Learning in the Cloud for Regulated Industries

SAP White Paper
Learning Solution
Learning in the Cloud for Regulated Industries
The Six Essential Requirements for a Multi-Tenant SaaS
Learning Solution
©2016SAPSEoranSAPaffiliatecompany.Allrightsreserved.

2 / 16
© 2016 SAP SE or an SAP affiliate company. All rights reserved.
Table of Contents
4 For Regulated Industries: Learning Within a Multi-Tenant SaaS Architecture
6 Why a Validated Learning Environment is a Challenge in Multi-Tenant SaaS
9 The Six Requirements to Deliver a Validated Multi-Tenant Saas Solution
11 How SAP SuccessFactors Learning Provides Validated SaaS
16 Conclusion

3 / 16
Does a multi-tenant SaaS learning management system
(LMS) have a role in a compliance-driven, highly
regulated work environment? Organizations in
regulated industries such as life sciences, medical
device manufacturers, and pharmaceuticals struggle
with adopting SaaS learning solutions because of the
need to comply with a range of Good Practice
requirements — generally known as GxP.

4 / 16
Understanding the obstacles in the way of
multi-tenant SaaS adoption first requires an
understanding of GxP, which are meant to ensure
that a product is safe and that it meets its
intended use.1 Examples of GxP include Good
Manufacturing Practices (GMP), Good
Laboratory Practices (GLP), and Good Clinical
Practices (GCP). In highly regulated industries,
such as those mentioned above, GxP guarantee
that facilities are in good condition, equipment is
properly maintained and calibrated, processes
are reliable and reproducible, and employees are
qualified and fully trained.2 To meet the principles
and goals of GxP, companies must document the
steps they take to meet these guidelines — a
process known as validation.3 For learning
management systems to comply with GxP, the
validation process means that every update,
patch, and change for learning software must
meet exacting requirements and support two
main goals: traceability and accountability.4
When it comes to learning systems in a validated
environment, there are specific documentation,
record-keeping, and IT requirements that must
be followed. Validation requirements can take
three to six months for a customer to complete
— a time-consuming and expensive process. The
typical SaaS software update schedule of three
or more updates a year is often incompatible
with validation processes. As a result, many
companies in regulated industries prefer on-
premise learning systems so they can control
the update schedule and maintain a validated
environment.
For Regulated Industries: Learning Within a
Multi-Tenant SaaS Architecture
Validation is defined as “establishing documented
evidence that provides a high degree of assurance
that a specific process will consistently produce a
product meeting its pre-determined specifications
and quality attributes.”
Source: U.S. Food & Drug Administration.
1. http://www.fda.gov/drugs/developmentapprovalprocess/manufacturing/ucm169105.htm
2. Ibid.
3. U.S. Food & Drug Administration.
4. Zhou, Michael. Regulated Bioanalytical Laboratories: Technical and Regulatory Aspects From Global Perspectives. 2011.

5 / 16
However, a multi-tenant SaaS learning system
can support a validated learning environment.
Being multi-tenant is the foundation for true
SaaS and leads to a variety of advantages,
including:
•• Configuration and data secured in a separate
container
•• Software configurability that doesn’t require
changing the underlying codebase
•• Seamless maintenance and updates
•• Economies of scale that lead to lower costs
This paper will explain how regulated companies
can address compliance challenges and deliver
a validated environment with a multi-tenant
SaaS LMS.
BEST PRACTICES FOR GXP AND TECHNOLOGY
GxP requirements have evolved over the years
as electronic records and e-learning technology
replaced paper records and traditional classroom
training. One constant that has survived the
transition from analog to digital form is the need
for accountability. Every piece of audited
information must have a known author who has
signed into the system using a secure username
and password. No anonymous actions are
allowed. Although regulatory interpretation of
GxP can vary by country and industry,
guaranteeing accountability means that
hardware and software must offer the
following functionality:
•• Security: System activity should be recorded
and secured appropriately so that even a
system administrator can’t change it.
•• Auditability: A learning system must be able to
provide conclusive evidence in litigation cases,
to reconstruct the decisions and potential
mistakes that were made in developing or
manufacturing a medical device, drug, or other
regulated product.
•• Archiving: Relevant audit information must be
kept for a defined period. In some countries,
archives must be kept for several decades.
Archived information is still subject to the same
requirements, but its only purpose is to provide
reliable evidence in litigation cases.
•• Non-repudiation: Information must be logged in
such a way that no user could say it’s invalid.
Because data must be tamper-proof, digital
signatures are frequently used.
•• Record keeping: It’s necessary to create and
document the decisions that lead from user
needs and business goals down to the system
design and verification of proper system
installation and operation.
•• Litigation and regulation support: Plaintiffs
and regulators may be able to subpoena or
otherwise demand certain information. This
data must be available and be maintained
according to law. This information must be
furnished promptly in the required format. 5
5. http://en.wikipedia.org/wiki/GxP

6 / 16
trying to implement or operate an LMS in a
validated environment must comply with Part 11.
An LMS in a validated environment must do
more than manage the volumes of training data
generated. Compliance itself presents four
significant challenges.
VALIDATING THE LEARNING SYSTEM
To qualify as a validated system, an LMS must
undergo a structured and documented process
that meets FDA requirements. In short, an LMS
within the life sciences and pharmaceuticals
industries must prove that it can do what it says
it can do — a task that is often easier said than
done. The validation process, for both software
and accompanying processes, and standard
operating procedures (SOPs), must document
user requirement specifications, functional
specifications, system design, and testing.
In short, a validated system must perform as
advertised, consistently produce results, meet
unique customer specifications, and fulfill its
intended purpose. If you’re not quite sure how to
meet all of the validation requirements, you’re
putting a lot of trust in the hands of your vendor.
Can they prove that their products can get the
job done?
Although these best practices are generally the
same regardless of location and industry, it would
be helpful to look at one specific example of GxP
compliance in a validated environment and
better understand these challenges.
In the United States, the Food and Drug
Administration (FDA) sets some of the most
stringent policies regarding documentation as
part of its efforts to protect the public. The best-
known aspect of FDA regulations is the Code of
Federal Regulations (CFR) Title 21, which relates
to food and drugs. Violations incur FDA Form 483
citations and other penalties. In recent years,
high-profile fines, expensive litigation, and plant
shutdowns have cost companies hundreds of
millions of dollars in losses. Although many
parts of Title 21 touch on aspects of validation,
focusing on Part 11, which relates specifically to
electronic records, can clearly illustrate the
challenges of validation and demonstrate how
SAP SuccessFactors delivers a validated
environment in the cloud.
The goal of the validation requirements in 21 CFR
Part 11 is for companies to document procedures
and processes, and demonstrate consistent
results. In the eyes of the FDA, achieving
consistency requires validation. Any company
Why a Validated Learning Environment is a
Challenge in Multi-Tenant SaaS

7 / 16
•• Operational qualification (OQ): demonstrates
that all facets of the process or equipment are
operating correctly. Why OQ matters:
Organizations need the ability to test
application functionality and document actual
results versus expected results, similar to User
Acceptance Testing (UAT). If your vendor
provides OQ, you have a lot riding on its
success. A well-defined OQ can dramatically
reduce your testing costs and save months of
testing time.
•• Performance qualification (PQ): demonstrates
that the end process repeatedly produces
results that meet specifications. This is
recommended but is typically completed by
the client.
After validating the LMS itself, you must next
prove that the LMS is installed properly and able
to operate correctly and perform consistently.
Your next challenge is compliance with these
mandatory qualifications:
•• Installation qualification (IQ): demonstrates
that the hardware and/or software meets all
specifications, is installed correctly, and that all
required components and documentation
needed for continued operation are installed
and in place. The outcomes of tests with
expected and actual results should be included.
Why IQ matters: The LMS vendor must be able
to show documentation of initial application
and database setup. The vendor must
demonstrate that it followed all required steps
for proper installation of the environment.
Regulatory non-compliance with GxP requirements can
be severe. St. Jude Medical, a company specializing in tech-
nology and services specific to cardiac, neurological, and
chronic pain ailments, saw a 13 percent drop in share prices
in November 2012 due to concern over FDA warnings. Even
with efforts to address record-keeping and quality issues,
St. Jude Medical still received an FDA Form 483 citation.
Source: St. Jude Outlines Fixes at Calif. Plant. Minneapolis Star-Tribune. Jan. 9, 2013.

8 / 16
COMPLYING WITH GUIDELINES FOR
AUDITABLE PROCESSES AND ELECTRONIC
SIGNATURES
According to the FDA, electronic data accepted
as official records in lieu of paper or other
physical records must comply with stringent
audit processes, including records storage and
electronic signatures. The FDA requires
electronic signature authentication because
many of these documents must be signed on
creation, review, or approval. If your LMS cannot
provide nondestructive auditing and support
multiple levels of sign-off, a Form 483 citation
could be in your future.
DOCUMENTING STAFF TRAINING,
EDUCATION, AND EXPERIENCE
The final hurdle is compliance with GxP
regulations and guidelines. These regulations
require companies — not the vendors — to
demonstrate that their staff has the appropriate
combination of education, training, and
experience to do their assigned jobs.
In spite of these four challenges, delivering a
validated learning solution in a true multi-tenant
cloud environment is possible. However, few
vendors can overcome these hurdles, and asking
specific questions can help you quickly discover
whether an LMS provider is up to the challenge.
VALIDATING SYSTEM UPDATES
One of the key benefits of SaaS is a regular
update schedule, usually on a quarterly basis.
Instead of maintaining and updating the
applications on your own servers with a level
of difficulty and risk, the vendor provides the
updates seamlessly. Not only are you saved the
expense and the hassle, you benefit immediately
from continuous innovation. You are always on
the latest operating system.
However, one of the greatest advantages of the
cloud is one of its greatest challenges in a
validated environment. Software vendors
upgrade everyone in the cloud at the same time
according to its release schedule. To meet
validation requirements, a regulated company
and its learning system vendor must overcome
two key challenges:
•• Validation is a prolonged process, typically
lasting three to six months. Companies that
receive as many as four releases per year with a
cloud-based solution are simply unable to
complete the validation process prior to the
next release. For this reason alone, a multi-
tenant SaaS LMS is not an option for most
customers.
•• Validation is never a standardized process,
because the level of documentation details
needed varies from company to company. Your
vendor must be proficient in delivering
solutions in a highly regulated environment.

THE LMS MUST SUPPORT MULTIPART
ELECTRONIC SIGNATURES
Electronic signatures are a significant focus in
Part 11 and are discussed in 11.50, 11.70, 11.100,
11.200, and 11.300. One or more electronic
signature authentications may be required when
creating, modifying, or deleting “covered data,”
which includes learning events, performance
reviews, and assessment processes. Multiple
levels of electronic signatures may be required.
For example, a typical approval process could
include a requirement for a supervisor to sign, for
a supervisor and then the employee to sign, or
for just the employee to sign. The LMS must
support different approval processes.
THE LMS MUST HAVE AUDITABILITY
“BUILT IN”
The requirements of 21 CFR 11.10(e) require
electronic records to have “secure,
computergenerated, time-stamped audit trails to
independently record the date and time of
operator entries and actions that create, modify,
or delete electronic records. Record changes
shall not obscure previously recorded
information.”As a result, an LMS in a validated
environment must have an inherent auditing
capability. The LMS must automatically provide a
secure way to determine the identity of a user
who recorded (or deleted) data and to determine
what data was added or modified.
THE LMS MUST MEET AUTHORIZATION
REQUIREMENTS
The requirements of 21 CFR 11.10(d) call for
electronic records to limit system access to
authorized individuals. Complying with the
unique username and password requirement
can be a challenge in a single sign-on (SSO)
environment — especially if password aging is a
requirement. The LMS must address both of
these needs.
The Six Requirements to Deliver a
Validated Multi-Tenant Saas Solution
9 / 16
The origins of SAP SuccessFactors Learning are in the high-
ly regulated nuclear, regulatory, life sciences, and energy
industries. From the beginning, our learning solutions were
built with compliance in mind. Source: St. Jude Outlines
Fixes at Calif. Plant. Minneapolis Star-Tribune. Jan. 9, 2013.

THE LMS MUST PROVIDE APPROPRIATE
SECURITY
Part 11 establishes different but integrated sets
of electronic records requirements for
administrators and users. A supervisor acting as
an administrator needs to manage the data for
their employees, and an individual employee user
needs the ability to manage their own data. One
challenge in a validated environment is restricting
administrator access appropriately. For example,
a departmental training administrator might
need to enroll people in classes, record course
completion, assign training requirements, and
produce reports on training history and status.
You should be able to limit an administrator’s
capability to perform those actions only on
people who work for their department.
THE VENDOR OF A MULTI-TENANT SAAS
LMS MUST PROVIDE AN UPGRADE SCHEDULE
THAT ALLOWS TIME FOR VALIDATION IN A
REGULATED ENVIRONMENT
When a validation process consumes half a year,
it’s impossible to stay in compliance with a
typical update schedule of three or four releases
annually for multi-tenant cloud solutions.
A cloud-based LMS vendor must offer flexibility
in its upgrade process to allow customers to
meet all FDA guidelines.
THE VENDOR SHOULD ASSIST WITH THE
VALIDATION OF THE LMS AND WITH
NECESSARY REPORTS
Complying with IQ, OQ, and PQ reports can be
difficult for most companies. After all, they didn’t
design the software. Who better to assist in
validation than the people who wrote the code?
Vendor support with appropriate documentation,
audits, and reports for each update can greatly
reduce compliance risk.
Now that you know what it takes to deliver a
multi-tenant cloud in a validated environment,
you can compile your short list of vendors — and
a short list it will be. The single name on the list
will be SAP SuccessFactors.
10 / 16

With SAP SuccessFactors Learning, Part 11
compliance is not a single feature, but rather a
set of interrelated system functions. Together,
these functions provide data accuracy and
security that meet or exceed the requirements
stated by the FDA in Part 11.
Most Part 11 requirements are simply common
application design and management best
practices, such as password aging and non-
destructive auditing. This functionality is already
built into SAP SuccessFactors Learning. Also,
the LMS includes an electronic signature
feature designed specifically to meet Part 11
requirements that can be turned off and on as
companies require.
The standard SAP SuccessFactors SaaS
schedule is four updates a year. A critical part
of complying with FDA regulations is
producing qualification reports that are
mandatory parts of the process. Anytime a
software release is delivered — cloud or not — an
organization must undergo the time and expense
of re-validating. In cloud environments in which
multiple releases occur on a quarterly basis, it’s
impossible to meet compliance standards that
sometimes require three to six months of
validation. To facilitate delivery to a validated
audience, SAP SuccessFactors Learning offers
validated customers a modified release schedule
of a single annual update.
With the once-a-year update, you benefit from:
•• Six months with a staging environment to
review and prepare for annual upgrades
•• Patches only applied for stability
•• Extension changes based on a schedule that
you define
To help validate the LMS itself, SAP
SuccessFactors documents the initial application
and database setup. We also demonstrate that all
required steps for proper installation of the
environment were followed. To assist you with
compliance on your mandatory qualification
reports, SAP SuccessFactors also offers IQ
reports with its validated environment in the
multi-tenant cloud.
How SAP SuccessFactors Learning Provides
Validated SaaS
11 / 16
A multi-tenant cloud LMS is a better choice than on-prem-
ise solutions for delivering a validated environment. Costs
are 11 percent lower than on-premise solutions over a
seven-year period. Also, a cloud-based LMS implements 36
percent faster, which can mean getting products to market
faster for companies in compliance-heavy industries.

You benefit from:
•• A standard IQ report with each update, with a
supporting execution signature to document
that installation is in accordance with both our
specifications and yours
•• Full-system technical and process
documentation
•• An independent annual audit for compliance
When you use the SAP SuccessFactors Learning
- Validated SaaS to deliver a validated learning
environment, you also enjoy these benefits:
•• Cost savings: The total cost of ownership is
lower because of reduced capital expenses.
Validation costs are lower, and maintenance
and ongoing operations costs decrease in
comparison with an on-premise solution.
Significantly accelerating deployment times
and adopting a pay-per-usage model further
reduce costs. Finally, updates can scale up
easily as the organization grows, again avoiding
significant capital investments.
•• Fewer IT requirements: Because the system
vendor manages updates, including preparation
and reporting, IT teams can focus on other
value-producing tasks. Also, Web-based
delivery and support eliminate the need for
servers or other hardware.
•• Continuous innovation: Regular upgrades that
are an integral part of the cloud model mean
that you can benefit from new developments
easier than with on-premise solutions. There’s
no need to let years go by without significant
functionality improvements.
•• Strong security and service: A cloud-based
LMS enables organizations to create a
foundation of security in the cloud, with 24-
hour staffed security teams that are skilled in
operating under SSAE 16 SOC 2-certified
controls that include data-center audits. The
premium multi-tenant cloud offering helps
organizations enhance service-level availability
by as much as 99.5 percent, while providing full
disk encryption for data at rest.
12 / 16
6. Gartner. Integration Challenges Can Thwart Getting Value From Talent Management Application Investments. 2012.
With validated cloud for SAP SuccessFactors
Learning, users enjoy 99.5 percent service
availability and full disk encryption for
database storage.

Beyond technology challenges, validation teams
spend much of their time simply struggling to
keep track of frequent regulatory changes — and
compliance failures have significant
consequences.
Because SAP SuccessFactors manages the LMS
implementation and the upgrades, we provide
you with a standard IQ report, which lowers your
costs and streamlines the validation process.
SAP SuccessFactors also complies with FDA and
GxP processes, which helps further reduce risk.
With SAP SuccessFactors Learning - Validated
SaaS, you have a partner in monitoring the
regulatory environment. We work to anticipate
changes and make system adaptations during
upgrades. For customers outside the United
States or with a significant international
presence, we also monitor regulatory efforts of
European, Canadian, Asian, and other
international bodies for newly passed legislation
that results in system changes.
Also, much of the required functionality for a
validated environment is already built into SAP
SuccessFactors Learning.
MULTIPART ELECTRONIC SIGNATURE
MANAGEMENT
To ensure regulatory compliance, organizations
in industries such as life sciences often require
electronic signatures for their learning
environments. With SAP SuccessFactors
Learning, you can require one or more electronic
signature authentications when creating,
modifying, or deleting covered data, which
includes learning history.
The LMS incorporates controls to maintain
unique username/password combinations and
meet FDA requirements for electronic signatures
(or e-signatures). LMS functionality includes:
•• Non-editable creation and modification
identifiers, including user ID, username,
signature reason, date, and time stamp of when
the data was created or last modified.
•• Global activation/deactivation exclusive of
audit-trail functionality. As a result, even if
e-signature functionality is turned off, the
system will continue to meet FDA requirements.
13 / 16
With 625-plus LMS customers and 14 million
learning users, SAP SuccessFactors knows
about learning technologies. It has 10-plus
years of history of compliance with FDA
regulations for more than 50 customers.

•• Administrator-maintained signature “reason
codes” from a list of options for covered data.
The codes become part of the data row and
cannot be excised or edited by normal means.
Individual reason codes also have a user/date/
time stamp/action audit trail associated with
them. If a reason code is already recorded with
a learning event, it cannot be deleted unless the
associated learning event is deleted (which
requires specific permissions in the system).
•• Identifiers for the nature of a change, including
creation, modification, or deletion. When a data
row is created, modified, or deleted from a
table, a complete duplicate row is created in the
covered data’s associated history table (even
for data deletions).
•• E-signature requirement at global and specific
data levels, which is useful in organizations
where some departments may be FDA
regulated and some are not. For example,
some courses could eliminate the need for
e-signatures, such as non-GMP-related
courses.
•• Multipart e-signature support means you can
create approval processes with multiple steps,
requiring each individual identified in the
process to electronically sign the data before
it’s recorded.
•• E-signature data that is non-editable by normal
means for all protected transaction records.
•• Defined signature uniqueness with username
and PIN. To protect covered data, you can:
–– Set expirations
–– Require e-signature PIN value to be different
from password
–– Manage by LDAP or SSL solutions
–– Require username, PIN, and reason code for
covered data
–– Encrypt PIN storage and link value to a user
–– Restrict system administrator to PIN
clearance capabilities, but not PIN retrieval
–– Require authentications for changes to
covered data
–– Send email alerts after three authentication
failures
E-signature triggers include global enablement,
covered data enablement, learning event
completion, and recorded learning events with
associated approvals.
14 / 16

INHERENT AUDITABILITY
Part 11’s electronic record requirements stipulate
that companies must provide “secure,
computergenerated, time-stamped audit trails to
independently record the date and time of
operator entries and actions that create, modify,
or delete electronic records. Record changes
shall not obscure previously recorded
information.”
With SAP SuccessFactors Learning, you can stay
in compliance with Part 11 because of built-in
auditability. You can determine the identity of any
user who recorded (or deleted) data and what
data was added or modified. The auditing system
includes a set of database tables that:
•• Store the history of every data record entered
into the system and a set of functions that
ensure that auditing can’t be turned off or
modified by ordinary means
•• Populate each time a data record is created,
modified, or deleted
•• Indicate the username, date, and time the
action was committed to the database
INDIVIDUAL AUTHORIZATION
SAP SuccessFactors Learning includes a two-tier
authentication scheme for system access based
on the unique combination of username and
password — including password aging. You have
the flexibility to enable system-administrator or
user-only password management. Access can be
implemented with single sign-on systems.
SYSTEM SECURITY
As in any data security environment, two levels of
authorization are needed: one for administrators,
the other for users. With SAP SuccessFactors
Learning, you’ll know that:
•• Users can only view and manage their own
data. Users who are supervisors can also
manage data for their employees. Inactivity
logouts are also included.
•• Administrators can access and manage most
data in the system, depending on the specific
activities (or workflows) assigned to them, such
as class enrollment or reporting on training
history. If needed, you can limit administrators’
capabilities to those who work in their
department. Additionally, there is no limit to the
number of workflows that can be created.
15 / 16

With more than 10 years of experience
supporting regulated industries with strict
validation requirements, SAP SuccessFactors
Learning - Validated SaaS is designed to meet
stringent validation requirements.
Our experience includes LMS customer
engagements for numerous life sciences,
pharmaceutical, and medical-device customers.
With our best-practices approach, you benefit
from an array of compliance-related training,
including:
•• Support for GxP requirements
•• Automated learning assignments based on
nearly any criteria
•• Visibility into compliance training status
and activities
•• Support for multipart e-signatures
In addition, SAP SuccessFactors serves as an
advocate for the regulated training industry,
working with industry trade groups and
petitioning the regulatory bodies directly to be
more exact with their requirements and to
decrease the information management burden
on organizations in regulated industries.
With all the benefits of the cloud and essential
features needed to meet today’s most stringent
validation requirements, SAP SuccessFactors
Learning - Validated SaaS is the solution of
choice for growing organizations in highly
regulated industries. Contact us today to find out
more about a validated SaaS learning solution for
your organization.
Conclusion
16 / 16
vQ316 © 2016 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the
express permission of SAP SE or an SAP affiliate company.
SAP and other SAP products and services mentioned herein as well as their respective logos are
trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other
countries. Please see http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for
additional trademark information and notices. Some software products marketed by SAP SE and its
distributors contain proprietary software components of other software vendors.
National product specifications may vary.
These materials are provided by SAP SE or an SAP affiliate company for informational purposes only,
without representation or warranty of any kind, and SAP SE or its affiliated companies shall not be liable for
errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company
products and services are those that are set forth in the express warranty statements accompanying such
products and services, if any. Nothing herein should be construed as constituting an additional warranty.
In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business
outlined in this document or any related presentation, or to develop or release any functionality mentioned
therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy
and possible future developments, products, and/or platform directions and functionality are all subject
to change and may be changed by SAP SE or its affiliated companies at any time for any reason without
notice. The information in this document is not a commitment, promise, or legal obligation to deliver
any material, code, or functionality. All forward-looking statements are subject to various risks and
uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned
not to place undue reliance on these forward-looking statements, which speak only as of their dates, and
they should not be relied upon in making purchasing decisions.

Learning in the Cloud for Regulated Industries

More Related Content

What's hot

Similar to Learning in the Cloud for Regulated Industries

More from Bhupesh Chaurasia

Recently uploaded

Learning in the Cloud for Regulated Industries