Our approach to regulatory requirements
How experience with health and biotech regulation translates across industries
IT informa has worked with clients in the health and biotech sectors for many years, including Diaverum, a health provider operating clinics in more than 20 countries. Managing regulatory requirements across that many jurisdictions, including Patient Data Acts, GDPR and local equivalents, gave us a clear method for handling compliance. We now apply it across industries, from finance to food manufacturing.
The core of the method: treat regulatory requirements as properties of the solution, not as a list of sub-requirements to be broken down.
Identify the regulatory requirements
Compliance is not only about software. How an organisation works, including its processes, working practices and values, is equally subject to regulatory demands. When working with Diaverum across more than 20 countries, we gathered the Patient Data Acts from each jurisdiction and identified which requirements affected software and which affected processes within the organisation. Viewed holistically, most of those regulatory requirements turned out to be properties that the solution either had or did not have.
That observation became the basis for our approach.
Managing requirements
The traditional way to analyse requirements is to break them into sub-requirements until each can be addressed with a clear, discrete solution. For functional requirements, this works well. For non-functional requirements, including regulatory ones, it is a trap. The decomposition fragments the solution, makes it difficult to maintain, and loses the broader perspective needed to demonstrate compliance.
Regulatory requirements are properties of the solution
A well-known example from the financial sector is BCBS239, a set of principles for Risk Data Aggregation and Reporting published by the Basel Committee on Banking Supervision and referenced by the ECB. Reading through those principles, it is clear they do not describe functional requirements: they describe properties the solution must have: governance, IT architecture, accuracy, adaptability, and related dimensions.
We treat such principles as properties of a single solution. Rather than managing a fragmented list of requirements, we manage a solution with a defined set of properties and verify changes against those properties throughout development.
In practice, this means using multiple views of the solution, each focused on one property. When a change is made to the system, we verify it against each view:
And we do this at every layer of the design process, from a high-level conceptual view down to implementation. At the conceptual layer, the solution can already be verified against the properties, meaning compliance is considered from the outset rather than retrofitted at the end. Each layer has its own level of detail; the granularity increases as we move closer to implementation, and the properties serve as a consistent reference point throughout.
Compliant processes
A common error is to focus compliance effort entirely on software. Compliant software does not make an organisation compliant. Processes and working instructions are equally subject to regulatory requirements, and more easily overlooked. When regulatory requirements are treated as solution properties, both software and processes are in scope from the beginning, which substantially reduces the risk of failing an audit or external review.
Conclusion
IT informa uses this approach when working with compliance and regulatory requirements. Whether the regulation is a Patient Data Act in healthcare, BCBS239 in finance, or customs requirements in supply chains, the method of treating them as solution properties applies equally in each context. It keeps focus on the overall solution, makes it easier to maintain compliance as the solution evolves, and means compliance can be demonstrated at any stage of development or operations.
The model is applicable not only during a development phase or organisational change, but also when the business is running normally.
