Enterprise Service Management
The systems in use have to remain in the validated state — for IT the same as maintenance is for the equipment. The field also carries the documentation systems.
The field is called Enterprise Service Management, ESM for short. ITIL 4 and ISO/IEC 20000-1 are the frameworks in which the service processes are designed — they are not the name of the field.
Regulatory anchor
Documentation (GMP Chapter 4 / GDP Chapter 4): the systems carrying the documentation — eQMS, DMS — have to remain in the validated state; the standards for it come from QA.
Annex 11
EU GMP guideline for computerized systems, in force since 2011 — it requires the validated state
GMP Kapitel 4
Documentation — the systems that carry the documentation (GDP Chapter 4 carries the same title)
ITIL 4
Framework for service processes — not the name of this field
ISO/IEC 20000-1
Requirements for a service management system
What we design here
A system leaves the validation project in the validated state. From then on, operation decides whether it stays there: every change, every incident, every configuration adjustment.
Any change to a validated system may require revalidation. We implement change control for validated systems as a process that keeps effort and risk proportionate — with the change advisory board as the deciding body.
For IT an incident is a ticket; for QA it may be an event that has to be documented. We establish classification schemas and escalation paths that identify and document GxP-relevant events.
Validated systems have to be reviewed at regular intervals. We run the periodic review in a structured way — with documentation, an assessment of validation status and, where needed, requalification. The CMDB holds the configuration state that is reviewed against.
Requirements arising from operation are assessed, prioritized and routed the right way: a change within the validated lifecycle, or a validation project of its own.
Operating manuals, configuration descriptions and records of the system state. The standards for them come from QA; the systems that carry the documentation — eQMS, DMS — sit in this field.
IT service processes that combine ITIL best practices with GxP requirements — without duplicate structures between the IT process and the quality process. The tools are the ones the processes run in, not the deliverable.
Regulatory inspections specifically scrutinize the service processes and the records of the system state. Preparing the records and the team is part of the work.
Frameworks and tools
Change control for label amendments is one example where the IT process and the quality process coincide: every template change is a GxP-relevant system change that requires validation.
Boundary
ESM maintains the validated state, it does not establish it — establishing it sits with Compliance (CSV), the handover point being release to productive operation. Producing the evidence sits with Test Management: ESM decides that re-testing is required after a change. The equipment sits with Engineering & Maintenance. ITIL is a framework here, not the name of the field.
Designing the system landscape and the target process across domain boundaries do not sit in this field: they sit with Enterprise Architecture and E2E Architecture. What this field delivers is maintaining the validated state in operation.
Discuss change control or periodic review?
Together, we accomplish what doesn't get finished alone.