Regulated contexts

In most SAP programs, testing answers a business question: does the system do what we need? In a regulated company, testing must also answer a second question, asked by someone outside the program: can you prove it? That someone may be an external auditor reviewing internal control over financial reporting, or an inspector from a health authority reviewing a manufacturer's computerized systems. This course is about producing evidence that answers both questions at once. It is not legal advice; your compliance, quality and audit functions decide how the rules apply to your company.

Two regulatory families

Financial controls in brief

Under section 404 of the Sarbanes-Oxley Act, management of a US-listed company assesses its internal control over financial reporting, and for many companies the external auditor attests to it. Most companies use the COSO Internal Control - Integrated Framework (updated in 2013), whose five components are control environment, risk assessment, control activities, information and communication, and monitoring activities. In SAP terms, the controls fall into two groups: application controls inside business processes (for example the tolerance check when an invoice is matched to a purchase order and goods receipt) and IT general controls (ITGCs) that keep those application controls reliable (user access, change management, and computer operations such as job scheduling and backups).

GxP in brief

GxP is shorthand for the "good practice" regulations in life sciences: good manufacturing, laboratory, clinical and distribution practice. Where a computerized system supports GxP processes or holds GxP records, regulators expect it to be validated for its intended use. In the US, 21 CFR Part 11 sets requirements for electronic records and electronic signatures, including secure, computer-generated, time-stamped audit trails. In the EU, Annex 11 to the GMP guidelines covers computerized systems. ISPE's GAMP 5 guide (second edition, 2022) is the industry's main practical framework for a risk-based approach.

When both apply

A US-listed pharmaceutical or medical device company is subject to both regimes, often in the same SAP processes. A goods receipt that moves a batch into quality inspection stock is a GxP event and an inventory valuation event. Do not run two separate test programs with two evidence standards. Agree one evidence standard that satisfies the stricter of the two, tag each requirement or control with the regimes it falls under, and let the risk assessment decide the depth. Internal audit and quality assurance should both approve that standard before testing starts.

What "validation" means

Computerized system validation (CSV) is documented evidence that a system does what it is intended to do, consistently, and remains in that state through change. Financial auditors use different words (design and operating effectiveness of controls), but the core idea is the same: defined requirements, risk-based testing, attributable evidence and controlled change. Both reject the idea that a vendor's product is "validated" out of the box. SAP provides a configurable product; each customer must show that its configuration and use are fit for its intended use.