1. Copyright © 2005, SAS Institute Inc. All rights reserved. Maintaining a Validated SAS Toolset Co-Presenters: Edward Helton and Patricia Halley

2. Copyright © 2005, SAS Institute Inc. All rights reserved. 2 db  LIS HIS lab, ADT, meds, source documents  display eCRF complete chart note Merged workflow: clinical trial data captured in initial CDA, re-used in chart note validation Proposed processes (single source) CLINICCRO ODM CDA & CDISC in Starbrite Trial CDA(1) CDA(2) Source: Liora Alschuler, Landen Bain, Rebecca Kush, PhD.

3. Copyright © 2005, SAS Institute Inc. All rights reserved. 3 Near-term Goal: Create means of conversion to minimize risk of ODM adoption

4. Copyright © 2005, SAS Institute Inc. All rights reserved. 4 Agenda  Part 11 and the Predicate Rules  Applying the Predicate Rules to Maintenance of a Validated SAS Toolset  Support from SAS (now and future)

5. Copyright © 2005, SAS Institute Inc. All rights reserved. 5 Common Threads of GxPs  Calibrate  Test  Validate  Standardize  Retain Records  Maintain Written Procedures

6. Update on Part 11 GMP by the Sea August 25, 2004 Rick Friedman, Team Leader Guidance & Policy Division of Manufacturing and Product Quality Office of Compliance, CDER

7. Copyright © 2005, SAS Institute Inc. All rights reserved. 7 FDA Regulation References - GCP  Strong New FDA Industry Guidances in GCPs  50.20 – 312.56 ( c) – sponsors shall review and evaluate evidence related to safety and effectiveness  312.57 (a) – Records must be Accurate & Complete  312.62(a,b,c) – Investigator Recordkeeping - drug disposition, case histories, record retention

8. Copyright © 2005, SAS Institute Inc. All rights reserved. 8 FDA Regulation References - GMP  211.22 (a) – Quality control unit has the authority to approve and reject  211.67 ( c) – Records shall be kept of maintenance, cleaning, sanitizing, and inspection  211.68 – Validation requirements of automated equipment  211.100 (a) - Written procedures for production and process control  211.180 (a), (b), and ( c) – Retention period for records

9. Copyright © 2005, SAS Institute Inc. All rights reserved. 9 FDA Regulation References - GLP  58.29 (b) – must maintain current summary of training for those engaged, or supervising the conduct of a non-clinical study  58.33 (b) – all experimental data… must be accurately recorded  58.35 (b) (4) – periodically submit a written status report noting problems and corrections  58.63 ( c) – records maintained of all inspections, maintenance records, testing, calibration and/or standardizing operations

10. Copyright © 2005, SAS Institute Inc. All rights reserved. 10 FDA Regulation References - Devices  21 CFR 812.145 (a) & (b) - Records must be Accurate & Complete  21 CFR 812.140 – must retain records required by 812

12. Copyright © 2005, SAS Institute Inc. All rights reserved. 12 21 CFR Part 11- Upcoming Amendment  Comments collected on the existing rule  Support for Part 11 in general  It is not going away – expect rewrite in future

13. Copyright © 2005, SAS Institute Inc. All rights reserved. 13 Standard Data / JANUS  Tools to receive, upload and analyze data  Unambiguous path of the source data to the analysis findings (metadata, derivations, flags, imputations, source code, analysis files)  Focus on standard data and standard analysis makes maintaining validation even more critical – valid interface, interaction between SAS systems  This makes your SAS configuration even more important!

14. Copyright © 2005, SAS Institute Inc. All rights reserved. 14

15. Copyright © 2005, SAS Institute Inc. All rights reserved. 15

16. Copyright © 2005, SAS Institute Inc. All rights reserved. 16 Standard Data / JANUS  Right now it takes analysis of many applications to find common trends.  One study took 10 person years.  We don’t have that kind of time to “find” the right data.  Standardization enhances the need for a validated SAS system.

17. Copyright © 2005, SAS Institute Inc. All rights reserved. 17 SAS Validation of SAS9 Customer Validation of SAS9 -- Toolset Validated System AERS Interim Analysis Integrated Safety Report Customer Validation of SAS9 -- Applications

18. Copyright © 2005, SAS Institute Inc. All rights reserved. 18

19. Copyright © 2005, SAS Institute Inc. All rights reserved. 19 Configuration Management  Identify functional and physical characteristics  Manage changes to those characteristics Source -- IEEE

20. Copyright © 2005, SAS Institute Inc. All rights reserved. 20

21. Copyright © 2005, SAS Institute Inc. All rights reserved. 21 Managing Changes

22. Copyright © 2005, SAS Institute Inc. All rights reserved. 22 Identify and Describe Changes  Sources of Information Tech Support SAS Notes Mail & File Lists (TSNEWS-L) Monitoring Tools  Sources of SAS Updates Hot Fixes Service Packs

23. Copyright © 2005, SAS Institute Inc. All rights reserved. 23 Identify and Describe Changes - Future Electronic Software Downloads Automatic Alert Notification

24. Copyright © 2005, SAS Institute Inc. All rights reserved. 24 Request and Approve Changes  Classify Change  Submit Request  Obtain Approval

25. Copyright © 2005, SAS Institute Inc. All rights reserved. 25

26. Copyright © 2005, SAS Institute Inc. All rights reserved. 26 Implement and Verify Changes  Test environment  SASIQ/SASOQ  Data Migration

27. Copyright © 2005, SAS Institute Inc. All rights reserved. 27 Copyright © 2003, SAS Institute Inc. All rights reserved. SASIQ/SASOQ  Automated  Tested  Repeatable  Reports and Stores Results (XML) http:// support.sas.com/rnd/migration/planning/validation /

28. Copyright © 2005, SAS Institute Inc. All rights reserved. 28

29. Copyright © 2005, SAS Institute Inc. All rights reserved. 29

30. Copyright © 2005, SAS Institute Inc. All rights reserved. 30 Data Migration  Proc Migrate  Migration Macros  Guidance and tools available at http://support.sas.com/rnd/migration/fulltoc.html

31. Copyright © 2005, SAS Institute Inc. All rights reserved. 31 Implement and Verify Changes – Future  IQ/OQ Enhancements  Install Enhancements  Less media (1 instead of 19)

32. Copyright © 2005, SAS Institute Inc. All rights reserved. 32 Document  Initial Change Requests  IQ/OQ Output  SAS Logs  SAS Registry (Future)  Design / Configuration Specification Change Log

33. Copyright © 2005, SAS Institute Inc. All rights reserved. 33

34. Copyright © 2005, SAS Institute Inc. All rights reserved. 34 Security  Physical  Logical Operating System Level Account Maintenance Internet Security SAS Management Console

35. Copyright © 2005, SAS Institute Inc. All rights reserved. 35 Business Continuity  Backups  Redundancy  Environmental Controls  Disaster Recovery

36. End-to-End Seamless Integration; Semantic Interoperability Pharma Medical & Statistical Reviewers Approval Open Data Model - XML based, CDISC compliant Patients Subject CDMS Op DB Investigator Physician ODMSDTM LABADaM Source: Dave Iberson-Hurst

37. Copyright © 2005, SAS Institute Inc. All rights reserved. 37 Copyright © 2005, SAS Institute Inc. All rights reserved. 37