Veeva’s 23R1 release is slated for April 21st release to all Vaults. As always, there are many new features and enhancements available in the new release, some of which require configuration efforts to enable in your Vault. fme is your partner in keeping your Vault up to date on all the latest improvements and functionalities. Let’s review some key new features which require configuration effort and their potential benefits included in this release for the Vault platform, Veeva Vault QMS, and Veeva Vault RIM.

Vault Platform features

Multi-Record Workflow

With the last release in 2022, Veeva introduced the ability to route multiple records (i.e. Change Control, Quality Events, Audit records, etc.) on the same workflow at the same time. This is similar to how multiple documents can be routed for review or approval on the same workflow via the Cart

In 23R1 the ability has been added to remove records from a multi-record workflow based on defined conditions. For example, if some records have incomplete fields, they can be removed from the workflow based on the defined criteria to ensure that only complete records are routed in the workflow. This action will be reflected in the audit trail.

Additional workflow configuration refinements are available in 23R1 to limit the roles allowed to participate when a workflow initiator selects the users for a participant group. This ensures the person initiating the workflow can only select users to participate in the workflow who have the correct user role(s).

Interface enhancements

A few of the new features in 23R1 provide interface enhancements for the system users. Tab Collections can now be created based on the user’s system permissions. This option can enhance a user’s experience in the system by providing an additional organization level for how information is displayed and accessed.

Another great enhancement that can head off frustration in users is that multi-select fields can easily be ordered alphabetically. Previously this required that a ticket be submitted to Veeva Support to configure.

Veeva QMS

In Veeva Vault QMS, several new features provide additional functionality to users if configured in the Vault.

The ability to perform and document a 5 Whys Analysis can assist in root cause analysis (RCA) of Quality Events or Complaints. Using the 5 Whys Analysis methodology, a Root Cause is identified by identifying a problem statement and iteratively asking ‘why’ the issue occurred up to five times. This is known to be a very effective RCA tool, and in 23R1 functionality has been added for this process to be completed and documented within Vault. Once the Root Cause Analysis reaches the Complete state, Root Cause records are automatically created by Vault.

Improvements are also available to the Risk Management functionality, which will allow users to enter data quickly and easily for risk events via the new Risk Builder Tool when performing PFMEA assessments. This feature makes it easy to enter multiple risks for a single risk assessment and allows for these risk items to be evaluated simultaneously.

There also are new features to automate tasks in the Vault. Configuration can be added for Vault to automatically create the associated Proposed Audit records based on the Planned Start Date and Planned End Date of the Audit Program. Vault QMS also now supports the ability for automated intake of supplier change notifications received via email within Vault. This facilitates triaging the change notification and assessing for impact while bypassing the need for manual input of the change notification details. In addition to the Vault configuration activities, some additional configuration on your email server will be required from your internal IT team.

Finally, the Recurrence Check capability in QMS can be used for custom Quality Event object types, not just the standard out-of-the-box Quality Event types. This enhancement will, once configured, allow your business to identify recurring events for all Quality Event object types.

Vault RIM

In RIM Registrations the Registration Verification workflow can now be reconfigured as a multi-record workflow as well so that multiple records can be routed on the same workflow in parallel, similar to the multi-record workflow described for Vault Platform.

In RIM Submissions, several improvements to Content Plan functionality have been made available.

• A feature can be enabled to allow users to create a Report Level Content Plan by copying from an existing Report Level Content Plan. The action copies the Content Plan, Content Plan Items, and the matched documents.
• A new field can be added on Submission, Event, and Constraint objects to allow for more granularity for excluding and creating Content Plan and Content Plan Item records as inactive based on the selected criteria.
• Also, a new Update Content Plan Study Section action is available for configuration. This action moves valid study sections related to the Submission Clinical Study or Submission Nonclinical Study within the Submission Content Plan to a new location when Clinical Study Type or Nonclinical Study Type fields are updated.

In RIM Submissions Archive a new useful feature that can be configured is the ability for Vault to display a special styling when sections are empty in the new Submissions Archive Viewer that was launched with 22R3. This will provide a visual cue to the user that Submission sections do not contain content. The functionality is also available for users to select and view inactive Applications and Submissions in the new Submissions Archive Viewer.

Learn more about Veeva from fme

These are some of the interesting new features available in the Veeva 23R1 release. Contact fme for details on additional changes that could impact your environment, and for assistance in configuring, validating, and promoting these changes to production.

About the author

Amanda Hancock is a Principal Consultant with the Life Sciences business unit at fme US. She has over 20 years of experience in the Life Science industry, working in the clinical research and diagnostics sectors. Amanda started her career in 2000 as Research Assistant at The Ohio State university and later worked in the roles of QC Analyst, Quality Assurance Manager, and Quality Assurance Director before joining fme in 2022. In addition to being a Certified Quality Auditor (ASQ), Amanda is a Veeva Vault trained professional holding Associate Administrator certifications in Veeva Vault Platform, Veeva Vault QualityDocs, Veeva Vault QMS, Veeva Vault Submissions, and Veeva Vault Submissions Archive.

One key benefit of the Veeva suite of solutions is that security and permissions are pre-configured to support the solution and highly configurable. This is great for your company from a compliance standpoint, but it can also introduce complexity that can be difficult to manage if not planned effectively from the beginning. You need to ensure that your users can access the correct data at the appropriate stage in the process, but you also need to protect and control that data to ensure that only authorized users have that access.

User access is a critical area to understand thoroughly as it impacts every area of your compliant, validated solution.  So how do you manage it? Is there an internal team who has the skill, time, and knowledge to understand each layer of the access approach? Or are you using the approach of “well, the vendor validated this, so it is probably fine…”? Over many projects, fme has developed and refined a controlled and systematic method for assessing, planning, executing, and testing your user’s data access permissions to ensure you are in control of the access to your data, and get the most of the Veeva solutions.

Let’s take a look.

Assessment: Understand your permission set requirements

The first step is to get a detailed understanding of the permissions you will need. Your administration team and process owners should evaluate your existing structure to determine if the current licensing model and security configurations are working efficiently for your company. Review the following areas to identify opportunities:

• Security Roles define the specific access allowed in the system for each user
• Permissions Sets allow granular access to data and content
• User Roles dictate the roles automatically assigned to user depending on scope (for example: Approver role for a specific department)
• Lifecyle permissions determine which User Roles have access or can perform specific functions at different points in the document/record lifecycle
• Possible integrations to automate the user profile creation and management process

As you know there is a lot to consider here! You are looking for any gaps, overlaps, or conflicts between these areas.

Planning: Define required permission sets

With a clear understanding of the existing permissions settings and requirements, you can start to build a comprehensive permission matrix detailing who needs what level of access in each area. It is important to consider which user roles require holistic data access and which users’ roles require lifecycle-state-specific access. Access should be managed to allow completion of work responsibilities while also ensuring necessary oversight of sensitive materials.

In fme’s projects, once we identify existing improvement opportunities and develop a full permission matrix, we test the configuration changes to verify the defined requirements are met. We then review the recommendations and key benefits with the team leadership to determine the path forward. We work within your change management requirements to ensure control of the overall impact to users, training materials, in-progress workflows, and existing content. We document all this information in our Implementation Plan.

At the end of your planning process, you will have a robust, methodical Implementation Plan that your company can leverage within your change control and validation processes. This plan should also have provisions in place for future change. No system is static forever, so be sure to build in a controlled revision process for additions, edits, and deletions as you continue to grow and evolve.

Implementation Phase

After the plan above is agreed upon and ready for execution, it is essential to configure and fully test the updates in the validation environment. Review your permissions matrix and ensure that every point is tested for both what is allowed and for what should not be allowed . Do approved users and roles have access, and are all others blocked? Use your documentation to plan your testing to make sure your business needs are met. If you discover any issues or required adjustments, be sure to correct the issue, retest, and add the changes to the plan in a trackable process.
We’ve seen many first-pass configurations work perfectly until ‘white-hat’ testing exposes unexpected access allowed in critical areas. In fme’s methodology, we start with clearly defined documentation of what will be maintained, updated, or eliminated based on the approved plan. We then execute rigorous testing to verify that the changes provide the desired results. The test results are then summarized, documented and approved by our client team. With these changes tested and approved in the validation environment, we then plan and execute the same process for the production Vault.

Post Implementation Phase

Other elements that are often given minimal attention include training, post-implementation monitoring, and verification. Take the time to confirm the change is adopted smoothly by the end users, and all members of the admin team understand the changes and the reasons for them. Provide written procedures to ensure that optimized settings and profile assignments continue to be utilized as planned. Any additional changes should always be documented, reviewed, and approved.

With any change within complex systems, there are always unexpected combinations of variables that provide unplanned results. Don’t assume everything will go perfectly and plan some time for real-time fire drills and critical adjustments. If you do everything perfectly and don’t need that time, super! But if you do, you’ll be thankful you have the room for it.

When we work with our customers, we agree upon a specific period of post-implementation support to address any challenges encountered with the changes in production. We also train both users and admin teams, providing detailed documentation that can be referenced at any time. Beyond the end of the current project, we maintain a consistent communication cadence, so we are available for further updates or planned changes down the road. We also recommend periodic reviews to verify that established configurations match your evolving needs, and there are no outstanding changes waiting to be made. Our customers appreciate that we document and leverage the system and process knowledge gained during our engagements to help streamline future projects .

Conclusion

Permissions and access control are basic components of any system and should always be given appropriate attention. Ensure your team has the experience to consider all situations so you don’t leave security concerns and questions unanswered. These challenges will multiply over time if not addressed. With a complete permission structure defined that meets your specific business needs, you will ensure that your users have access to the data and workflows they need to do their jobs.

If you have any questions or concerns, please reach out to fme’s team of Veeva certified configuration experts to help you with your security management. Our proven step-by-step approach will show that it’s possible to leverage the robust configurability of the Veeva solution to serve your user and compliance needs with a consistent framework that is replicable for future business scenarios.

About the author

Amanda Hancock is a Principal Consultant with the Life Sciences business unit at fme US. She has over 20 years of experience in the Life Science industry, working in the clinical research and diagnostics sectors. Amanda started her career in 2000 as Research Assistant at The Ohio State university and later worked in the roles of QC Analyst, Quality Assurance Manager, and Quality Assurance Director before joining fme in 2022. In addition to being a Certified Quality Auditor (ASQ), Amanda is a Veeva Vault trained professional holding Associate Administrator certifications in Veeva Vault Platform, Veeva Vault QualityDocs, Veeva Vault QMS, Veeva Vault Submissions, and Veeva Vault Submissions Archive.