AUDITING SUPPLIERS OF STANDARD SOFTWARE PACKAGES

Anton Dillinger Robert Kampfmann Torsten Wichmann SAP AG 

This chapter presents the audit experience of SAP, one of the world s leading IT (information technology) software product suppliers. SAP is renowned for its R/3 Enterprise Resource Planning (ERP) software. The R/3 product is typical of what is commonly referred to as standard software. 

Standard software provides functionality that is not based on the defined requirements of one customer it is based on the requirements of best industry practice of different industries, represented by top companies, university knowledge or consultant experience. 

Standard software is composed of a set of functions that can be configured by logic switches defined in tables to fit individual business scenarios of a defined company. Indeed, a user may even decide to customize its specific application with bespoke programming to meet their particular needs. SAP s R/3 product is a standard software package consisting of several programs. 

Pharmaceutical manufacturers are accountable to regulatory authorities like the U.S. Food and Drug Administration (FDA) for the validation of computer systems. Suppliers have a responsibility to ensure that their software, hardware or associated services are fit for purpose. Pharmaceutical regulators, however, do not hold suppliers accountable for validation. The validation of such standard software packages by a pharmaceutical user therefore consists of two aspects  

---