Cloud Computing: Is a check list for the assessment of a Cloud Service Provider sufficient?

Recommendation

23-26 April 2024
Berlin, Germany

Computerised System Validation - Introduction to Risk Management + GAMP 5 Approach
Learn How to Plan, Implement and Document Effectively Computer Validation Activities

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 12: Will it be sufficient to send a check list for the assessment of the CSP - for instance Amazon and Microsoft? Topic: Requirements for Supplier Evaluation and Supplier Audits

Cloud service providers are among the most important quality-relevant suppliers a pharmaceutical company has to assess in the course of the supplier qualification. This places heavy responsibility on the quality assurance or on the audit department as concerns the qualification of auditors and the availability of the required information at the suppliers: For each cloud service provider the request for an audit signifies the introduction of comprehensive coordination activities for the audit carried out on site or for answering long questionnaires. Both are rather unpopular since they bind a lot of resources. That's why cloud service providers often ask for cost sharing for audits carried out on site hoping that then the audits won't be carried out at all. Obviously, the quality department of the cloud service provider isn't very pleased about questionnaires full of open questions either, when answering these questions might require several days.

In order to assess a SaaS cloud service provider offering a quality-relevant application it is strictly necessary to carry out an audit - it would be best on site - since the documentation on the development and validation of the system must be assessed considering GMP aspects. In case only a remote audit would be possible it has to be guaranteed that there is sufficient time for reading the documentation made available online. The auditor should try to receive a copy of the quality-relevant documents for examination before the actual remote audit takes place. Most suppliers will refuse this for confidentiality reasons, however.

The quality assessment of global service providers in the area of IT infrastructure (IaaS service provider) often poses bigger problems as such companies (for instance Microsoft, Amazon) simply ignore such requests. In this case, the pharmaceutical entrepreneur is required to assess general documents made available on a broad basis. Microsoft provides a comprehensive quality manual (Microsoft Azure GxP Guidelines, © 2020 Microsoft Corporation, 99 pages) which can be downloaded from the Microsoft website. Here, the auditor finds answers to a number of questions she/he would want to discuss in the course of the audit. 

Amazon also provides a number of documents on the relevant subject areas in the form of not contiguous fragments which are made completely available to the auditor only after signing the delivery contract, however, so that they are not suitable for the initial assessment of the supplier.

The auditor should absolutely try first to send a questionnaire with the request for replies also to these global companies in order to leave nothing undone. In this context it should be noted that I've sent a request to Amazon recently and have received an almost completely answered questionnaire which allowed me an assessment.

It is very important for the pharmaceutical company to include the option of regular audits (without additional costs) into the contract with the service provider. Furthermore, the bundling of audits activities of several pharmaceutical companies (joint audit) with sharing of the costs should be considered. This would have a lot of advantages and win-win situation for both parties - the customer as well as the service provider - since time and costs could be saved.

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart