Integrated Risk Management with GAMP 5 – manage ... - we.CONECT

Integrated Risk Management / July 2012
Many of the controls, however, occur more or less identically in the various
compliance frameworks (GxP, SOX etc.), meaning that they are checked several
times in various cycles. Consequently, the introduction and maintenance of a change
process as a control, for example, occurs in almost all compliance requirements.
Added to this is that many controls are related to processes, which in turn apply to a
variety of computer systems, e.g. the change process.
Subsequently, we can therefore conclude that we have introduced appropriate risk
management processes to the fullest extent possible, but that these have been
implemented redundantly and at a considerable cost throughout the entire
organisation due to numerous compliance requirements and their application to a
number of IT systems.
Generally, this leads to high yet unnecessary additional costs for the specification
and implementation of the controls. It can even lead to contradictory evaluations of
individual controls, as these are not standardised throughout the various frameworks
and so are evaluated differently by the different departments. A lack of transparency
in the actual compliance status within the organisation then also contributes to the
system falling short of expectations.
The desired compliance is indeed achieved, but only at considerable expense and
the risk of unpleasant surprises during audits and inspections due to this complexity.
Integrated Risk Management
One solution for implementing these risk management processes in an efficient way
into the entire organisation is the introduction of an integrated risk management
system:
Figure 3: Integrated risk management
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 3 of 6