How to Leverage USDM's Vendor Audit of Oracle Supply Chain Management Cloud

From the General Principles of Software Validation (2002) to Computer Software Assurance for Production and Quality System Software — Guidance for Industry (September 2025)

The FDA has continuously promoted leveraging vendor documentation to support a risk-based least burdensome approach to software quality. The FDA states if vendor documentation is in place and of good quality, it can and should be leveraged as documented evidence in establishing that the software core functionality has been validated.¹

While life science companies are ultimately responsible for ensuring that software meets their own intended use, their focus should not be on re-creating documentation for documentation's sake. Instead, they should focus on ensuring the software works for their end-to-end intended use. This mindset is at the heart of Computer Software Assurance (CSA) and modern validation lifecycle management: think critically, test where risk lives, and reuse credible evidence wherever it already exists. Below, we share how you can utilize USDM and Oracle activities to minimize your validation and testing burdens. This benefit applies to all partners in USDM's Cloud Assurance ecosystem.

Oracle Vendor Assurance Report

Annually, as a part of the USDM Cloud Assurance™ service, and to replace the need for individual audits, Oracle hosts USDM as an independent qualified third party to audit their design, development, testing, qualification, and maintenance methodologies. The audit is specifically scoped to the Oracle Fusion infrastructure and Oracle Supply Chain Management (SCM) Cloud, Clinical One and Argus Safety for compliance to FDA software compliance standards.

Results of the audit are compiled into the Oracle Vendor Assurance Report, a comprehensive report and reference document, which not only provides a summary of the audit, but also cites all source material reviewed as a part of the audit activities, and provides direct links to all publicly available content. Think of it as your own Dewey Decimal System for Oracle software development lifecycle (SDLC) and testing documentation. Bottom line: USDM audits Oracle, so you don't have to.

Because the audit is performed by an independent qualified third party, it also strengthens your third-party risk management posture — giving quality and procurement teams a defensible, repeatable basis for trusting a critical cloud vendor.

USDM audits Oracle, so you don't have to — and the Vendor Assurance Report becomes your reference library of credible, citable validation evidence.

Leveraging Vendor Documentation

Infrastructure, Back-Up, Disaster Recovery, and Installation Testing
Installation Qualification (IQ)

By qualifying the cloud infrastructure, verifying the applications, and following their own procedures for items such as backup and recovery, access control, and the instance installation, Oracle has done much of this work for you. You can leverage the summary of documentation reviewed during the audit, and detailed in the Vendor Assurance Report, as your evidence.

• Leverage Oracle's core functionality testing. Reference the appropriate sections of the Vendor Assurance Report in your Traceability Matrix and include a copy of it as evidence in your Validation package.
• Focus on qualifying the configuration; verify your instance has been configured for your intended use.

Functionality and Workflow Testing
Operational / Performance Qualification (O/PQ)

While testing of functionality will still be required from an intended use standpoint, certain aspects of the traditional O/PQ activities can be leveraged from the audits. The most prominent is a detailed review of Oracle's functional testing activities – the overall SDLC, including unit, regression, integration, and boundary testing of the out-of-the-box (core) functionality. You can leverage the summary of test documentation reviewed during the audit and detailed in the Vendor Assurance Report, as your evidence.

• Leverage Oracle's core functionality testing. Reference the appropriate sections of the Vendor Assurance Report in your Traceability Matrix and include a copy of it as evidence in your Validation package.
• Focus OQ testing on high-risk core and custom functionality that impacts product quality and patient safety.
• Focus PQ testing on your use of the system. End-to-end workflow to establish confidence that your process operates as intended and is reproducible.

Throughout, keep your access controls, audit trails, and electronic records aligned to 21 CFR Part 11, and confirm that the configured system preserves data integrity across your supply chain workflows.

USDM Cloud Assurance™

Whenever software is changed, an analysis should be conducted not just for validation of the individual change, but also to determine the extent and impact of that change on the entire system. As part of the Cloud Assurance™ core-level subscription for Oracle SCM Cloud service, USDM provides an impact assessment of upcoming releases that includes guidance on the required regression testing based on the high-risk areas of the system's core functionality.

Additionally, you can upgrade to USDM's premium-level Cloud Assurance™ subscription, if you would also like for USDM to provide a customer-specific analysis of Oracle's SCM Cloud releases to ensure all aspects of your unique system configuration are tested according to your inherent risk – within your specific testing environment. Regression test scripts are executed for each release specific to each customer's configuration. Read more about what it means to be Cloud Assurance Certified.

[1] General Principles of Software Validation; Final Guidance for Industry and FDA Staff, FDA (2002).