Integrated Risk Management with GAMP 5 – manage ... - we.CONECT

Integrated Risk Management / July 2012
Instead of specifying and monitoring controls for each individual compliance
requirement, the controls are summarised in a unified system. The challenges of an
integrated risk management system such as this are that the context and timing of
the requirements are not uniform, e.g. the SOX controls are reviewed at a different
time and possibly by other organisational units to the GxP requirements. The
integrated approach requires a certain degree of abstraction of the controls to make
them applicable to all compliance frameworks. These necessary abstractions can
lead to various interpretations by the different organisational units within the
business.
On the other hand, the integrated approach allows for a unified business-wide basis
for the controls, and thus a significant reduction in costs. Concurrently, this enables
the comparability of results across organisational and system boundaries and
achieves the necessary transparency.
In practice, we first specify the controls for the various frameworks and unify those
controls that occur in several frameworks. The specification and application of a
change process, for example, can be expected in all frameworks (GxP, SOX etc.).
Tool Support
In order to manage the controls efficiently, Microsoft Excel is available as a tool for
the simplest cases. Excel is ideal for organisations that only need to assess a few
applications for compliance. As soon as one has to manage a larger number of
applications, or wants to consolidate multi-organisational results, using Excel
becomes extremely time-consuming and/or no longer feasible.
Database applications specialising in risk & compliance management represent an
alternative to Excel. These provide an advantage over Excel, in that the entire risk
management work flow is displayed in an integrated tool:
• specification of the assessments and controls
• implementation of the assessments and evaluation of the controls
• identification of compliance deviations
• assessment of the risks
• management and monitoring of risk mitigation measures
www.hgp.ag
© 2012 HGP AG, CH-Basel, All rights reserved Page 4 of 6