This article discusses the need to validate SAP R/3 systems and presents a method of dividing them into validatable parts to make the process easier and traceable. A support tool for the validation of SAP R/3, which is based on an accelerated SAP (ASAP) system and allows SAP documentation to be controlled and traced, is also described.

Is there really a need for SAP R/3 (systems, applications and products in data processing) validation? One or both of the following questions are frequently heard:

"Why do we need to validate a SAP R/3 system? It's a business system only, used for financial and human resource administration and not involved in GMP-[good manufacturing practice] critical aspects."

Whether validation is necessary depends upon which SAP R/3 modules are used. If a pharmaceutical company uses the MM (materials management), PP-PI (production planning for process industries) or QM (quality management) modules, validation is mandatory. In these cases, data relevant to quality control, such as concerning batch recipes, material flow, status of finished and unfinished products, lot numbers, expiration dates and lot tracking, are administered. Occasionally, a highly automated warehouse is connected to SAP R/3 and information such as the location and status of products is only available from the system.

"SAP R/3 is a standardized system. It's sufficient to prepare a supplier audit. Why should a standardized system be validated?"

If you work with an ERP (enterprise resource planning) system, a supplier audit is good but not sufficient. SAP R/3 and other ERP systems can be customized very specifically to meet the functionality demanded by the user. In SAP R/3, the configuration of the system is done at two detailed levels: the level of individual programming, using ABAPs (advanced business application programs); and the level of customization, for example, of fields, values, functionalities and access rights. Therefore, SAP R/3 must be validated in a similar way to an individually developed computer system.

Although logical, neither comment may be acceptable from a GMP perspective. Good automated manufacturing practice (GAMP) considers SAP R/3 as a customizable standard software system of category 4. GAMP defines five categories of software. Category 5 requires the highest validation effort. It is this category in which custom-built or bespoke software falls. Configurable software packages such as SAP R/3 belong in category 4.

How to validate a SAP R13 or ERP system

The following description is oriented along the V-model shown in Figure 1. It is based on the V-model of the GAMP 3 guide [1] and is modified to the specifics of the SAP R/3 or another ERP system.

How to create a user requirement specification (URS) for a SAP R/3 system. To be able to perform performance qualification (PQ), a URS is required as a standard against which to run the tests and from which acceptance criteria will be derived. Usually, SAP R/3 is implemented by companies alongside...