SAP Systems Validation

COMPUTER SYSTEM VALIDATION (CSV) SAP VALIDATION
1

All Experts,
I have worked as a CSV validation team member on a few SCADA systems, lab systems and network validation projects. Now, I am being assigned to the SAP team as a validation representative. But I have only a general idea on how SAP systems work and what one needs to look for in terms of SAP Validation. Can anyone provide me any reference documents/articles/materials on the net or a book that can :

  1. help me in understanding the SAP systems in general quickly.
  2. guideline on what one needs to be looking for and in what modules in terms of validating SAP systems in a regulated environment.

Your help is greatly appreciated!

Thanks!

2

Well heres some points to consider, and some questions to ask if you want to work out whats going on.

  1. SAP is a modular system where you can buy the modules that you require.

  2. SAP website has alot of info

  3. SAP has it own validation packages that you can buy.

  4. SAP uses Oracle back end database, I think

  5. SAP uses client / server topology therefore the computer network must be qualified if the SAP validation is to be valid.

  6. There will need to be process mapping by end users / consultants to define how to configure SAP. This makes up the URS.

  7. There may need to be data migration validation from the old system’s data.

  8. There is usually consultants and SAP reps involved in the project.

  9. I would most definately compile a Validation Master Plan for this project defining who will do what where and when. You can assign roles and responsibilities.

  10. You will need to do a DQ/IQ/OQ/PQ

  11. Define the hardware and document it

  12. document the correct installation of the SAP software

  13. the testing of scripts can be labour intensive, and mundane.

  14. research some other sites such as IVT / ISPE and the like as there are documents available that cover a whole SAP project “journal of validation technology” an ERP case study

Regards

3

To be honest, in my experience of SAP Validation Projects, it would be totally impossible for 1 person to validate an entire SAP system! It would require an adequately trained and appropriately experienced “team” of professionals to do such a job, assuming it’s a relatively large life sciences company. The mapping of the various Business Process Requirements alone would be a huge undertaking, crossing multiple business departments with varying criticalities. This will drive the validation effort required.

Sorry, but I would go back to management and request some support, otherwise they are ‘likely to hang you out to dry’ when the validation project fails.

I wish I could be more helpful. Just my experience of SAP validation projects, that’s all…you need more expert manpower.

4

I appreciate your difficulty. SAP Validation is a huge task and it changes from project to project as it depends upon its implementation. We have done number of such projects and no two are similar. Let me briefly tell you standard steps devised by us to make the task more organised.

  1. Gap Analysis - Trying to findout from implemented systems, available documentation, applicable SOPs present day position of SAP against expectations of Regulatory agencies, say FDA. We have devised a checklist and map system against that.
  2. Action Plan - Based on that we create action plan alongwith client, and decide which gaps can be closed technically and which are to be attended procedurely. Of course, cost aspects to be kept in mind.
  3. Risk Assessment - Next step is to carryout detailed Risk Assessment of all relevant modules i.e. MM( Material), QM(Quality) and PPM(Production). Some scope also falls into Distribution module as well as HR module depending upon implementation strategy. This step is very important as it allows you to determine which T-codes or transactions are most important to cover into validatin and which are least. We classify into typical 3 categories as per GAMP guidelines. Further validation effort is based on this classification.
  4. Validation - This in a traditional sense starts with creation of Validation Master plan, Protocols preparation and ends with Traceability Matrix.

One of the most difficult task in such projects is to trace or identify URS and/ or FS. Also most of the time, validation group is assigned task only after system has been implemented and running for more than year! So finding out what system was supposed to deliver is a major task and this has to involve some senior representative from each user of module. And person has to be one who can define present requirements too. So, you have to create a Core Team which includes all above users as well as senior rep. from QA, QC , IT and Validation. At some point of time you may need to involve Finance, if its capital incentive. However they are not actively part of Validation Core Team.

There are of course many things to be considered, however i have tried to summarise above.

Trust above is of some help.

Rgds.

Jaydeep Chhatrapati

[quote=maryacton]All Experts,
I have worked as a CSV validation team member on a few SCADA systems, lab systems and network validation projects. Now, I am being assigned to the SAP team as a validation representative. But I have only a general idea on how SAP systems work and what one needs to look for in terms of SAP Validation. Can anyone provide me any reference documents/articles/materials on the net or a book that can :

  1. help me in understanding the SAP systems in general quickly.
  2. guideline on what one needs to be looking for and in what modules in terms of validating SAP systems in a regulated environment.

Your help is greatly appreciated!

Thanks![/quote]

http://mexicotravelpoints.com/th/

5

We received software to assist in generating help files and “BPP.” BPP are detailed procedures on how to perform a task. Here is the quandary, BPP are held in validated doc management system…but help files are not. Any issues here? I was of the opinion that there was an issue since users will probably use the online help and not go to the controlled BPP. I was thinking of putting a procedural control in place to maintain the two in synch.

6

If individuals are performing a particular task in SAP then they should be following the SOP on how to do this ie the BPP files in the doc management system.

How can help files, help people perform a specific task are they not just there to help people to troubleshoot how SAP functions.

Just say these people went to the web to get some help, can’t validate the web i’m afraid.

As long as the users are trained and understand that they have to follow the BBP files then I dont see a problem here.

What do you think?

7

This solution replaces the SAP help and gives context specific help for a particular transaction. If a user gets stuck performing a transaction, they can click the help menu in SAP GUI. The help menu is “smart” in that it knows what transaction the user is on and brings up a web page with the appropriate content. The website content is the BPP (procedure) but it is not the one from the document management system it is held by the help system.

8

So would you say that this “help” information acts as part of the SOP?

9

The help is a copy of the SOP. only not in the document management system. But most likely, it will be the document referenced by the user and not the SOP in the doc management system.

10

Yes these docs would have to be maintained in a validated system as this system is more or less doing the job of a doc management system.

Having two systems working together is never a good idea like this and ensuring that they both have the same version control adds alot of unneccessary work.

Just my 2 cents!

11

You are just “validating” :slight_smile: my points that I have brought up to the team. Thanks.

12

No problem

13

I have just completed a SAP validation project and have a similar background to yourself. There are a number of standard document sets produced if the follow the ASAP (Accelerated SAP) methodology. I will list them for you below.
Blueprint - This document briefly outlines the objective of the particular implementation of the software module in question.
Business Process Definition - (BPD) This document establishes exactly how the software will function with respect to the users interaction and takes the form of process maps.
System Requirement Specification - (SRS) - This document is used by the SAP specialists to determine how the functionality is going to be delivered i.e. Vanilla SAP, enhancement (FRICEW), or configuration (IMG).
We now move onto the actual technical documents.
Configuration Record (CR) - This document is created to state how the configuration functionality is going to be delivered.
Functional / Technical Specifications FS / TS - Well know terminology. Used to develop the code (Most development is done in ABAP)
The we move on to the testing. IQ and OQ is used for the hardware and software install, but the terminology used for the software functional testing tends to be;-
Development Unit Test (DUT) - Proves that the developers have done their development correctly
Functional Test - (FT) - Proves that the configuration and development software works correctly.
Integration Test (IT) - Shows that the individual elements of config of coding work together in a process.
User Acceptance Test (UAT) - End to end testing of specific processes.

There are normally three or more areas within the SAP landscape. SANDBOX - Normally a developers area where you can play around with development as much as you want. DEV - The development area, coding and config is carried out here by the development team to make sure that it functions. QA - Quality Assurance, this environment is where you would do the integration and user testing. PRD - Production, this is the area where fully tested and verified code is placed and used by the end users.

The validation approach is key to delivering a validated system with minimal frustration for the development team. High level risk assessments at the BPD stage help to identify what is GxP critical functionality and data. This can then be further risk assessed at the config of Functional stages.

I could talk for hours on specific issues to look out for. If you would likie any further information, post a reply.

Jon Davey
Managing Director
Provalidus LTD

www.provalidus.com

14

Thanks Jon great post!

15

Hi,
Anyone have any experience of validating SAP interfaces with other systems (e.g. an MES system). I am facing a project where materials planning will be carried out on the SAP system which will feed information into the MES system. my experience with trying to get systems to talk to each other and validating such interfaces have proved very labourious tasks.

alitoast

16

Alitoast,

What eaxactly do you want to know?

Regards

17

[quote=Alitoast]Hi,
Anyone have any experience of validating SAP interfaces with other systems (e.g. an MES system). I am facing a project where materials planning will be carried out on the SAP system which will feed information into the MES system. my experience with trying to get systems to talk to each other and validating such interfaces have proved very labourious tasks.

alitoast[/quote]
@Alitoast

you have two systems here. one is the SAP and another is the MES. now, is the interface developed seperately and installed or is it a part of the MES application ?
if it is a seperate piece of application then you need to follow regular qualification approach.
If it is part of the MES application, it can be extensively defined in an appropriate section header “Software Inteface” and then qualified as part of the MES’s function. This module is not visible. so it can be tested at module level in Unit testing level. Also, the function of the interface is implicitly tested when you qualify the whole MES including data movement from the SAP.
hope this makes sense to you

18

Here is a new social network site
www.sapforall.net

Join for FREE and let’s start your SAP Consultant career.

19

SAP the company was founded in Germany in 1972 by five ex-IBM engineers. In case you’re ever asked, SAP stands for Systeme, Andwendungen, Produkte in der Datenverarbeitung which - translated to English - means Systems, Applications, Products in Data Processing. So now you know! Being incorporated in Germany, the full name of the parent company is SAP AG. It is located in Walldorf, Germany which is close to the beautiful town of Heidelberg. SAP has subsidiaries in over 50 countries around the world from Argentina to Venezuela (and pretty much everything in between). SAP America (with responsibility for North America, South America and Australia - go figure!) is located just outside Philadelphia, PA.

The original five founders have been so successful that they have multiplied many times over such that SAP AG is now the third largest software maker in the world, with over 17,500 customers (including more than half of the world’s 500 top companies). SAP employs over 27,000 people worldwide today, and had revenues of $7.34 billion and Net Income of $581 million in FY01. SAP is listed in Germany (where it is one of the 30 stocks which make up the DAX) and on the NYSE (ticker:SAP).

There are now 44,500 installations of SAP, in 120 countries, with more then 10 million users!

So what made this company so successful? Back in 1979 SAP released SAP R/2 (which runs on mainframes) into the German market. SAP R/2 was the first integrated, enterprise wide package and was an immediate success. For years SAP stayed within the German borders until it had penetrated practically every large German company. Looking for more growth, SAP expanded into the remainder of Europe during the 80’s. Towards the end of the 80’s, client-server architecture became popular and SAP responded with the release of SAP R/3 (in 1992). This turned out to be a killer app for SAP, especially in the North American region into which SAP expanded in 1988.

The success of SAP R/3 in North America has been nothing short of stunning. Within a 5 year period, the North American market went from virtually zero to 44% of total SAP worldwide sales. SAP America alone employs more than 3,000 people and has added the names of many of the Fortune 500 to it’s customer list (8 of the top 10 semiconductor companies, 7 of the top 10 pharmaceutical companies etc). SAP today is available in 46 country-specific versions, incorporating 28 languages including Kanji and other double-byte character languages. SAP also comes in 21 industry-specific versions.

SAP R/3 is delivered to a customer with selected standard process turned on, and many many other optional processes and features turned off. At the heart of SAP R/3 are about 10,000 tables which control the way the processes are executed. Configuration is the process of adjusting the settings of these tables to get SAP to run the way you want it to. Think of a radio with 10,000 dials to tune and you’ll get the picture. Functionality included is truly enterprise wide including: Financial Accounting (e.g. general ledger, accounts receivable etc), Management Accounting (e.g. cost centers, profitability analysis etc), Sales, Distribution, Manufacturing, Production Planning, Purchasing, Human Resources, Payroll etc etc etc. For a full description of the modules included in SAP, see the related articles. All of these modules are tightly integrated which – as you will find out – is a huge blessing … but brings with it special challenges.

SAP are maintaining and increasing their dominance over their competitors through a combination of

  • embracing the internet with mySAP.com (a confusing name we believe) to head off i2 etc
  • extending their solutions with CRM to head off Siebel
  • adding functionality to their industry solutions
20

SAP is a configurable system.

It has many application in engineering industries and now it is used in Pharma industries.

Main pont which is orgotten is about extra security needed for all pharma use and that is two different level of creator and aprover.

There are places in SAP where we need to configure certain parts and has a critical quality issues.

Many a time SAP remains as an Inventory management systems.

Every one should spend some more time with validation consulatant during implementation to avoid many issues latter on.

Key points being. Test all server.
Check time synchronization and time correction.
Security system thouroughly
User authorization
Transection code authorization and Controls.
Flow Preparation
All process made onlie from order received to despatch.

Proper integration of Stability Data.
Generation of COA and routing of Man-Machine

There are many more points to go on…

One shold carry out he intensive Risk Assessment of all stages, steps.
Risk needs to be mitigated.
Than only we can proceed for the validation.

Kalpesh KVS technologies