Why SAP projects in pharma are different
An SAP implementation at a consumer goods company is a business transformation. At a pharmaceutical company it is also a regulated change to the systems that hold GMP records and, for listed companies, the financial controls behind SOX. Every design decision, from batch status logic to role design, must be specified, tested and documented in a way that survives an FDA inspection and an external audit.
This article covers new implementations, multi-site rollouts and the most common project in 2026: moving from SAP ECC to S/4HANA. For background on modules and GxP rules, see our companion article on SAP in the pharmaceutical industry.
The S/4HANA migration timeline
SAP committed in February 2020 to mainstream maintenance for Business Suite 7 (ECC) until the end of 2027, optional extended maintenance through the end of 2030 at a two-percentage-point premium, and S/4HANA maintenance until 2040.
In February 2025, SAP added a transition option for very large on-premise landscapes. According to SAPinsider’s analysis, customers must move to SAP ERP, private edition, before the end of 2030, can use it from 2031 to 2033, and must then move to S/4HANA Cloud, private edition, before the end of 2033. SAP says it is not a maintenance extension, and fees are significantly higher than a comparable cloud subscription.
Many companies are mid-journey. SAPinsider’s 2026 benchmark of 296 members found 55% had deployed S/4HANA in some form, but only 34% had moved daily operations to it, and 35% planned to switch by the end of 2026. Interestingly, 43% cited SAP’s AI announcements as a driver, ahead of the 2027 deadline at 39%.
For pharma, the deadline matters more than usual because validation adds months. A plan that assumes a go-live in late 2027 leaves little room for a failed qualification cycle.
Implementation and rollout phases
Most pharma SAP programs follow a similar shape, whatever methodology the partner uses.
| Phase | Business work | Validation and compliance work |
|---|---|---|
| Discover and plan | Scope, sites, migration approach (new build, conversion or selective) | Validation plan, GxP and SOX impact assessment, supplier assessment of SAP and partner |
| Design | Process design for procure-to-pay, plan-to-produce, quality, order-to-cash | User requirements, functional and configuration specs, risk assessment per process |
| Build | Configuration, custom code, interfaces, data migration design | Code review, unit testing, data migration specs and acceptance criteria |
| Test | Integration, user acceptance, performance | Risk-based testing evidence, Part 11 control tests, SOX control design tests |
| Deploy | Cutover, hypercare | Data migration verification, validation summary report, release for GxP use |
| Run | Support, enhancements | Change control, periodic review, audit-trail review, SOX operating tests |
A rollout to additional sites or countries reuses the global template. The validation strategy should do the same: validate the template once, then test site-specific configuration, local interfaces and local regulatory requirements (for example, a new market’s serialization reporting) rather than revalidating everything.
Validation: GAMP 5, CSA and Part 11
Use a risk-based approach
ISPE GAMP 5, 2nd edition (July 2022) remains the reference model. It stresses critical thinking by subject matter experts, supports iterative and agile delivery, encourages using supplier documentation, and discusses FDA’s Computer Software Assurance work.
What the FDA CSA guidance does and does not cover
FDA finalized Computer Software Assurance for Production and Quality System Software in September 2025. It was issued by CDRH and CBER, is tied to the device Quality System regulation (21 CFR 820) and does not mention CDER. Strictly, it applies to medical device production and quality system software. In February 2026 FDA reissued it as Computer Software Assurance for Production and Quality Management System Software to align with the amended Part 820 (QMSR), superseding the September 2025 version.
Drug manufacturers often borrow its logic anyway: focus assurance on features with high process risk, use unscripted or exploratory testing where risk is lower, and keep records proportionate. That is consistent with GAMP 5, but your validation plan should cite the drug requirements you actually meet rather than presenting the device guidance as binding.
Controls you must still prove
For drug GMP, 21 CFR 211.68 requires controls on who can change master production records, verification of inputs and outputs, and secure backups. 21 CFR 11.10 requires validation, access and authority checks, and secure, time-stamped audit trails. For EU supply, the revised Annex 11 draft consulted on in 2025 adds detailed expectations on identity and access management, audit trails, and supplier and service management, which matter if you move to RISE or another hosted model.
Data migration is the highest-risk step
In an ECC-to-S/4HANA conversion, open batches, inspection lots, quality notifications, approved-supplier lists and stability data all move. Define acceptance criteria per object, reconcile counts and key fields, and decide in advance how you will preserve legacy audit trails and records for their retention period.
SOX compliance in SAP for pharma companies
For US-listed pharma companies, SAP is usually the core of internal control over financial reporting. Regulation S-K Item 308 requires an annual management report on ICFR, bars a conclusion that ICFR is effective if a material weakness exists, and requires an auditor attestation for accelerated and large accelerated filers.
The SEC’s 2007 management guidance, as summarized by Cooley, notes that “the proper and consistent operation of automated controls or IT functionality often depends upon effective IT general controls,” and that management need evaluate only the IT general controls necessary for other controls to work.
In practice, a migration changes many SOX controls at once:
- Automated controls such as three-way match, credit limits and pricing must be re-designed and re-tested in S/4HANA.
- IT general controls over access, change management and operations change when hosting moves to RISE or a cloud provider. Expect to rely on service-provider SOC reports and test your complementary user entity controls.
- Segregation of duties rule sets must be rebuilt for new roles and Fiori apps.
- Key reports used in controls need fresh completeness and accuracy evidence.
The overlap with GxP is large. Access reviews, change control and audit trails serve both, so a combined control matrix avoids testing the same thing twice.
Choosing an SAP partner for pharma
There is no single “best SAP partner.” The right one for a pharma program can show:
- Delivered S/4HANA programs at GMP manufacturers, with validated go-lives and references from quality, not only IT.
- A validation approach aligned to GAMP 5 that uses SAP and partner documentation rather than duplicating it.
- Templates for Part 11 and Annex 11 controls, audit-trail configuration and SoD rule sets.
- Experience with serialization and the industry solutions you plan to use.
- Clear roles for who writes, reviews and approves validation deliverables, since your quality unit must approve.
Best practices
- Start the validation plan and GxP impact assessment in discovery, not after design.
- Use one requirements set with GxP and SOX tags instead of separate documents.
- Keep custom code minimal; every custom object needs specification and testing.
- Treat data migration as a validated process with its own acceptance criteria.
- Plan audit-trail and access reviews for the run phase before go-live.
- Build buffer for at least one failed test cycle ahead of the 2027 deadline.
Common weaknesses
- Validation evidence produced after testing, reconstructed from partner notes.
- Test scripts that prove the standard SAP process but skip custom interfaces to MES, LIMS and eQMS.
- Legacy audit trails left in a decommissioned ECC system with no retrieval plan.
- SoD conflicts accepted at go-live “temporarily” and never resolved.
- Validation plans that cite the FDA CSA guidance as if it applied directly to drug GMP.
Checklist: SAP implementation readiness
- Validation plan approved by quality before design starts
- GxP and SOX impact assessment for each process and custom object
- Supplier assessment of SAP and the implementation partner on file
- Risk-based test strategy with traceability to requirements
- Data migration specs with acceptance criteria and reconciliation evidence
- Audit-trail, e-signature and access controls tested against Part 11
- SOX control matrix updated and design-tested before go-live
- Legacy record retention and retrieval plan for ECC
- Periodic review and change control procedures ready for the run phase
How AskDona helps
An SAP program produces validation plans, specifications, test evidence, data migration reconciliations and SOX control documentation, often thousands of pages from several parties. AskDona reads that evidence against the requirements you set, such as your validation plan, Part 11 §11.10 or your SOX control matrix, and shows where each requirement is supported, where evidence is missing and which page it came from. Run a sample validation and SOX evidence review on one process area before your next quality gate. AskDona shows the evidence; your quality and compliance teams decide.
Editor’s note: Maintenance dates come from SAP’s 2020 press release and SAPinsider’s analysis of the 2025 transition option; confirm your contract terms with SAP. Migration statistics come from a survey of SAPinsider members, not a random sample. The FDA CSA guidance is device-focused, and the revised Annex 11 was a draft at the consultation stage cited. The SEC guidance is cited through a law-firm summary. None of this is legal or audit advice.
FAQ
How long does an SAP implementation take in pharma? It depends on scope, sites and migration approach. Validation, data migration and SOX testing typically add time compared with non-regulated industries, so plan for at least one extra test cycle.
When does SAP ECC support end? SAP committed to mainstream maintenance until the end of 2027 and optional extended maintenance through the end of 2030. A separate transition option runs to the end of 2033 for qualifying large customers.
Does the FDA CSA guidance apply to pharma SAP systems? The final guidance covers medical device production and quality system software. Drug manufacturers often adopt its risk-based thinking alongside GAMP 5, but should cite the drug regulations they must meet.
How does S/4HANA migration affect SOX? Automated controls, IT general controls, SoD rules and key reports all change and must be re-designed and re-tested, often with greater reliance on service-provider SOC reports.
What makes a good SAP partner for pharma? Proven validated go-lives at GMP manufacturers, a GAMP 5-aligned validation approach, Part 11 and Annex 11 templates, and references from quality leaders.
References
All pages opened and checked by October 19, 2026.
| Source | Type | Used for |
|---|---|---|
| SAP News, Feb 4, 2020 | Vendor press release | Maintenance commitments |
| SAPinsider: ERP transition option | Analyst/community | 2031–2033 transition option |
| SAPinsider: Migration benchmark 2026 | Analyst/community survey | Migration status statistics |
| ISPE GAMP 5 2nd ed. | Industry standard body | Risk-based validation |
| FDA CSA final guidance | Regulator | CSA status and scope |
| 21 CFR 211.68 (LII) | Regulation | Drug GMP computer controls |
| 21 CFR 11.10 (LII) | Regulation | Part 11 controls |
| European Commission consultation | Regulator | Annex 11 revision |
| 17 CFR 229.308 (LII) | Regulation | SOX management report and attestation |
| Cooley, 2007 | Law firm | SEC guidance on IT general controls |