GxP and agile: streamline data integrity on Atlassian Cloud

Working in a GxP environment means prioritizing data integrity. But archaic processes and systems mean life sciences organizations will struggle to stay competitive and reap the benefits of agile practices, DevOps, automation, integrations, and AI advancements.

So what’s the solution? Moving to Atlassian Cloud, for example, doesn’t mean data integrity goes out the window – in fact, it can improve your processes, providing greater traceability and transparency for your organization.

In a recent webinar, RadBee CEO Rina Nir chatted with Monika Andraos, founder of Dunamis Compliance. Monika is an independent consulting firm that empowers regulated organizations to achieve unparalleled data integrity through data governance. They discussed:

• How to think about data integrity in the context of test reports.
• How to buy from a vendor you can’t audit (like Atlassian).
• The considerations regarding data integrity when using Atlassian Marketplace apps.

We take a closer look at their insights below, but if you want to watch the full webinar, it’s available here.

Understanding data integrity without fear

Imagine being able to deliver updates to your product or platform, not once a year, but every month or every week without compromising data integrity? That’s what Cambs Pharma wants to do (we’ve made this company up, but we’re sure you’ll recognise its use case).

Cambs Pharma has a lot of software, much of which is GxP sensitive, but it uses old methods to keep it updated. Some of its systems are managed with a GxP life cycle that relies on Word and Excel. And it also uses a big legacy requirements management system. It’s not reaping the benefits of agile working, DevOps, automation and more – and it has myriad experiences across different teams.

The business has made the decision to move to Atlassian Cloud, but its people are worried about data integrity. But what exactly is data integrity and what do they need to think about?

What is data integrity?

Data integrity is the degree to which data is complete, consistent, trustworthy, reliable, and accurate, and the maintenance of that throughout the data lifecycle.

Should we be worried about it?

When it comes to data integrity, Monika Andraos says we need to stop worrying and see it differently. “We don’t want it to loom over us. We want to think of data integrity as an asset. Stop thinking of it as a chore or a regulatory requirement, and start thinking of it as a way to bolster your product, your decisions, your processes, and your understanding.”

Data governance and organizational maturity

Good data integrity requires effective data governance and mature processes. Data governance is made up of:

• Quality organizational culture that embraces ownership, accountability, and communication.
• Data culture, where good digital hygiene is standard across your procedural, behavioral, and technical controls.
• Good knowledge management, including training, resource continuity, vendor management, and data management.
• Design and IT infrastructure of data and systems integration.

And you don’t just assess your own data governance – you do this for any providers you’re planning to work with too. Monika suggests choosing a cloud solution and SaaS vendors like searching for a place to live. Just because an apartment meets your requirements (budget, location, etc.), it doesn’t mean the landlord is good. You need to ask yourself “Are they good? Or is there a better option out there?”

Data integrity and test reports

In our Cambs Pharma example, they want to improve the way they develop, test, and perform testing activities in their systems. As they’re trying to modernize their approach, this includes having a lot of automatic tests alongside manual tests. With Atlassian Cloud on their team, the result of these testing activities will be stored in Jira. All their requirements management will be in Jira as well.

To create release documentation and their requirements traceability matrix, they’ll be using Confluence. With the help of the Snapshots App from Radbee, they can aggregate the data from Jira into Confluence and create clear, accessible reports in a couple of clicks. These reports can then be exported if they need to submit them to regulatory authorities or third parties.

What are the data integrity considerations?

“The main thing is that you have a traceable way of going back and understanding the decisions you took and if things need to change or be updated,” says Monika. “And we can learn from mistakes and successes.”

Mapping your process out as well as you can before implementing systems helps you identify any potential issues around infrastructure, storage, and risk. It also prevents confusion down the road and a system that’s not designed to handle your testing requirements.

A quick checklist:

• Store the data – you need to look after all of the information and the records that are going to prove and reconstruct the events that got you to that snapshot – your data and your metadata.
• Map the data – with data moving between systems through integrations, it’s critical to define and demonstrate your business process. That’s where your data process map and data lineage are going to be really important.
• Classify the data and your systems – understand your data and systems in detail: is it critical or not critical? Where does it go?
• Identify the risks – are you moving data, copying data, or leaving data behind? Once you know the risks, you can document them, mitigate them, and accept them if you need to.

How to buy from a vendor you can’t audit

“This is one of the first questions people ask when they want to move their GxP workloads into Atlassian, specifically Atlassian Cloud,” explains Rina Nir. In our example, Cambs Pharma has chosen Atlassian as their vendor. A lot of organizations traditionally send a quality questionnaire or assessment to a prospective vendor. But Atlassian doesn’t undertake auditory requests.

What are the data integrity considerations?

“The risk lies with the regulated company at the end of the day, no matter what,” says Monika. “But you do want to explore all your options to make sure you’re minimizing the risk to your data integrity, data loss, and data availability.”

A quick checklist:

• Read the fine print – these types of vendors have generic agreements, so make sure you read yours in detail and understand it.
• Visit the Atlassian Trust Center – this is where Atlassian has lots of information about your data in the cloud, including its certifications. If there’s something missing, you can approach Atlassian and find out if it’s on their roadmap.
• Know your organization – think about how your business likes to do things and understand the implications anything in the agreement will have.
  Get professional help – hire the right consultants to help you understand certifications that may be applicable to you, for example, someone who knows all about GDPR, ISOs, etc. depending on the data you’re dealing with.
• Take notes – document any risks and make sure you fully understand the rules and responsibilities on both sides of the agreement.

Data integrity and Atlassian Marketplace apps

For many organizations, one of the big appeals of using Atlassian Cloud is its rich marketplace of extensions. These are features that you can add to your instance to increase functionality. In our Cambs Pharma example, they added Snapshots of Jira Data into Confluence to produce those traceability reports. Another application they used was Xray Test Management for Jira, which brings a very rich test management suite in Jira.

At a glance, you can get a good idea of the data security credentials of these third-party vendors. In any of the app listings on Atlassian Marketplace, you can see if the app is CLOUD FORTIFIED or not. While alone this doesn’t mean your data is totally protected, these apps will offer better protection than those that aren’t. Also, in the “Privacy & Security” tab, you can find out details about whether an app stores your data and how.

What are the data integrity considerations?

Monika says you need to do your due diligence with vendors, whether they’re a third-party app or not. That includes a documented risk assessment, with clearly outlined rules and responsibilities and a good understanding of their governance process, to see how well it fits with your organization’s needs.

A quick checklist:

• Check accreditations – look for CLOUD FORTIFIED apps with detailed privacy and security information. And visit the Marketplace Trust Center for information from Atlassian about the risks of using these apps.
• Ask the right questions – you want to minimize data breaches and identify any issues that might come up. Find out about their restoration and back-up controls, disaster recovery, how they handle data privacy, if they’re doing penetration testing, and how you get your data back if you need to.
• Think about the future – if you’re planning on growing, you need to know that this vendor will be able to scale with you and accommodate your changing needs. How future-proofed are they – are they going to keep up with AI and new technology?
• Look at the human side – don’t just focus on the technical aspect. Find out if this vendor is willing to work with you to resolve issues. Do you get a good feeling from your interactions? Are they responsive, transparent, and proactive?

A simple recipe for data integrity

To sum up, it’s worth remembering that data integrity isn’t something to be terrified of – it’s something that those making medicines and medical devices in particular need to embrace. Monika made this useful analogy in our webinar:

“I just started making bread. I thought I was the worst baker in the world until I brought a notebook and a pen into the kitchen and started writing down when things came out good – what the temperature was, what ingredients I used… and every time something failed. And that’s data integrity.

“I write down my experiences because I’m going to forget and I’m going to keep making the same mistakes, or I’m not going to connect my failures to different variables. So that’s what we want to do all day every day, because we’re in a controlled and regulated environment. We want to understand where we went wrong and where we’re doing well.

“It’s not scary, or a burden or a chore. It’s just a method to document and understand and to have traceability and transparency between what you’re doing and what the outcome is.”