
it's not wrong. It's, you
45
00:03:40.639 --> 00:03:44.680
know, certain companies obviously a lot
more conservative than others, and some of
46
00:03:44.719 --> 00:03:49.039
the companies, the biggest names in
the industry, just for the nature of
47
00:03:49.120 --> 00:03:52.120
the type of business it is,
have to have been around for a very
48
00:03:52.199 --> 00:03:54.199
long time to get to where they
are. You know, a drug takes,
49
00:03:54.240 --> 00:03:58.030
you know, over ten years to
go from start to finishing, and
50
00:03:58.229 --> 00:04:00.069
so if big companies have got a
lot of drugs out there since the reason
51
00:04:00.069 --> 00:04:02.389
they've been out for a long time
and they've got a lot of policies and
52
00:04:02.469 --> 00:04:08.550
procedures and people on board that are, you know, more conservative and less
53
00:04:08.629 --> 00:04:13.340
likely to be looking forward to to
changing their methodologies then others. So you
54
00:04:13.419 --> 00:04:17.259
know, really one of the biggest
challenges for the life sizes companies are those
55
00:04:17.300 --> 00:04:23.459
regulatory compliance requirements right that that are
perceived and must be met to produce their
56
00:04:23.500 --> 00:04:27.050
products and their therapies and made devices
and drugs to get them on the market.
57
00:04:27.129 --> 00:04:30.250
That there there's more hoops to go
through. So there are those requirements
58
00:04:30.290 --> 00:04:32.329
that they're really just part of doing
business in life sciences and everyone's aware of
59
00:04:32.370 --> 00:04:36.529
that. But then necessity for them
is vital, right to keep people safe
60
00:04:36.569 --> 00:04:42.560
and ensure the products are not harming
anyone on the qualities high but you know,
61
00:04:42.759 --> 00:04:46.279
as I mentioned, for many years
there's a business ingrained belief that the
62
00:04:46.439 --> 00:04:49.519
innovations such as cloud and automation and
moving, you know, through into the
63
00:04:49.519 --> 00:04:55.750
digital transformation world, they create more
owners compliance burdens. And as you'll see
64
00:04:55.790 --> 00:04:59.069
as we go through, that's just
not the case anymore with with the new
65
00:04:59.110 --> 00:05:01.470
technologies that are around. But as
an IT consultant, you know, in
66
00:05:01.509 --> 00:05:04.550
this industry for a long time now, I spend a lot of my time
67
00:05:05.110 --> 00:05:10.259
even now dispelling those beliefs that have
played the industry for a while. You
68
00:05:10.300 --> 00:05:13.699
know, I've been I've been working
with the cloud exclusively for about eleven years
69
00:05:13.819 --> 00:05:16.459
now and I still hear it all
the time. So the history of compliance,
70
00:05:17.139 --> 00:05:23.089
you know, and technology has a
long history of fears of FDA observations
71
00:05:23.170 --> 00:05:27.810
and warning letters and Cybersecurity hacks,
you know, those kinds of cultural behaviors
72
00:05:27.850 --> 00:05:31.889
that create barriers to innovation and moving
forward rapidly. And too much works done
73
00:05:32.329 --> 00:05:38.680
because of that fear of regulatary punishment
instead of fear of putting a poor quality
74
00:05:38.720 --> 00:05:42.120
product on the market. And that's
really and then balance that, some of
75
00:05:42.199 --> 00:05:46.399
the the new SECSA guidance from the
FDA is trying to address you know,
76
00:05:46.480 --> 00:05:48.480
that's that's where we're trying to get
to, is get to that that proper
77
00:05:48.600 --> 00:05:53.029
balance of what should be done,
what needs to be done and what's what's
78
00:05:53.029 --> 00:05:56.589
going to benefit the industry the most. MMM, yeah, that makes sense.
79
00:05:57.389 --> 00:05:59.350
Do you have a sense of that? I'm sure you do. But
80
00:05:59.589 --> 00:06:06.259
how many of these life sciences companies
are still using these on prem systems versus,
81
00:06:06.459 --> 00:06:10.459
you know, cloud based systems?
Is it? Is it most still
82
00:06:10.660 --> 00:06:13.620
are a kind of where we add? Yeah, it's certainly a lot.
83
00:06:13.819 --> 00:06:15.500
You know, still in the majority, I'd say, have a have some
84
00:06:15.740 --> 00:06:21.250
forms of regulated systems on in House
and hosted. You know, newer companies,
85
00:06:21.290 --> 00:06:25.730
emerging companies, they tend to go
straight to the cloud. It's obviously
86
00:06:25.889 --> 00:06:28.930
that. You know, the benefits
are very apparent. You know, there's
87
00:06:28.930 --> 00:06:31.879
not so much management of technology and
and people that have to manage these things.
88
00:06:32.480 --> 00:06:35.319
But where you have these established companies
that have been around a long time
89
00:06:35.399 --> 00:06:39.720
and have historically, you know,
had to use on premise because there was
90
00:06:39.879 --> 00:06:43.519
no other options, it's harder to
move away from those, you know,
91
00:06:43.639 --> 00:06:46.709
with that that perceived conservative fears we've
mentioned. So the majority, you know,
92
00:06:46.870 --> 00:06:50.310
sixty percent or so more more,
still have some sort of on prem
93
00:06:50.430 --> 00:06:54.829
system that needs to migrate to the
cloud. You know, you can be
94
00:06:54.949 --> 00:06:58.949
you know, earp systems and document
management systems, things like that are going
95
00:06:58.949 --> 00:07:00.860
to be, you know, things
they rely on. They may be built
96
00:07:01.180 --> 00:07:04.579
even themselves. They could be bespoke
systems to that company or they're built them
97
00:07:04.579 --> 00:07:09.579
on a specific platform they bought fifteen
years ago and it's been very, very
98
00:07:09.620 --> 00:07:14.339
well tailored to to their business so's
harder to move away. MMM. So
99
00:07:14.459 --> 00:07:17.490
I assume it's barely common knowledge,
even in life sciences, that the cloud
100
00:07:17.610 --> 00:07:24.529
offers car saving, storage benefits,
things like that. There's advantages, obviously,
101
00:07:24.610 --> 00:07:29.089
I'm sure. But what about out
things like data security and infrastructure concerns,
102
00:07:29.170 --> 00:07:32.800
or be naging system updates, as
that a giant headache, or or
103
00:07:32.879 --> 00:07:35.600
what are what are these companies getting
into and they when they go down this
104
00:07:35.720 --> 00:07:41.079
road? Yeah, no, it's
a great question. It again, it
105
00:07:41.199 --> 00:07:44.350
comes down to the type of company
it is and the type of people are
106
00:07:44.430 --> 00:07:46.550
in the organization and flatly, from
the quality side of things. You know
107
00:07:46.670 --> 00:07:51.029
how conservative or how open the after
new ideas and new regulations and how they're
108
00:07:51.029 --> 00:07:56.269
interpreting them. You know there are
you know, their historically at least has
109
00:07:56.350 --> 00:08:00.779
been fears around data security in the
cloud, whereas, if you really think
110
00:08:00.819 --> 00:08:03.139
about it, you know if you
using, you know, single ten or
111
00:08:03.139 --> 00:08:07.540
multitenant systems in the cloud, that
the cloud company, the vendor that's producing
112
00:08:07.620 --> 00:08:09.699
that, as long as you've done
your due diligence and selected them correctly,
113
00:08:11.220 --> 00:08:15.009
they are actually going to be far
better at doing data security on their systems
114
00:08:15.009 --> 00:08:18.889
and their infrastructure then you could be
on your own hosted, pront on premise
115
00:08:18.930 --> 00:08:20.769
systems. You know, if you're, if you especially be talking about you
116
00:08:20.850 --> 00:08:24.410
know, multitenna systems, that the
data scattered throughout, you know, throughout
117
00:08:24.449 --> 00:08:28.839
the different various data centers and stacks, then it's much harder to get data
118
00:08:28.839 --> 00:08:31.960
out of a cloud system than it
is from a if you hack into an
119
00:08:33.000 --> 00:08:35.279
on prem system. So data securities
really, if you think about that,
120
00:08:35.600 --> 00:08:39.519
you know it's handled by their professionals. They do it day and day out.
121
00:08:39.559 --> 00:08:43.429
That said, job same with infrastructure. Now, you know, your
122
00:08:43.470 --> 00:08:48.909
job as a ABC farm or ABC
Biotech Company is is really to produce drugs
123
00:08:48.909 --> 00:08:52.990
or medical devices or, you know, whatever that may be, not to
124
00:08:52.110 --> 00:08:58.500
manage infrastructure and servers and server rooms
and you know relative humidity and haylight systems
125
00:08:58.580 --> 00:09:01.340
and this kind of thing. You
know, that's that's taking away from what
126
00:09:01.419 --> 00:09:05.940
you're really core business is trying to
do. So transferring that to a company
127
00:09:05.980 --> 00:09:11.850
that does that day in, day
out and it's their core competency it just
128
00:09:11.970 --> 00:09:15.690
makes sense right. Professionals can do
that better than you can. And lastly,
129
00:09:15.730 --> 00:09:18.169
you talk about the the frequency of
the system updates. You know,
130
00:09:18.289 --> 00:09:24.480
from a system development life cycle perspective, having a system that's currently and and
131
00:09:26.200 --> 00:09:30.720
will be at the cutting edge of
the latest and greatest technology, that it's
132
00:09:30.840 --> 00:09:35.480
greatest ideas in the business just simply
makes sense right to start using those systems
133
00:09:35.519 --> 00:09:37.669
and to keep on top of those
that you know, as another initial fear
134
00:09:39.070 --> 00:09:41.070
of this system is going to change
every month or every two months or every
135
00:09:41.149 --> 00:09:45.830
three months or every week or even
every day. How do I possibly keep
136
00:09:45.830 --> 00:09:50.710
it up to date and valid from
a compliance perspective when, once I've established
137
00:09:50.710 --> 00:09:54.340
it, next week it's going to
be different? And that's all being done
138
00:09:54.379 --> 00:09:56.740
right now. It's been done for, you know, a number of years
139
00:09:56.779 --> 00:10:01.779
now the USDM where, but definitely
managing that for hundreds of clients these days,
140
00:10:01.059 --> 00:10:05.860
where there are systems that are being
chains on various different cadences and we
141
00:10:05.899 --> 00:10:09.409
have technologies and processes and tools in
place to handle that, whether it be
142
00:10:09.970 --> 00:10:15.649
automated testing, always on regression testing
that's happening, or can be, you
143
00:10:15.730 --> 00:10:20.610
know, manual assessments of changes that
come through specific to customer specific environments and
144
00:10:20.649 --> 00:10:24.159
then testing those, those pequ tests, in their in their environs to make
145
00:10:24.240 --> 00:10:26.600
sure they haven't broken anything. So
there's a lot going on that we're doing.
146
00:10:28.000 --> 00:10:31.080
We're actually developing. Well, we
developed and continue to use, for
147
00:10:31.279 --> 00:10:37.350
from a lot of customers now,
some tools for for continuous regression testing for
148
00:10:37.789 --> 00:10:41.230
content, major system that's used in
the in the cloud world and their life
149
00:10:41.269 --> 00:10:48.029
sciences industry for managing collaboration of documentation
and processes where it's changing on a daily
150
00:10:48.070 --> 00:10:52.220
basis. So once you've established a
compliance state, it's then kicked over and
151
00:10:52.299 --> 00:10:56.620
we're testing that twice a day every
day and producing raw ports and trends and
152
00:10:56.659 --> 00:11:01.860
we actually find issues much, much
more quickly than you would on a traditional
153
00:11:01.940 --> 00:11:05.330
old approach where you're looking at doing
manual assessments and testing and risk assessments and
154
00:11:05.970 --> 00:11:11.730
manual testing subsequent to thou as well. So the risk actually goes down rather
155
00:11:11.809 --> 00:11:16.129
than up because you find issues.
You find issues in both approaches, but
156
00:11:16.289 --> 00:11:18.759
with the the the continue automated aggression
testing, you find them much mouch more
157
00:11:18.759 --> 00:11:22.799
rapidly can roll them back if there
are any. So M so you were
158
00:11:22.879 --> 00:11:28.360
doing this a long time now,
over twenty years. How's this conversation changing
159
00:11:28.639 --> 00:11:31.159
for you? What was it like? I mean, I don't know if
160
00:11:31.159 --> 00:11:35.070
the cloud was around twenty years ago, but you know, in the end
161
00:11:35.110 --> 00:11:41.269
the early stages of this versus versus
today were how are those conversations changing?
162
00:11:41.389 --> 00:11:45.029
Or Handy changed? Yeah, I
might. Certainly the last three months has
163
00:11:45.029 --> 00:11:46.379
been, you know, a big
change. But you know, just over
164
00:11:46.419 --> 00:11:50.820
the last seven or eight years people
have started to embrace the cloud more.
165
00:11:50.860 --> 00:11:56.500
They've realized that the you know,
the security concerns and that the infrastructure pieces
166
00:11:56.539 --> 00:12:01.139
and you know, the benefits are
simply far outweighing that the you know,
167
00:12:01.220 --> 00:12:03.769
they perceived, you know, concerns
that they had. So we're looking at
168
00:12:03.889 --> 00:12:09.769
having, you know, companies that
either already had effective classes is in place.
169
00:12:09.330 --> 00:12:13.289
When, you know, for example, things like covid nineteen come along,
170
00:12:13.610 --> 00:12:16.480
they're much more flexible. They can
suddenly say, okay, you know,
171
00:12:16.759 --> 00:12:20.840
companies that work from home or have
the ability to work from home because
172
00:12:20.840 --> 00:12:24.399
everything's in the cloud, are suddenly
less disrupted than companies that had everything on
173
00:12:24.480 --> 00:12:28.720
prayer and they're scrambling now to find
a way to meet their business needs.
174
00:12:30.309 --> 00:12:33.029
have to implement systems extremely rapidly,
or the having to do things for a
175
00:12:33.269 --> 00:12:37.710
period of time wouldn't necessarily always be
considered the best way of doing their business
176
00:12:37.750 --> 00:12:41.830
and it's not necessarily going to be
compliant with regulations. So they have to
177
00:12:41.070 --> 00:12:45.740
scramble very, very fast to overcome
those needs and put work arounds in place.
178
00:12:46.340 --> 00:12:50.299
And you know what? Example,
obviously, where we experienced overnight huge
179
00:12:50.379 --> 00:12:54.460
jump in the need for systems was
in the e signature world. Right,
180
00:12:54.500 --> 00:12:58.769
people have to suddenly work from home. That's great. You maybe you had
181
00:12:58.450 --> 00:13:03.690
systems where you can collaborate your documentation, but having them approved across the globe.
182
00:13:03.889 --> 00:13:09.610
Suddenly everyone's now working in their home
offices or from wherever, having those
183
00:13:09.649 --> 00:13:13.600
approvals and there's those not just approvals
but qualified part of eleven and x eleven
184
00:13:13.720 --> 00:13:20.320
compliant approvals being done. was suddenly
a huge spike in that in that need,
185
00:13:20.799 --> 00:13:24.879
and one of the things that I
did at at US DM was we
186
00:13:24.320 --> 00:13:31.470
introduced to methodology, which helped customers
adopt and use those types of technologies and
187
00:13:31.669 --> 00:13:35.429
become fully compliant with the configured to
them system, you know, less than
188
00:13:35.509 --> 00:13:39.389
seven days. So they can actually
go from from start to finish and get
189
00:13:39.629 --> 00:13:43.860
compliant on sending those documents around the
world and signing them with with, you
190
00:13:43.940 --> 00:13:48.100
know, compliant signatures. So it's
a way of adapting. You know,
191
00:13:48.139 --> 00:13:50.620
obviously, US, DM is,
we're very virtual company already. We the
192
00:13:50.740 --> 00:13:54.809
impact to us from a technology perspective
has been minimal, so we're able to,
193
00:13:56.330 --> 00:14:00.450
you know, flex and move with
the Times they're but we're also able
194
00:14:00.490 --> 00:14:03.370
to recognize that some companies weren't that
built that way and how we have to
195
00:14:03.450 --> 00:14:07.970
help them and come up with strategies
for helping them do that. And you
196
00:14:07.090 --> 00:14:13.200
mentioned that. We've seen this big
spike and e signature solutions, in particular
197
00:14:13.320 --> 00:14:16.440
with art we and all these people
working from home. Now, with that,
198
00:14:16.759 --> 00:14:20.480
set that aside for a second,
would that be a normal starting point
199
00:14:20.519 --> 00:14:24.710
or a good starting point for a
company that is starting to move into this
200
00:14:24.909 --> 00:14:28.269
cloud based technology? No, absolutely, yeah, definitely. It's, you
201
00:14:28.350 --> 00:14:33.389
know, it's a relatively inexpensive,
you know, type of software. It's
202
00:14:33.429 --> 00:14:35.149
fairly simple as easy to understand.
In fact, a lot of companies,
203
00:14:35.190 --> 00:14:41.179
a lot of customers and end users
have seen these types of system already in
204
00:14:41.620 --> 00:14:45.659
a non kind of regulated guys right. So everyone's already familiar with them.
205
00:14:46.019 --> 00:14:48.940
If you bought a house in the
last ten years, you're likely to have
206
00:14:48.059 --> 00:14:52.169
seen electronic signatures being used for the
and all the contracts and things, always
207
00:14:52.210 --> 00:14:56.090
just using, you know, three
or four pens before they run out.
208
00:14:56.090 --> 00:14:58.529
So that's that's typical. You know, it's easy to adopt, it's easy
209
00:14:58.529 --> 00:15:03.809
to pay for, it's easy to
get the basic functionality up and running very
210
00:15:03.850 --> 00:15:07.159
rapidly. And what that does is
then it drives in a land and expand
211
00:15:07.279 --> 00:15:11.080
kind of method. At the companies. That's where it's been put in.
212
00:15:11.360 --> 00:15:15.159
We often see that the footprint is
initially, you know, a few people
213
00:15:15.200 --> 00:15:18.080
within the company, but then word, word gets around those systems there and
214
00:15:18.399 --> 00:15:22.269
the usage really, you know,
explode. And then subsequent to that they
215
00:15:22.309 --> 00:15:26.149
realize, you know, we we
USDM and and the company that we working
216
00:15:26.230 --> 00:15:31.389
with will visit there at the requirements
list, not just the initial I need
217
00:15:31.590 --> 00:15:35.460
this immediately because everyone's working from home, but the future requirements. You know,
218
00:15:35.539 --> 00:15:39.019
how am we going to use this
in the future, whether the people
219
00:15:39.019 --> 00:15:41.620
are at home or in the office. What other systems and technology can I
220
00:15:43.299 --> 00:15:46.899
integrate to or can I start using? Because my perception has changed of the
221
00:15:46.980 --> 00:15:52.730
cloud? Now I can maybe think
about using a cloud storage solution or or,
222
00:15:52.250 --> 00:15:56.929
you know, a cloud crm solution
or a ctms solution that can then
223
00:15:56.970 --> 00:16:02.690
be linked to my signature and my
my self solution things. So everything can
224
00:16:02.730 --> 00:16:06.879
all be, you know, linked
together, integrated very well in a simple
225
00:16:06.879 --> 00:16:11.480
fashion to accomplish a lot more business
use cases them was initially in a kind
226
00:16:11.480 --> 00:16:15.960
of thought of when they when they
implemented the initially signature solution. So it
227
00:16:15.080 --> 00:16:19.629
just drive adoption. It's great introduction. It helps people realize that, you
228
00:16:19.750 --> 00:16:22.830
know, this cloud is not the
big bad werewolf of the world. It's
229
00:16:22.830 --> 00:16:27.070
actually helping, it's less expensive and
it's, you know, it's really easy
230
00:16:27.110 --> 00:16:33.139
to use an adults. Okay,
so in our last podcast we talked about
231
00:16:33.179 --> 00:16:38.179
the FDA's upcoming guidance for computer software
assurance and how the FDA is encouraging the
232
00:16:38.299 --> 00:16:44.580
use of automation and more advanced technologies. How do you think this will impact
233
00:16:44.659 --> 00:16:49.570
life science companies willingness to adopt cloud
systems. This is would good thing or
234
00:16:49.649 --> 00:16:53.570
bad thing. Without I think it
should help. I mean if people,
235
00:16:53.809 --> 00:16:59.129
you know, are aware of the
guidance and the understanding that the FDA has,
236
00:16:59.929 --> 00:17:02.399
they've been looking at this. I
mean the Guy Guidance from the FDA
237
00:17:02.480 --> 00:17:04.559
doesn't just happen overnight. It takes
a lot of time, you know,
238
00:17:04.640 --> 00:17:08.559
many, many years of going back
and forward, and that's that's a result
239
00:17:08.599 --> 00:17:15.119
of customers and companies you know,
that have had audits, observations or have
240
00:17:15.240 --> 00:17:18.789
talked to people the FDA in various, you know, forums that that are
241
00:17:18.869 --> 00:17:22.069
said, look, this is this
is two owners. We can't we can't
242
00:17:22.109 --> 00:17:26.670
innovate when we can't take advantage of
the technology this out there because we're scared
243
00:17:27.309 --> 00:17:30.099
that what we do, this these
other things are going to be, you
244
00:17:30.180 --> 00:17:33.220
know, there to bite as.
And the FDA's never been saying that.
245
00:17:33.380 --> 00:17:37.980
It's always been, you know,
since you know, the early two thousands,
246
00:17:37.019 --> 00:17:41.900
has been around a risk based approach. That's that's been developed to meet
247
00:17:41.940 --> 00:17:45.690
those regulations. You know, gamp
has been around for over twenty years now
248
00:17:45.769 --> 00:17:52.089
and it's been advocating this. This
approach is risk based computer systems validation approach.
249
00:17:52.410 --> 00:17:56.529
But what's new is some of the
clarity has come from the FDA and
250
00:17:56.730 --> 00:18:02.880
and some of the methodologies that you
could now employ to really take advantage of
251
00:18:02.920 --> 00:18:06.640
the cloud to say, okay,
I'm not going to just implement this in
252
00:18:06.799 --> 00:18:10.000
this particular fashion, in this particked
away and make it compliant and that way
253
00:18:10.079 --> 00:18:12.630
and document it that way because the
FDA needs me to do so, when
254
00:18:12.710 --> 00:18:17.549
that doesn't really do anyone any favors. It doesn't help the business, it
255
00:18:17.670 --> 00:18:19.869
doesn't help, you know, the
patient. And what's the real point of
256
00:18:19.990 --> 00:18:23.309
doing that? The idea of the
companies are out there to produce the drugs,
257
00:18:23.349 --> 00:18:25.990
are going to help the people.
They help, you know, the
258
00:18:26.029 --> 00:18:29.740
MED devices, and so so the
FDA is coming up, come back and
259
00:18:30.140 --> 00:18:33.500
and in a really pragmatic fashion and
said, look, what we need to
260
00:18:33.579 --> 00:18:38.380
do is shift to focus on to
what helps the business, what helps the
261
00:18:38.460 --> 00:18:41.690
customer, rather than what needs to
be in place for us to audit you.
262
00:18:42.130 --> 00:18:47.529
What I mean by that is there's
a lot of testing and risk mitigation
263
00:18:47.569 --> 00:18:52.410
activities that have judicially been in play
that customers thought they needed to put in
264
00:18:52.569 --> 00:18:56.000
play because they were scared of,
you know, the FDA will be scared
265
00:18:56.000 --> 00:18:59.640
of you know, the conservative people
in the organization or whatever it might be,
266
00:19:00.720 --> 00:19:03.759
so that that that testing effort was
way too much. You know,
267
00:19:03.799 --> 00:19:07.680
they were taking screenshots of everything and
they were taking hundreds of hundreds of pages
268
00:19:07.720 --> 00:19:11.750
of testing to do a very simple
process. And it's been flipped around.
269
00:19:11.750 --> 00:19:15.309
Now what we're saying is, rather
than doing in a kind of eighty percent
270
00:19:15.430 --> 00:19:18.589
testing, it's now kind of twenty
percent testing, but we're actually folk using
271
00:19:18.589 --> 00:19:22.390
the testing in the right area.
Or Documentation. Ashes eighty percent documentation of
272
00:19:22.430 --> 00:19:26.140
your testing and twenty percent of actual
system. This other way around. Now
273
00:19:26.259 --> 00:19:32.539
right were actually testing system or but
we're documenting it less. Because here's the
274
00:19:32.579 --> 00:19:37.140
key. We're now can unlocking the
potential and the history of that vendor.
275
00:19:37.259 --> 00:19:41.529
So if you select the right vendor
that has a great stlc in place,
276
00:19:41.930 --> 00:19:47.410
they can then leverage the clients,
can leverage all of the activities that that
277
00:19:47.569 --> 00:19:52.650
vendor is is performing on a routine
basis based on established procedures that have been
278
00:19:52.650 --> 00:19:56.000
audited many times. To say I'm
not going to test that. You Know
279
00:19:56.279 --> 00:20:02.319
Two plus two equals four, because
you know the vendors already tested that many,
280
00:20:02.359 --> 00:20:04.000
many times and it's proven that to
be the case and I'm not touched
281
00:20:04.079 --> 00:20:08.029
that. So I'm going to leverage
that activity in my traceability effort. I'm
282
00:20:08.029 --> 00:20:11.670
going to say I didn't need to
test all these pieces here because they're already
283
00:20:11.670 --> 00:20:18.470
been tested by XYZ vendor. So
it becomes a piece of your methodology or
284
00:20:18.549 --> 00:20:22.940
cloud strategy to select the right person, the right vendor, that you can
285
00:20:22.940 --> 00:20:30.579
actually have leverageable risk medigation activities in
place. HMMMM. Any final advice you
286
00:20:30.660 --> 00:20:34.769
have for our listeners that are going
through their digital transformation activities now or even
287
00:20:34.809 --> 00:20:40.569
considering moving in this direction? Yeah, so, I mean, as I
288
00:20:40.650 --> 00:20:42.529
just said, you know, obviously
one of the key things is that that
289
00:20:42.769 --> 00:20:45.930
vendor piece. Make sure that you're
looking at the right vendors, and I
290
00:20:47.089 --> 00:20:52.359
just picking one the that's there.
You know, based on a few criteria
291
00:20:52.400 --> 00:20:55.200
around, you know, financials and
and time and things like that. But
292
00:20:55.319 --> 00:21:00.079
look at their the industry or the
the vendors knowledge, how experience they are
293
00:21:00.200 --> 00:21:03.589
working in the gisp world. You
know, how much of their IP are
294
00:21:03.630 --> 00:21:08.029
they willing to share if you have
to leverage their effort? How much of
295
00:21:08.069 --> 00:21:11.789
that is available to you? Is
it? Is it something they're very willing
296
00:21:11.990 --> 00:21:14.950
and open to say? You know, as we have this testing, his
297
00:21:15.069 --> 00:21:18.150
little testing we have you can you
can see that we do that every week
298
00:21:18.190 --> 00:21:22.299
or every day or every three months
or whatever, because that investment is going
299
00:21:22.339 --> 00:21:26.140
to pay off for you to reduce
the burden at the end users perspective,
300
00:21:26.579 --> 00:21:30.660
to do that work yourselves. And
it's important that you see that when you
301
00:21:30.740 --> 00:21:34.490
do that vendor selection activity, that
you see that's really in place. And
302
00:21:34.569 --> 00:21:38.930
that was really something that's I've been
driving at for a few years now and
303
00:21:40.410 --> 00:21:42.730
the Yes, the the CSA guidance
is now speaking to as well. Right.
304
00:21:44.089 --> 00:21:48.240
So we're trying to take that that
effort off the client put it onto
305
00:21:48.279 --> 00:21:51.240
the vendors shoulders. And then,
of course there's going to be, you
306
00:21:51.319 --> 00:21:56.319
know, pieces that you need to
make a compliant and validate on your end,
307
00:21:56.480 --> 00:21:59.640
but you need to try and take
all the core pieces, that the
308
00:21:59.720 --> 00:22:03.349
common elements, away and focus on
your actual real key business needs. And
309
00:22:03.470 --> 00:22:07.710
the secondly, consider offloading the compliance
piece. Right, that's not your core
310
00:22:07.750 --> 00:22:12.309
confidency either. Neither it, you
know, whereas infrastructures not in testing is
311
00:22:12.390 --> 00:22:15.940
not and neither is the compliance in
the it piece. So you know,
312
00:22:17.180 --> 00:22:21.380
select companies that can help you do
that, can actually help you maintain the
313
00:22:21.460 --> 00:22:23.980
system. They have processes and experienced
and you can, you know, get
314
00:22:25.019 --> 00:22:29.500
on with your business and kind of
have a nice fire and forget process where
315
00:22:29.539 --> 00:22:33.410
you get your system implemented in someone
else takes it. That's a compliance on
316
00:22:33.490 --> 00:22:36.809
your on the shoulders for you.
All Right, David blew it, thanks
317
00:22:36.849 --> 00:22:41.009
for coming on the show. All
right. Thank you all right, and
318
00:22:41.130 --> 00:22:44.680
we want to invite you to check
out some of David's other content that he's
319
00:22:44.759 --> 00:22:48.680
produced. He's an accomplished author.
We have several white papers that David is
320
00:22:48.720 --> 00:22:53.160
done on in the past and one
recently on this very subject that we talked
321
00:22:53.160 --> 00:22:56.920
about today. There's some webinars on
there that David is done, as well
322
00:22:56.960 --> 00:23:02.190
as some blogs. So head to
our website, US DMCOM and head to
323
00:23:02.269 --> 00:23:07.150
the insight section that's in the upper
right hand corner of the the main page
324
00:23:07.150 --> 00:23:10.309
of the website. In the meantime, thank you so much for joining us
325
00:23:10.390 --> 00:23:12.660
and we hope you'll tune in next
time to life science is accelerated. In
326
00:23:12.740 --> 00:23:22.180
the meantime, have a great day. You've been listening to life sciences accelerated.
327
00:23:22.380 --> 00:23:26.420
If you enjoyed this episode, please
subscribe and leave us a review if
328
00:23:26.460 --> 00:23:30.369
you'd like. To learn more about
strategies to digitally transform your company and ways
329
00:23:30.410 --> 00:23:37.730
to streamline your organizations compliance processed.
Visit US, dmcom. That's you asked
330
00:23:37.890 --> 00:23:41.960
dmcom. Thanks so much for listening. Until next time,
