AIIM’s CIP … soon to be extinct


It’s been 4 years since I attained AIIM’s Certified Information Professional (CIP) certification. At the time it seemed like a good idea. Below is an extract from AIIM’s “CIP Examination Objectives”

The certification is dedicated too enhancing and promoting the profession of information management by providing the premier credential in the industry.

Note the word “premier“.

Exciting News

Last week, AIIM announced an exciting development. They described how they were “consolidating” their CIP and their Master designation. (You can read the announcement here). In other words, the premier credential is going to be worthless.

The CIP was something that you qualified for, after sitting a rather rigorous exam that covered a vast range of areas within Information Management. And then, because things are continuously changing, there was the requirement to re- qualify every X years, by accumulating X continual training units.

.The Master designation that they refer to is something that one can get after doing a course (in either Enterprise Content Management (ECM), Business Process Management (BPM), or Electronic Records Management (ERM)) , pass an exam, write a case study. and that’s it. No further “keeping up-to-date”

… there is a difference in a training institute’s “certificates” and an industry “certification.”

Kevin Parker (Information Management Consultant & AIIM Trainer)

I’ve been a big supporter of AIIM. I was even an “ambassador”. I’ve written several blog posts about them, and was one of their “expert bloggers”. I saw value in the CIP. It created a “standard” (I wrote about this in an earlier post), so I was disappointed to see that it was, essentially, being killed off.

I don’t feel that the “Master” designation is quite the same as the CIP, but then, it appears that the CIP certification was not quite as popular as AIIM had anticipated. Apparently over the 4 years there were only 1000 Certified Information Professionals.

So why didn’t it work?

Lack of Interest

I can only really speak from my own perspective here. Jesse Wilkins has tried to give some explanations to the angry mob of CIP holders that gathered at his doorstep (and by “doorstep” I mean “on Twitter”), and it seems to boil down to “a lack of interest”.

it seems to boil down to “a lack of interest”

When the CIP appeared on the landscape I saw it as a great way of defining what I knew (with regards the field of Information Management), as well as creating a roadmap of other areas that I needed to explore to become a well-rounded Information Professional. (In an earlier post I referred to it as an Island). I found the idea of continual learning valuable. It was something that I did anyway, but now it was something that was being recognised.

The other professional institutions (PMI, IIBA) have done it. Their certifications are internationally recognised (and career definning), but even those started out with just a handful of certification holders.


So now that the CIP is gone. I ask “was it really necessary”. The fact that there wasn’t a great uptake shows that, maybe, it wasn’t. Information Professionals have carried on being Information Professionals, and companies have carried on hiring them based on their experience and knowledge.

Having CIP certification wasn’t really a deal-breaker. Back in 2012, before I embraced the CIP, I asked whether it would be JAC (Just Another Certification). The reason that I decided that it wasn’t was because of the reasons I described above.

A lack of a framework

Look at the PMI (Project Management Institute) certification, or the IIBA (International Institute of Business Analysis) certification. They are standards for professionals working in those fields. And having the certification does make a difference.

And these certifications are based on a BOK (Body of knowledge) that provides a framework for the way these professional perform. That’s what helped the certification to be seen as something professional. And that was something that the CIP lacked.

So what now?

That’s the question that I’m trying to answer. Some have even suggested that AIIM has no more value. I’m curious what you think? Does AIIM really make a difference?

My Earlier CIP posts







The Difference between Records Management Policies, Procedures, and Guidelines – Richard Medina Doculabs


This is a great post from Richard Medina from Doculabs. It digs into the structure and differences between the policies, procedures, and guidelines you need for an effective RM program. Click on the link below:

The Difference between Records Management Policies, Procedures, and Guidelines – Richard Medina Doculabs.




Promise #9 – The CMIS Survey Blog Post

Refer14 Unfulfilled Promises


In the post titled “Latest CMIS survey from Generis”, I promised to write a blog post over a Survey Generis had done on the adoption of CMIS.


Promise Partly Fulfilled

I followed this promise up. The post was originally published on the AIIM site.
(I will need to publish a copy of this on my own blog.

The Inaugural Conference of the Swiss ARMA Chapter

Latest CMIS survey from Generis

Last year I wrote a blog post titled “CMIS – what are the adoption plans for 2011?” in which I discussed a survey that Generis had done on CMIS adoption.

James Kelleher, the CEO and owner of Generis, has sent me an the latest version of the survey. I plan to write a blog post over this soon.



I think I underestimated what AIIM’s “Certified Information Professional” is

Recently Laurence Hart wrote a blog post about the new AIIM “Certified Information Professional” certification.

In response to this I made a comment  that I needed to be convinced that the CIP wouldn’t be just another of the many certifications that are available. (I refereed to it as JACJust Another Certification)

Laurence posted a second blog post where he discussed, further, the type of content that he encountered in the exam. This assuaged some of my concerns, but also prompted me to do something that I should have actually done in the beginning, and that is, read the CIP information that AIIM has on its site! If I had I would have seen that a lot of thought, and work, had been put into it.

As Laurence pointed out, the exam is not an easy one. I looked at the sample exam that is available, and got nervous just looking at that. The real exam has 100 questions, and is not the sort of thing that you can just do while sitting in the comfort of your own chair, while flicking back and forth between the exam, and Google. No, for this, you need to go to a Prometric test centre. The guys there are professionals, and you can expect to be under video surveillance while you do the exam.

When AIIM were putting the whole “certification” thing together, they went and asked the industry, what “stuff” was actually important to know. This was all scribbled down in a large notebook, and then scrutinized by subject matter experts. The SME’s then created the monster known as the CIP exam. Very broad, but also very deep in each of the various areas. Fortunately AIIM have made a large number of “preparatory” videos available.

AIIM also recognize that the industry is not a static thing. Technology changes, business processes change, ways of working change. As a result, if you pass the exam, it’s only valid for three years. After that, it’s necessary to either re-sit the exam, or to prove that you have attained a necessary level of continuing education credits ((in this case, 45). And what does that mean? Initially, this was something else that bothered me. “Hey, my company just paid $500 for an on-line training course. It was easy – didn’t have to do anything, and voila, I’m recertified.” No – earning continued education credits is not so easy. You earn credits by attending conferences, formal university-level courses, chapter meetings, giving presentations. And you don’t earn that many credits for each of these items. Even if you re-sat the exam after three years, AIIM will be continuously updating it reflect changes in the industry, so you can’t just “use the same answers as last time”. (For more details, check out the AIIM CIP Certification Maintenance Form)

This is what really impressed me. In the Netherlands, medical doctors need to keep up a certain level of training. Each course or conference they attend delivers them a certain number of points. To stay registered they need to attain a certain level each year. (It is most likely the same in other countries, it’s just my wife’s a doctor, and I get to hear about this all the time.) I realize that there is a world of difference between a Certified Information Professional, and a Medical Doctor, but this one factor drove home to me how serious AIIM’s CIP certification is.

Based on what I have read, I’m putting the CIP high on my list of goals for this year.
(And, even though I’ve been working in the industry now for over 13 years, I’m not going to do the exam “cold” as Laurence did. I’ll be making damn good use of those training videos.)

Relevant links:

Note – currently many of the AIIM CIP sites are unavailable. This is because AIIM is working on a new version of the CIP. (For more information,  check out the following posts)

AIIM with Pie

If you have not already heard, Laurence Hart has a new job. He’s the new CIO at AIIM.

So, what does this mean? What value will he bring to AIIM? To answer that, we really need to understand what kind of a person Laurence Hart is.

I’ve never met Laurence. I don’t really know him, but I have a certain impression of him. An impression that has been built up over the years since I first got involved with Documentum.

I discovered his blog “Word of Pie” back in 2007, when I had just moved from working with FileNet to a world of Documentum.

Pie’s writings seemed to be honest, and to the point. He didn’t write about how “great” this product was, or how “fantastic” that company was. He never sounded like he had drunk the Kool-Aid.

Laurence wasn’t afraid to discuss a company’s warts. He wasn’t nasty. He just said it like it was.  And I found that valuable. (In fact, his blog was was inspired me to start my own blog (along with Andrew Chapman’s ). However he is also the reason that I put off actually starting one, for so long. (He set a very high standard.)

Obviously I was not the only one who thought that Laurence wrote some good shit. As well as having, what must be, thousands of readers, in 2008, he was the victim of plagiarism.

I think that AIIM will benefit a lot from the addition of Laurence to their staff. (Also with addition of Cheryl McKinnon.)

I think that Laurence’s honest, and critical, way of looking at things will be interesting in an organization such as AIIM.

As I mentioned I don’t really know Laurence personally. (I screwed up a chance to meet him at a Nuxeo conference in Paris, last year, and, heck … I don’t even know the “Pie” story)

There are many, many other people who know Laurence better than I do. If you have a different perspective, or can add something to what I’ve said, please, please feel free to make a comment..

Total Regulatory Solution – a “complete” offering from CSC – Webinar 1

The other day I received an invitation from CSC to attend a series of three webinars on their “Total Regulatory Solution” offering.

The “Total Regulatory Solution” consists of three “components”:

  • Software
  • As a service offering
  • Business Process Outsourcing.

Having described CSC’s plans for this earlier (In Part 1, and Part 2 of the FirstDoc User Group posts), I was curious to see what CSC would cover.

Webinar 1

The first webinar was entitled “Flicking the Switch: Integration Drives Greater Regulatory Efficiency” and was presented by Jennifer Webstrom. 

Here are some key points from the webinar:

  • CSC’s was primarily driven by technology (that is – what is required to make sure that their products would run on the latest, and upcoming, technology platforms).
    Approximately 18 months ago they decided to change to focus more on how they can solve business problems that their customers were having.
  • They want to be the go-to company for regulatory submissions.
    Or, to quote their mission statement, they want to…

Provide end to end business solutions for processes involving the creation, review, approval, consumption & exchange of regulated and mission critical documents and content within a Life Sciences organization

  • With the recent acquisition of ISI, CSC offer tools that allow for end-to-end regulatory information management process. These include:
    • Tracker  
    • Assembly Planner
    • FirstDoc or FirstPoint
    • eCDTXPress
    • Publisher
    • Viewer
  • These applications are, currently, disparate applications, but CSC are working to integrate these tools so that they share a common data model, have the same interface, and (ultimately) will be “aware” of the other tools, in the sense that operations in one tool trigger certain “pre-emptive” actions in the other tools.
  • The integration roadmap includes the following:
    • ensure that Publisher, eCDTXpress, FirstDoc, and Viewer work together
    • release of Tracker – integrated with Viewer
    • release of Assembly Planner – integrated with Tracker

Strategy Analysis

This had to happen. Providing an application, or a collection applications, that allow users to perform specific tasks is one thing, but to have a truly integrated suite of tools that can work together, is another. Users do not want to have to “think” about what they are doing. They just want to be able to complete a task, in the most efficient way they can, without having to consider the different interfaces that they need to work with, or the different processes that they have to follow for each application they use.

By changing their focus from one of technology to one that is more on the business challenges that pharmaceuticals companies face, means that CSC can streamline the whole regulatory submission process so that there is as little “pain” as possible.

And, naturally, if they can achieve this, they do help to position themselves in the market as the “one-stop shop” that they want to be.

The other webinars

As mentioned above, there are three webinars in which CSC are describing their new “Total Regulatory Solution”. The other webinars are:

  • Data in the Sky: Finding Flexible Solutions in the Cloud
  • Clearing the Path to Innovation: Exploring Total Regulatory Outsourcing

I plan to write posts on these as well.

Reference sites

A couple of reasons for me to travel to Switzerland – ARMA & Chris Walker

On Monday morning, I’m heading to Switzerland.

The Swiss Chapter of ARMA, is having their inaugural meeting, in Basel, and a fellow tweeter of mine, Christian Walker, will be giving the key note speech there.

Because I’m “in the neighborhood”, (sort of), he suggested I come along to it.

I’m really excited…for two reasons.

This is going to be the ever first meeting of the ARMA’s Swiss Chapter!
I’m really pleased that I have the opportunity to be present during this.

The second reason is that I really, really enjoy the chance to meet some of the really smart ECM people that I tweet with. Christian is a senior consultant at Oracle in Edmonton, as well as an “expert blogger” for AIIM. I’ve be connected to Christian for over a year now, and have been involved in many Twitter discussions with him (and others) on subjects ranging from ECM through to “toilet paper” (long story…maybe I’ll cover this in a separate blog).   Needless to say – I am looking forward to meeting him in person.

(I had an excellent opportunity recently to meet up with another fellow Tweeter, Laurence Hart, in Paris, a few months ago (I was invited as a guest blogger to Nuxeoworld, where Laurence was giving the keynote speech.)
Because of various circumstances, I couldn’t make it – something I still regret).

Needless to say – I’ll be taking notes during the sessions (especially the keynote speech), and plan to write a blog post once I get back.

Related Links

FirstDoc, FirstPoint, NextDocs – a “rough notes” comparison

21 CFR 11 Compliance evaluationA reader has recently asked if I had any information on the differences between FirstDoc, FirstPoint and NextDocs.

To do a full feature-for-feature comparison of all the solutions is not something that I can easily do.  However I have been able to get my hands on some great documentation, and can put together a “rough notes” comparison of the three solutions with regards to the core system, and how each solution complies with 21 CFR Part 11.

Note – this is version 2 of this post. After publishing the initial version, one of the vendors was able to provide me with a later version of their compliance statements. The table below has been updated as well as the Comparison PDF that can be downloaded. This is marked as Version 2. The link in the references still links back to the original compliance statement.

Important Note 1:

The FDA regulation, 21 CFR Part 11, is often update and modified. The documentation that I was able to find from CSC, and NextDocs appears to have been created at different times. As a result – I found some “discrepancies” between them. Sometimes the wording in the material I had, didn’t match the current version of the regulations. However, the “intent” is still the same.

Important Note 2:

I do not claim to be an expert in 21 CFR 11. Nor do I claim to be an expert in each of the different platforms/applications described in this post. I will list my references at the bottom this, but I make 2 recommendations:

  1. 21 CFR Part 11 can be interpreted in slightly different ways. Discuss with your internal QAV people what the expectations are.
  2. Make contact with the vendors in question to really determine whether their application fits your requirements.

21 CFR Part 11

To get read what is specifically contained in 21 CFR Part 11, click on this link. This will open the FDA’s “CFR – Code of Federal Regulations Title 21” site.

Product Comparison

Below I have listed each vendors response to each of the regulations outlined in 21 CFR 11.

This was compiled using information that can be found on the Internet. (I include reference links at the bottom of this post, as well as in the PDF.)

However, as mentioned – this is intended merely as a guideline. I encourage you to contact each of the vendors directly to get an updated statements of compliance, as well as information on server configuration/sizing & prerequisite software.

(Note to vendors – if you feel that there are errors, please let me know in the comments, and I will make the necessary corrections).

You can also click HERE to download a PDF version.

FirstDoc, SPX, FirstPoint & NextDocs

Subpart B – Electronic Records

21 CRFR 11 Requirement FirstDoc FirstPoint NextDocs
(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. FirstDocis developedin accordance with the CSC LSQMSadvantage™, an ISO 9001:2000 certified Quality Management System.QMSadvantage and FirstDochave been audited by many pharmaceutical clients. As part of a formal vendor audit, CSC canprovide evidence that FirstDoc is developed and testedin accordance with QMSadvantage.FirstDoc has been validated by many clients. CSC offers a validation package (consisting of validation plan, traceability matrix, and IQ/OQ/PQ protocol templates and OQ protocols) with each release of the FDRD, FDQ&M, and FDTMF products. FirstPoint is developed in accordance with the CSC LS QMSadvantage™, an ISO 9001:2000 certified Quality Management System. QMSadvantage™ has been audited by many pharmaceutical clients. As part of a formal vendor audit, CSC can provide evidence that FirstPoint is developed and tested in accordance with QMSadvantage™.FirstPoint is “validation ready” for its clients upon completion of installation and configuration. Full IQ, OQ validation scripts, a PQ template and supporting services available from CSC for interested clients. Validation is ultimatelythe responsibility of the client as validation can only be performed in the environment in which the softwarewill be used, and against specifications defined by system users.NextDocs offers a validation toolkit to streamline the validation process.The toolkit includes a sample validation master plan and traceability matrix, ready-to-run scripts for IQ and OQ, summary report templates, and sample PQ scripts.NextDocs also has standard professional services packages that include assistance with validation planning, PQ script preparation, and managing PQ script execution and documentation activities.
(b) The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records. Documentum will satisfy this requirement in conjunction with a company’s records management policy. Features of Documentum that support generation of accurate and complete copies in human readable form include the generation of PDF renditions and the ability to view and print these renditions in accordance with a system’s defined security rules.Additional support for this requirement is provided by FirstDoc’s automatic PDF rendition generation feature. Each time the content of a document is modified and the modifications checked in, FirstDoc generates a PDF rendition from an approved rendition generation station if the format supports transformation to PDF. Automatic transformation to PDF ensures that all documents will be readable in the foreseeable future. FirstPoint satisfies thisrequirement by managingaccurate and complete copies of files in human readable form with the tight integration with the Microsoft Office Suite of products andthe generation of PDF renditions and the system generated and maintained metadata. The system also provides human readable audit trails and reports. The ability to view and print these files and associated metadatais managedin accordance with a system’s defined security rules.All relevant recordsare maintained in their native file format within a robust MS SQL database and MS SharePoint environment. FirstPoint generates a PDF rendition from an approved rendition generation station, if the format supports transformation to PDF. Automatic transformation to PDF ensures that all documents will be readable into the foreseeable future. Actual generation of records is a client responsibility. NextDocs facilitates generating copies of records by:

  • Viewing records in native electronic format with any computer running one of several supported browsers.
  • Allowing records to be exported by dragging and dropping to any desired file system location
  • Providing sophisticated controlled, uncontrolled and clean copy printing capabilities


(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period.
  • Documents may be retained in the system throughout their retention period, or an archiving process developed to store them outside the system. Documentum’s built-in archiving capability can be used to migrate content offline while maintaining metadata in the docbase.
  • FirstDoc uses Documentum’s robust security, which limits the capability for modifying and deleting records to designated users. FirstDoc automatically applies security to Approved documents that prevents them from being deleted or modified.
  • The FirstDoc product also includes an optional Records Management module which implements retention policies and allows deletion of records which have reached the end of their retention periods in accordance with a standard process.
Documentsmay be retained in the system throughout their retention periodthrough the use of a built-inlifecycle management system.FirstPoint applies robust security across the entirelifecycle, which prevents and limits approved or historical records from being deleted or modified except by specifically designated users. A document restore feature is available to the system administrator that allows for the retrieval of deleted records.All FirstPoint content is retained for retrieval until some business rule criteria has been meet to trigger the destruction. Records retention fun includes the ability to purge specific cycles of minor or major versions at the Library Level and purge working comments and draft comments after a specified retention period.  NextDocs systems automatically “lock down” official versions of documents so that they cannot be deleted or modified without following system configurable change control procedures.
(d) Limiting system access to authorized individuals.
  • The underlying Documentum application implements a secure username and encrypted password (generally the network password) to limit access to authorized individuals.
  • FirstDoc augments Documentum security by providing automatic application of a client’s defined security scheme. Users cannot modify security outside of the rules defined by the client.
  • FirstPoint provides a secure username and encrypted password for all users in addition to the network access/password system.
  • FirstPoint augments the SharePoint basic Library level security by allowing permission sets to be applied based on any metadata in the system. This allows for content to have a more granular security model based on role, site, project, product etc, and allows for confidential documents to have a restricted access permission set.
  • FirstPoint also provides application level rights to system and business administration function such as setting up workflow and other business rules templates.
In general, an SOP is needed to define the roles and responsibilities for the administration and maintenance of the groups and users for the system and/or network permissions. Access to NextDocscan be controlled by configuration. Securitycan be configured to use Active Directory or Active Directory Lightweight Directory Services accounts or accounts created within SharePoint. Internal users with on-premises deploymentscan access NextDocs applications through single sign-on without requiringadditional system login unless performing a signature related action in the system.Alternatively, if a client’s Part 11 interpretation requires explicit sign-onto access the system, single sign-oncan be disabled. Internal users with hosted deployments access NextDocs applications by providing a user name and password.External users access NextDocs applications by providing a user name and password. Depending on a client’s security set-up, Virtual Private Network (VPN) access may be required as well.
(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.
  • FirstDoc uses the Documentum audit trail capability augmented by audit trail entries produced for custom FirstDoc events. Example events include checkin, save, destroy, status change and user acknowledgements, such as review and approval outcome — including electronic signature. Since the audit trail must be maintained for the life of the record, Documentum’s Purge Audit Trail capability should not be used unless the audit trail has been migrated offline as controlled by a client’s SOP. Note: This assumes that the approved record is the electronic record. Audit trail entries for draft, minor versions of records can be deleted using the FirstDoc purge minor version functionality if the clients’ policies dictate.
  • FirstDoc provides thecapability for authorized users to change document metadata on approved records. In this case, an audit trail entry captures the previously recorded values so they are not obscured.
    • SharePoint records all events that occur on documents, the time and date of the and the username of individual (or system account) performing the action.
    • FirstPoint also provides a preconfigured, system generated audit trail report for each document that records the date/time of all critical events that occur during the entire of the document or record from creation, review and approval.
      The username of the individual (or system account) who invoked each action during the history of the document is also shown in the audit trail report.
      Information pertaining to previous document will continue to be displayed in the audit trail report, even as new versions of the document are created.
    • The audit trail report is presented as a single viewable and printable file.
    • The audit trail report is systematically generated, and cannot be overwritten or otherwise modified by any user.
NextDocs records:

  • Record modification events including check-in and check-out.
  • Move, copy, delete and undelete events.
  • Electronic/Digital Signature events.
  • Lifecycle promotions and demotions
  • Workflow events
  • Permission changes
  • Record viewing (configurable).

Audit trail entries include event, user name and server-based time/date stamp. Local time/date stamps can also be configured if desired.

Audit trail records are retained indefinitely unless manually purged from the system.

NextDocs also provides access to and copying of the audit trail. The audit trail can be saved to Excel with a single click for advanced sorting, filtering and analysis.

(f) Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate. These checksare implemented within a number of system functions. They include client-defined control over:

  1. Enforcing the use of approved templates only in creating documents
  2. Limiting property values to predefined dictionary lists wherever possible
  3. Requiring entry of mandatory attributes
  4. Enforcing storage in a pre-defined hierarchy (cabinet/folder structure)
  5. Enforcing a defined document lifecycle and approval process
  6. Ensuring that all required electronic signatures are obtained (if electronic signatures are used)
These checks areimplemented within a number of system functions. They include client control over:

  • The use of approved templates in creating documents/records.
  • Predefined metadata dictionary lists which structure dependent valid choices.
  • Enforcement of mandatory metadata fields where required.
  • Enforcing a defined document lifecycle requiring a specific, defined review and approval process via document workflow
  • Enforcing the review and approval of the PDF rendition of the document, since that is generally considered to be the approved electronic record
  • Ensuring that all required electronic signatures or electronic approvals are obtained using systematic participant selection and voting rules.


These checksare implemented ina number of areas. Some examples include:

  • Ensuring that documents follow a defined lifecycle
  • Ensuring that workflows are used when needed to move a document through its lifecycle
  • Ensuring that documents are properly set up to display digital signatures before they can be signed
  • Ensuring that all required signatures are collected before a document is approved
  • Ensuring that documents meet requirements such as having a valid PDF rendition before becoming approved or effective
  • Ensuring that all required metadata is entered for a document
  • Enforcing the use of approved templates for authoring
  • Limiting pick lists to appropriate values when creating or modifying document properties
(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. These checksare implemented within a number of system functions. They include client-defined control over authorization for:

  • Document creation
  • Document access (delete, write, read, etc.) (via ACL security)
  • Changing status
  • Initiating and participating in the review and approval process
  • Signing documents (if electronic signatures are used)
  • Establishing document relations including change request relationships
  • Performing various types of business administration functions including dictionary maintenance, training record control, etc.
A series of authority checksare implemented within system functions. They include the following client defined controls:

  • Network access with unique ID and password controlled at the operating system level.
  • The SharePoint permission model controls document security at the Library (a collection of documents) and for draft versus approved documents.
  • FirstPoint enhances this security model which allows additional security layers to be implemented based on document metadata. This is useful for documents required restricted, confidential controls.
  • Documents that are part of a workflow process receive enhanced security in that only those selected participants have access to the in progress document.
  • System configuration, maintenance and other types of business administration functions are accessed only by those individuals with specific access rights.


These checksare implemented ina number of areas. Some examples include limiting the following to authorized users:

  • Modifying a document’s content or properties
  • Initiating or participating in workflows
  • Applying digital/electronic signatures
  • Modifying system configurations
  • Generating controlled or uncontrolled copy prints
  • Modifying essential information, such as study investigators
  • Approving requests for system access
(h) Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction. This requirement in general does not apply to FirstDoc since the system does not have any functionality where information is valid only when entered from specific terminals. If a specific client has this requirement, CSC will address the requirement for that client. This requirement in general does FirstPoint since the system does not have any functionality where information is valid only when entered only from specific terminals. If a specific client has this requirement, CSC will address the requirement for that client. This requirement does not apply to NextDocs since the system does not have any functionality where information is valid only when entered from specific terminals.
(i) Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks.
  • CSC maintains resumes and training records on all team members.
  • CSC provides training to key client team members including business users, business administrators, and system administrators.
  • Upon request, CSC can provide developer training to non-CSC developers employed by the client.
  • CSC maintains resumes and training records for all its team members.
  • CSC will also help generate training records to track any training it provides to the client’s personnel.
NextDocs maintains resumes and training records s to provide evidence that our employees who develop and deploy our software are trained and qualified to do so.NextDocs also provides client-specific training documentation to help our clients comply with this requirement. We also offer end user training, train-the-trainer training and administrator training.
(j) The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification. N/A This requirement is not applicable at a system level but requires a procedure to be implemented by the client. Client responsibility
(k) Use ofappropriate controls over systems documentation including:(1) Adequate controls overthe distribution of, access to, and use of documentation for system operation and maintenance.(2) Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation. Electronic audit trail for the appropriate document types must be enabled if documentation is maintained in electronic format.
  • CSC will provide the client copies or access to system documentation corresponding to the licensing agreement and version of the product.
  • CSC maintains a strict version and change control methodology for its product, product related documentation and training materials.


NextDocs’s documentationis maintained in our configuration management system and available for review during audits.However, ultimately it is the client’s responsibility to control system documentation in their environment.NextDocs’ release notes describe the names and versions of documentation that apply to each product release. In addition, each client receives documentation specific to their NextDocs implementation.
§ 11.30 Controls for Open Systems. Same as § 11.10 plus document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.
  • If the system is judged to be an open system, it would require encryption and digital signature standards. This is not part of FirstDoc and can be contracted as an option if needed.
CSC believes the FirstPoint products are a closed system so section 11.30 is not applicable. NextDocs systems that are hosted may be considered open based on the specific circumstances and the client’s 21 CFR Part 11 interpretation. The use of digital signature is available in all NextDocs products to fulfill the additional requirements imposed on open systems.

Subpart B – Electronic Records

21 CFR 11 Regulation FirstDoc FirstPoint NextDocs
Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.
  • Signature information is stored as document properties.
  • Signature information is also displayed as non-editable properties on the Properties screen.
  • • Signaturesare removed when a documentis edited, copied, or otherwise modified.
    • Electronic signatures can only be applied to a document\record through the administrator-configured workflow process and the proper execution of approval rules.
    • The signature page is fused to the PDF rendition of the document and cannot be excised from the document.
    • Signature information is also retained as non-editable data in the database and is displayed in the document’s audit trail report.
    • When a document is revised or copied, the signature page is removed from the new version of the document.
Signatures are bound directly to a specific version of a document.NextDocs digital signaturesare based on Public Key Infrastructure (PKI) and are a result of a cryptographic operation that guarantees signer authenticity, data integrity and non-repudiation of signed documents. The digital signature cannot be copied, tampered or altered.Digital signatures appearing in a document automatically appear as invalid when the document changes in any way.During change control the signature is removed for the draft version in anticipation of future approval and signing.

Subpart C – Electronic Signatures
§ 11.100 General requirements.

21 CFR 11 Regulation FirstDoc FirstPoint NextDocs
(a) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.
  • The client will need an SOP on establishing and maintaining user profiles as applied to the assigning of a unique ID code/password combination to only one individual and maintaining a list of user profile information in perpetuity.
  • Documentum can assist with this via the ability to disable (rather than delete) users who are removed from the system. By leaving the users in the system, but disabling them, re-use of their user IDs will not be possible.
  • The network operating system ensures a unique userid which is used to execute the electronic signature.
    FirstPoint allows the administrator to lockout or disable accounts, as well as delete users from the system.
Since NextDocs is generally implemented such that user credentialsare supplied via Active Directory (or Active Directory Lightweight Directory Services), complianceis built in.Active Directory willensure that a user name cannot be re-used within a given domain, andprovide the ability to disable (rather thandelete) users whoare removed from the system. By maintaining a record ofprevious users, reuse of user IDswill not be possible.NextDocs signatures authenticate the content of documents by attributing the signer to the signed document. Every signer is identified by an issued certificate (or by that of an external trusted entity). This identification is based on the fact that the user is a recognized employee in the organization.
(b) Before an organization establishes, assigns, certifies, or otherwise sanctions an individual’s electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual. The client will need SOPs on establishing and maintaining user profiles as applied to the verification of a user identity. This requirement needs to be met with a client’s business processes. CSC can help establish work instructions or training procedures to assist with the on-boarding process Client Responsibility
(c) Persons using electronic signatures shall,prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997,are intendedto be the legally bindingequivalent of traditional handwritten signatures.

  1. The certification shall be submitted in paper form and signed with a traditional handwritten signature, to the Office of Regional Operations (HFC-100), 5600 Fishers Lane, Rockville, MD 20857.
  2. . Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer’s handwritten signature.


  • The client will need to submit a letter to the FDA certifying that they consider electronic signatures are the legally binding equivalent to handwritten signatures.
  • The client will need SOPs on establishing and maintaining user profiles showing that a given individual accepts that the electronic signature is the legally binding equivalent of handwritten signatures.
  • This requirement needs to be met with a client’s business processes.
Client Responsibility

Subpart C – Electronic Signatures
11.200 Electronic signature components and controls.

21 CFR 11 Regulation FirstDoc FirstPoint NextDocs
(a) Electronic signatures that are not based upon biometricsshall:(1) Employ at least two distinct identification components such as an identification code and password.(i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual.(ii) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components.

(2) Be used only by their genuine owners; and

(3) Be administered and executed to ensure that attempted use of an individual’s electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals.

NoteContact CSC directly for their comments on how FirstDoc meets this regulation.  FirstPoint incorporates the user’s network account and password for general access to the system, which is also used for electronic signature approval. FirstPoint requires the re-entry of both identification components (user ID and password) each time an electronic signature is executed.. Each time a signature is applied, both a user name and password are required.NextDocs supports a configurable automatic time-out during periods of system inactivity. This time-out will also end a user’s continuous and controlled access to the system.
  • (b) Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.
FirstDoc can support the use of biometric solutions through customizations. Customizations for biometrics are not in the scope of this document. FirstPoint can support the  use of biometric solutions through customizations. Customizations for biometrics are not in the scope of this document. NA – Biometrics are not used by NextDocs.

Subpart C – Electronic Signatures
Persons who use electronic signatures based upon the use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include:

21 CFR 11 Regulation




(a) Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password.
  • Documentum and Unix/Windows Server will provide most of this functionality. See Item § 11.10 (a).
  • The client will need an SOP on establishing and maintaining user profiles.
  • The client’s network user authentication methodology provides this functionality.
See item § 11.100 (a).
(b) Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging).
  • Both Trusted Unix and Windows Server can be used to require periodic aging of passwords.
  • The client will need an SOP on establishing and maintaining user profiles.
  • The client’s network user authentication and password encryption methodology provides this function
This is a client responsibility, generally achieved through settings in Active Directory. Windows and Active Directory infrastructure can enforce password policy for complexity and expiration. Windows integrated authentication and Basic authentication can leverage this automatically.
(c) Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.
  • The client will need an SOP covering loss management for passwords.
  • If devices are used, the client must have an SOP covering loss management.
  • NA
NextDocs does not make use of tokens, cards, and other devices that bear or generate identification code or password information.Windows and Active Directory administrators can deactivate users, change users’ passwords, or require users to change passwords after issuing a temporary password. Windows integrated authentication and Basic authentication can leverage this automatically
(d) Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.
  • Both Trusted Unix and Windows Server can be used to disable user accounts after a configurable number of unsuccessful attempts.
  • The client will need an SOP containing the procedure for reactivating accounts.
  • The client’s network user authentication methodology provides this functionality.
  • Windows can disable user accounts after a configurable number of unsuccessful attempt
This is a client responsibility, generally achieved through settings in Active Directory.The Microsoft Windows family of products can audit logon changes and failed attempts. Group policy can enforce account lockout policy to help to prevent brute force password guessing. Lockout policy is based on failed attempts for a time window and users can be locked out for specified times before they can attempt again (or not).
(e) Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.
  • If such devices are used, the client must have such a policy in place.
  • NA
NextDocs does not make use of tokens, cards, and other devices that bear or generate identification code or password information.

Audit Trail Functionality

Audit Trails is an included feature in FirstDoc. Documentum has its own audit trail capabilities, with FirstDoc adding on to Documentum’s audit trail system. Table 3 discusses the Audit Trails functionality that FirstDoc provides in support of 21 CFR Part 11.

Subpart C – Electronic Signatures
§ 11.10(E),(K)(2) AUDIT TRAIL

21 CFR 11 Regulation FirstDoc FirstPoint NextDocs
(a) Use of secure, computergenerated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.
  • • FirstDoc uses the Documentum audit trail capability augmented by audit trail entries produced for custom FirstDoc events. Example events include check-in, save, destroy, status change and user acknowledgements, such as review and approval outcome — including electronic signature.
  • • Since the audit trail must be maintained for the life of the record, Documentum’s Purge Audit Trail capability should not be used unless the audit trail has been migrated offline as controlled by a client’s SOP. Note: This assumes that the approved record is the electronic record. Audit trail entries for draft, minor versions of records can be deleted using the FirstDoc purge minor version functionality if the clients’ policies dictate.
  • • FirstDoc provides the capability for authorized users to change document metadata on approved records. In this case, an audit trail entry captures the previously recorded values so they are not obscured.
(b) Use of appropriate controls over systems documentation including: 1. Adequate controls over the distribution of, access to and use of documentation for system operation and maintenance. 2. Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.
  • • Electronic audit trail for the appropriate document types must be enabled if documentation is maintained in electronic format.


How does FirstDoc “do” 21 CFR Part 11 compliance?


CSC have published (not recently) a whitepaper about the capabilities that FirstDoc products provide for compliance with the FDA’s ruling on Electronic Records and Electronic Signatures (fondly known in the Pharma industry as “21 CFR Part 11”).

The whitepaper is a good one. It starts off with a recap of what is contained in 21 CFR Part 11, and then does an itemised breakdown of the capabilities that the FirstDoc products have to meet the compliance requirements.

You can download it here.

21 CFR Part 11 Compliance Position for FirstDoc Applications

Related Post: FirstDoc, FirstPoint, NextDocs – a “rough notes” comparison

Working with Global Teams: Date Formats


Image via Wikipedia

This is part of the Working with Global Teams series


Previous Post: Working with Global Teams: Pesky Time Zones

OK, I’m going to give you a date, and I want you, without thinking about it, to tell me when it is.


Did you choose the 7th day of the 11th month of 2007? Or did you choose the 11th day of the 7th month of 2007? Or even the 7th day of June 2011?

All three are valid.

I’m sure whatever you choose was based on what is normal where you live. And that’s great when communicating with other people within that area (city, county, country).

But when you working beyond the extend of that area, as part of a global group for example, then you need to be aware of the date formats.

For example, if someone in Japan was asked to do something by 11/10/12, then they would aim at the 12th day of October 2011. While someone in North America would know that, obviously, the date is November 10, 2012.

Real life example – my car was broken into when I was in the United States. The police officer who arrived, asked me for my date of birth. I told him 17-11-73 (17th day of November 1973 – and not my real date of birth). You’d think that, obviously, there is no 17th month, that he would be able to work out what I meant. However, he was so used to MM-DD-YYY that he had to stop and think about it.

While it’s easy to rant and rave about how stupid this is, the fact is that different date formats are one of the things that comes with working with a global team.

ISO 8601 suggests using YYYY-MM-DD (similar to what our Japanese friend in the example would use). I think that this is a brilliant idea, and gives a clear standard. Also it allows a list of dates (in a spreadsheet or similar) to be easily put in order.)

However, I know that unless you were used to it, even this would cause frustration, and possible errors (until it became second nature).

When communicating with people in other parts of the world, using e-mail, fax, or carrier pigeon, I recommend using a  long date form. Something like “10 January 2013”, or “January 10, 2012”. Sure – even there, there are differences in the way that it is written, but at least you know what the month is, you can see what the year is, and (hopefully) you can work out that the rest is the day.

This would certainly prevent issues and miscommunication regarding dates.

For some interesting reading on this subject , check out the following:

SPX Series – A little bit of history

This is part of the SPX Series

Previous post: SPX Series – SharePoint eXperience – (aka SPX) – Series Introduction

First off – I want to explain that I am, in no shape or form, an SPX “expert”. I’m just a guy who has been using SPX since it was first released. I’m not a coder, so can’t tell you all the cool ways that the web parts can be tweaked, or made to dance. I am able to share with you some of the “lessons learned”, and tips . that I have picked up over time. Some of what I write might be incorrect. Please feel free to let me know if that is the case.

And, where possible, if there are other resources that explain something better than I can, I’ll point you to it.

So without further delay I will launch into today’s SPX post…”A little bit of history“.


In 2007 Microsoft introduced SharePoint 2007.

As well as providing the ability to store content in its own repositories (doclibs, lists), it also provided web sites that could be populated with web parts that allowed users to interact with internal content (lists and SharePoint repositories), as well as external content. This included other LOB enterprise systems (such as SAP, Siebel, etc). There was no native way to connect SharePoint and Documentum though.


A company called Wingspan had also developed technology that provided Web Services connectivity to Documentum.  This consists of the Docway Server, and Docway “Portlets”, (and for SharePoint – Webparts), and allowed for single sign-on,  cross-docbase browsing, as well as the ability for users to access, create & update content from a Portal.


CSC’s FirstDoc, provides a layer that sits on top of Documentum, and allows for compliance with many of the Pharmaceutical regulatory requirements imposed by the various regulatory authorities (FDA, EMA,  MHRA, etc.)

Using Wingspans technology, CSC (or, at the time, FCG), were able to create special webparts that allowed users to interact with their FirstDoc system from a SharePoint Portal. These offered about 85% percent of the functionality provided by the native FirstDoc application.


The first version was released in the 2nd half of 2007, and had the moniker “version 4.3“. This was to keep the version inline with the (then current) version of FirstDoc. It was compatiable with version 5.3 of Documentum.

There were 17 webparts available. These included webparts for browsing cabinets, listing the logged-on users checked-out documents, displaying the Home Cabinet, an inbox webpart, an very handy object-view webpart that could be configured to display one particular folder, or cabinet), an also handy query-view webpart that allowed content to be displayed based on a query, as well as an assortment of other functional webparts, and administration webparts.

Each web part offered a user the ability to further interact with an object via a context menu that showed extra functionality depending on the type of object that was clicked upon.

This first version was an excellent step towards greater flexibility in creating interfaces for users that better matched their daily work style. For the 80% of users who rarely log into FirstDoc, it provided a quick and easy way to get to specific documents. Links to specific documents could be sent via e-mail, and when a user clicked on it, the document would automatically be opened, without having to go through a process of logging into a client and searching for a document.

But there were also several shortcomings. There was the 20% of hard-core users that quickly discovered that there was still a lot of functionality that was not available. Also the SPX interface did not offer the same flexibility that WebTop did. You couldn’t easily change the columns that you wanted displayed, the search functionality when compared to the WebTop search was very limited, and the way of interacting with the documents was different. The context menu was not found in WebTop.  Performance was also a bit sluggish especially when using the webparts over a WAN.

To be fair, CSC were also restrained by the limitations of the underlying Docway technology.
(However, Wingspan have been making continual improvements to their technology and CSC have been able to take advantage of this).


CSC listened to the concerns that the hard core users (as well as the administrators) were having. Version 5.0 of SPX was released in the middle of 2008, with Product Alias Search functionality, the ability to limit search results, and also the ability to add multiple documents to a workflow. Version 5.0 was also compatible with Documentum 6.0


Then later that year, version 6.0 was released. This was based on Documentum 6.5, and an upgraded version of Docway(6.1). It had been designed to be backwards compatible (with configuration, it could work with version 4.3 of FirstDoc). This allowed SPX to work over multiple docbases of different versions. As well as this, the Inbox and Query webparts were tweaked so that values could be automatically passed on the URL. Menu selection was made configurable. A quicklink capability was added that allows a link to be configured that will launch FirstDoc functionality, and the ability to View Relationships, and Audit Trail reports was added.


Then, in the later part of 2009, version 6.1 was released with even more functionality – Virtual Documents could now be viewed, multiple files could be imported, a new :”My Views” webpart was available, as well as the ability to view the Workflow Status report. Importing related documents was now, also possible. A version 6.1.1. was also released but this was a correction to a limitation that was previously believed to be uncorrectable.


In 2010, version 6.2 and 6.2.1 were released. The only difference was that 6.2.1 was certified for use with SharePoint 2010. Both versions also used Docway 7.0.  And there was a bundle of new features and functionality. These included: the ability to register interest, the availability of the WebTop Search app as a webpart, a single-box search (“Google-like”), Saved Searches, the ability to display custom properties in the web parts, clipboard tools, subscription notifications, as well as other functionality.


CSC are working on the next release of  SPX, and it looks like they’ll be adding even more functionality to close the gap between SPX and WebTop.

FirstDoc doesn’t have its own client application – it extends the functionality of the EMC Documentum native client – “WebTop”. EMC has announced that they will be phasing out this out sometime soon.  As a result CSC are dedicated to ensuring that SPX is ready to be a replacement.

So – that’s the end of my “A little bit of history” post. If have made mistakes anywhere, please feel free to let me know.

AIIM’s CMIS Product Guide!!!


Wow – call me Happy and knock me to the ground.

AIIM have just released their standards based Product Guide focused on CMIS. Being an AIIM Professional Member I was quick to download a copy.

For those of you unfamiliar with CMIS (Content Management Interoperable Services), one of my earlier posts “Small Brain Notes on CMIS” explains it more in detail.

About 9 months ago I started writing a blog post that would give an overview on the CMIS market at that stage. A lot of Vendors had recognised the real benefit of CMIS and were all making plans to implement it one way, or another.

My post did have some promise. (Click here if you’d like to view it in it’s unfinished glory). However I was not happy with the incompleteness of it, and decided, at the stage not to publish it.

The AIIM document is not comprehensive (which AIIM states clearly in the Introduction). It covers 13 vendors, and describes the CMIS enabled product of each of them along with more detailed information on the use of the product as well as (where possible) the CMIS capability support of the product.

Products covered in AIIM’s Report:

  • Alfresco Web Quick Start
  • Alfresco Activiti
  • CMIS Export for Kodak Capture
  • Content View
  • Documentum Content Management Interoperable Service
  • Fresh Docs
  • IBM Connections 3.0.1
  • IBM Content Manager Enterprise Edition 8.4.3
  • IBM FileNet Content Manager 5.0
  • IBM Lotus Quickr 8.5
  •  Nuxeo Document Management
  • Open Text ECM Suite 1.0
  • SharePoint 2010
  • WeWebU Open Workdesk

The authors hope that later versions of the guide will contain more vendors.

In the start of the Guide there is a very good introduction, and an article by David Choy (chair, OASIS CMIS Technical Committee). David Choy has also recorded a brilliant video, awhile ago, in which he explains CMIS. This was a great tool when I was trying to understand what CMIS was all about. (You can view the video here.)

After the vendor review, there are a couple of articles by Laurance Hart (@piewords) and Stephan Waldhauser (@WeWebU).

Following the articles, there is an excellent list of CMIS Resources, which I am going to look through when I get some time.

Taking into account that (at AIIM’s own admission) the Guide is not comprehensive, it is still a very handy document to give a better understanding of the CMIS landscape.

My only criticism is: Guys – when you are creating a PDF – do it properly. Get each section properly bookmarked, as well as the TOC hyperlinked to the corresponding page. It’s not hard to do; it makes the Guide a lot more usable (when viewing on screen).

Click on CMIS for my other CMIS posts.

CMIS is here … but where?

Note – this post is in a draft format. It was written in June 2010 and was never published. The information in this post is not complete.
I have released it now as part of my AIIM CMIS Product Guide post.

CMIS 1.0 was ratified in the beginning of May 2010. This is the standard that will allow interoperability between the various content management systems that are currently on the market. For more information on CMIS, refer my Small Brain Notes on CMIS. Go and read it now, and when you are finished, click on the back button. I’ll be waiting…

Ok – now that you understand a bit of what CMIS will offer, let’s ask the question – when will it be available in these disparate content electronic content management systems?

Let’s look at the list of companies that were associated with the creation on CMIS 1.0

And…who is ready for CMIS?


These three  were there in the beginning, and developed the initial draft.


The following companies also played a part in the moulding and shaping of the CMIS standard:

  • Alfresco – Version 3.3 (available now)
  • Open Text,
  • Oracle,
  • SAP

Others Adapting their systems to be CMIS compliant:

  • ASG Software Solutions
  • Content Technologies ApS
  • Day Software
  • Ektron
  • Exalead, Inc.
  • FatWire
  • Flatiron Solutions Corporation
  • Greenbytes GmbH
  • Harris Corporation
  • Nuxeo
  • Saperion AG
  • Sun Microsystems
  • Vignette Corporatio

Here is a list of the vendors with regards CMIS compliance.

Vendor Product CMIS Support Timeline
Alfresco Alfresco 3.2 Available for testing
EMC Documentum First half of 2010
IBM Content Manager Second First half of 2010
IBM FileNet P8 Second First half of 2010
KnowledgeTree KnowledgeTree 3.7 Available for testing
Microsoft SharePoint Server 2010 First half of 2010
Nuxeo Nuxeo DMS 5.3 Available for testing
Open Text Enterprise Library Services (ELS-Beta) CMIS connector available now
Open Text Open Text ECM 10 Mid 2010
Oracle Oracle Universal Content Management Not known
SAP SAP DMS Not known
Sense/Net Sense/Net 6.0 Available for testing

Social Media and Pharma Industry, a Paradoxical Oxymoron?

The following is an article that was originally posted on PharmaIQ.

The author is Cristina Falcão.


The world’s most highly regulated industry seems doomed to “forward retreat” tiptoeing into social media. Why? The reason lies on social media’s gist – user generated content (UGC) is the raison d’être but also the main drawback, since the lack of rules on the accuracy of online content (written by the users of websites such as Facebook, Twitter and LinkedIn) makes pharma accountable.

Effective guidance, equally issued by the EU and US drug agencies, is urgently needed, before pharma companies can use social media’s valuable contribution in areas such as pharma-vigilance, clinical trials, R&D, and employee- recruitment.

What is the current guidance situation?

Unlike in the US, the European Directive 2001/83 (Community Code) forbids public advertising of “prescription-only medicines”. On the other hand, EU offers little specific guidance on social media (apart from some EFPIA -guidelines on websites, and the PMCPA’s (UK) “Brief guideline on blogs”), and waits for the US approach; however, FDA rules on pharma, internet and social media, which draft was due at the end of 2010, still have not been issued.

Major concerns

Pharma companies are responsible for the contents of a sponsored website (sponsorship can simply be advertising); yet, it is virtually impossible for the industry to control a website’s UGC without undermining the dynamic nature of social media. Adverse events reporting (AER) is a nightmare: the law states pharma companies must report all those events to the respective regulatory agencies, where they are stored in databases to monitor drug safety. It is impossible for the industry to monitor all AER’s, and marketers fear that user-generated content will include complaints about their drugs’ side effects; what makes it even worse, is the fact that FDA’s databases are regularly searched by lawyers for potential class-action suits.

Nevertheless, there are many pharma companies using Facebook, Twitter, YouTube and other social media tools; the only way out, is to monitor activity on any social media platform where they are present, using disclaimers, reserving the right to remove unwanted comments and redirecting drug questions to the company’s website.

Clinical trials

Patient-recruiting for clinical trials through social media, grants decreased R&D costs to the industry. However, clinical trials have several types, designs, and sample groups; social media, alone, is not the universal source. It can prove to be a double-edge sword, if patients interact and exchange information before the whole trial is completed; also it does not ensure evaluable data in the end. Patient- recruiting outside the physician’s own pool of patients has high dropout rates; tweeting about a clinical trial may build awareness of the opportunity, but does not guarantee an engaged PI, who will lead the patient through the clinical trial, thus assuring collection of meaningful data.

Although ‘social media’ is the overhyped buzzword of our time, for pharmaceuticals it will be a treacherous route: regulations will undoubtedly limit (further) interaction with the public, but increase accountability – it not being worth the effort or risk.

All we know for sure is that the debate has only started.


Click on this image for the original post



Related Posts:

The Fast and the Furious – SCRUM

One thing I used to hate was working on Projects that had no “definition”. They were usually just a case of stumbling along, hoping that everything was going according to plan (not that there ever was a “plan”). And then working madly at the end to get something that was close to what a sales person had promised a client.

Then, over the last 5 years I have learnt a more methodical way of carrying out a project. A way that ensured that the project was well defined, had suitable requirements,  had appropriate milestones against which the progress of the project could be measured. This methodical way ensured that the correct documentation was created at the correct time, and followed a suitable life-cycle. Very much based on the PRINCE2 methodology.

And I liked this way of doing a project. It had structure. And is still very relevant and appropriate to many situations.

Recently I have become more aware of the SCRUM methodology. Originally I thought it was to do with the sport Rugby, and since I was brought up to worship the All Blacks (part and parcel of the culture I grew up in) I was surprised that SCRUM, in this case, had nothing to do with men in rugby jerseys fighting over possession of an oval ball.


No – SCRUM, it transpired, is a “different” way of doing a project. The more I read about it, the more I thought “hey – this makes sense!” SCRUM also has a set of practices, and a set of predefined roles. Whereas PRINCE2 has it’s Executive, Key Customer & Key IT board members and a Project Manager, SCRUM has its SCRUMMaster, Product Owner and Team. However the difference is that, while PRINCE2 is a process-driven project management method, SCRUM is reactive/adaptive method.

This is highlighted by the fact that the SCRUM methodology involves several sprints – periods of two to four weeks – where the team work on  creating a potentially shippable product based on high-level requirements.

Obviously this way of working is not suitable for everything. I mean, just imagine a company building a motorway, or a high-rise building, where every four weeks that make changes based on “high-level” requirements. In those situations, you do want your processes.

However for smaller projects, such as developing a corporate portal, or similar, the SCRUM methodology seems to really make sense. Especially when you are relying on requirements from users who don’t really understand, or know, what they want. In this case, the build it, and then “rebuild/modify” based on feedback is a faster way of working.

I’ll be the first to admit that I am no expert when it comes to SCRUM. Heck – I’ve really only “discovered” it. There are some pretty good references on the internet.  (See below).

See also: Quick and Angry – More on SCRUM