Establish and Document the Application's Regulatory and Compliance Classification

This chapter explains how to establish and document the regulations, compliance frameworks, and internal control requirements that apply to an Application.

Why Regulatory Classification Matters

Applications may be subject to many regulatory and compliance obligations, depending on the data they hold, the business processes they support, the industries and jurisdictions in which the enterprise operates, and the customers they serve. Examples include financial reporting controls, health information privacy requirements, payment card data security standards, data protection laws, and “good practice” (GxP) regulations in life sciences, where the “x” stands for an area such as manufacturing, clinical, or laboratory practice. These obligations determine which controls, validation, testing, retention, and audit practices the Application requires. If they are not identified early, the Application may be built without them, and retrofitting compliance is far more expensive than designing for it.

Establish the Regulatory and Compliance Classification

Early in the Application’s life, and again whenever its data, functions, users, or jurisdictions change:

• Identify every regulation, compliance framework, and internal control requirement that applies to the Application, with Risk and Compliance.

• Identify why each applies, for example because of the data the Application holds or the business process it supports.

• Identify which conditional practices each triggers, such as formal validation, penetration testing, or special data handling, as described in the chapter “Apply Conditional Practices Based on Criticality and Regulatory Classification.”

Document and Share the Classification

Record the Application’s regulatory and compliance classification, the reasons for each obligation, and the conditional practices triggered, in the Application Documentation and in the Application Record. Review the classification with every Release.

Best Practice: Establish and Document the Application’s Regulatory and Compliance Classification

It is a best practice to both establish and document the solution for an Application’s regulatory obligations: identify every regulation, framework, and control requirement that applies, record why each applies and what it requires, and review the classification as the Application changes.

Benefits: Knowing an Application’s obligations from the start means compliance is designed in rather than bolted on, which is cheaper and more reliable. A documented classification also lets auditors, Risk and Compliance, and portfolio managers see at once which Applications fall under which obligations.

Connections to Related IF4IT Practices and Inventories

The Application Portfolio Management (APM) Best Practices addresses maintaining audit readiness by knowing which applications are subject to which compliance frameworks. The Regulatory Agencies Inventory and Attributes describes the regulatory bodies whose requirements may apply. The GxP Compliance Framework addresses GxP obligations in detail.