Validation of SAP Public Cloud Solutions using SAP Digital Manufacturing as an example
The cloud is changing the way companies use and operate IT systems and presents regulated companies in the pharmaceutical and medical technology industries with new challenges. Particularly with regard to GxP compliance, data security, and validation, companies must find ways to reconcile the digital transformation with the stringent regulatory requirements.
SAP Digital Manufacturing at a Glance
SAP Digital Manufacturing is a Manufacturing Execution System (MES) that acts as a bridge between ERP systems such as SAP S/4HANA and the shopfloor level. This makes it business-critical and GxP-relevant in regulated industries. For life sciences companies, this means that a computer system validation, e.g. according to GAMP 5, is required to meet the requirements of EU GMP Annex 11 or FDA 21 CFR Part 11. This was precisely the topic examined in the DHC webinar with Thomas Pauly (Practice Manager IT Compliance) and Frederick Walte (Senior Consultant) on the validation of public cloud solutions. Using SAP Digital Manufacturing (SAP DM) as an example, a public cloud solution for manufacturing execution, the challenges, solution approaches and future perspectives were explored.
The distinctive feature of public cloud systems such as SAP DM lies in their system architecture: SAP DM is built on the SAP Business Technology Platform (SAP BTP) and uses hyperscalers such as Microsoft Azure, while the public cloud system SAP DM is operated by SAP. This provides flexibility and scalability, but also requires trust in the cloud provider, as companies have no direct influence on release cycles or infrastructure changes. This trust should be established through a meaningful and risk-based supplier qualification of the cloud service provider.
Shared Responsibility: Distributed Responsibilities
A key concept in (public) cloud systems is the so-called Shared Responsibility Model. It describes which responsibilities lie with the cloud provider and which with the customer. While the cloud service provider, such as SAP, is responsible for infrastructure, platform, and standard functionality, the customer is responsible for ensuring that GxP-relevant processes are correctly configured and that audit trails, electronic signatures, or access rights are correctly implemented and validated.
This model is also anchored in regulatory guidelines, such as GAMP5 or the ISPE guidelines. For companies, this means that in addition to classical validation tasks, they must also conduct supplier qualification and appropriate supplier management.
Release Management and Test Automation
A central topic of the web session presentation was release management. SAP delivers quarterly release updates for SAP DM. Customers have only a few weeks to maintain the validated state of the previously used functionality. Verification is performed through regression tests, which are determined by a corresponding change impact analysis. To carry out validation in a timely and efficient manner, test automation is a critical success factor.
Test automation refers to the use of software tools that execute predefined test scenarios automatically in the user interface. This allows changes after updates to be verified quickly and reliably. Especially in an environment with short release cycles, this is essential to ensure compliance while not jeopardizing time-to-market.
SAP Cloud ALM and DHC Smart Validation Accelerator
With SAP Cloud ALM, SAP provides a central tool for requirements, change, and test management. For regulated companies, it offers the possibility to integrate validation processes directly into IT processes.
DHC complements this platform with the DHC Smart Validation Accelerator (SVA), a solution that automatically creates, versions, and links validation documents such as URS (User Requirements Specification), risk analyses, or test cases based on the captured validation objects. Instead of static documents in Word or Excel, a database-driven validation is created that is always traceable and audit-proof.
The execution of automated tests takes place in a corresponding test tool.
In combination, SAP Cloud ALM and the DHC SVA enable an End-to-End Digital Validation Platform: requirements, risks, specifications, and tests are digitally captured, automatically linked, and can be consistently maintained throughout the entire system lifecycle.
Digitalization of Validation: From Obligation to Opportunity
Companies that actively shape this transformation benefit twice: they not only secure their compliance but simultaneously create the foundation to introduce innovations such as cloud ERP, AI-driven analytics, or digital manufacturing solutions faster and more safely.
Conclusion
The validation of public cloud solutions such as SAP Digital Manufacturing is complex but feasible. The key is that companies:
- clearly define responsibilities in the sense of the Shared Responsibility Model,
- take supplier qualification and supplier management seriously,
- rely on test automation and efficient release management, and
- digitalize validation processes, e.g., with SAP Cloud ALM and the DHC Smart Validation Accelerator.
This way, validation does not become an obstacle to innovation but rather an enabler for digital transformation in regulated industries.
Validation of SAP Public Cloud Solutions
Let us jointly assess how cloud solutions can be validated GxP-compliantly in your life sciences landscape.