ITAM in Pharmaceuticals and Life Sciences: The Gap Between R&D and Compliance

On September 23, 2025, the U.S. Food and Drug Administration issued a Warning Letter (MARCS-CMS 711191) to Persōn & Covey, Inc., following an inspection of their Glendale, California facility. The FDA cited the quality unit for failing to adequately investigate out-of-specification test results. Crucially, inspectors highlighted uncontrolled analytical software access, including shared user logins, a single generic system administrator role assigned to multiple personnel, and missing audit trail reviews.

While the FDA citation focused on laboratory data integrity and access governance, it points to a broader structural issue. In many pharmaceutical and life sciences organizations, IT leadership cannot produce an authoritative, discovery-sourced inventory of software running across laboratory and production environments. Software governance failures and licensing blind spots stem from the same root cause: the lack of a single ground truth for software assets, configuration items, and user entitlements.

In life sciences companies, software management is split between agile R&D applications and heavily regulated GxP compliance systems. Software Asset Management (SAM) and IT Asset Management (ITAM) in pharmaceuticals and life sciences are essential for maintaining audit readiness and managing software licensing across these environments.

Two Software Estates, One CMDB Blind Spot

Pharmaceutical and biotechnology firms operate two distinct software estates, each governed by different priorities, funding models, and operational owners.

The first estate comprises R&D applications. This includes Laboratory Information Management Systems (LIMS), Electronic Lab Notebooks (ELN), Clinical Trial Management Systems (CTMS), and specialized bioinformatics or molecular modeling software. These tools are frequently selected, purchased, and managed directly by scientific departments, research fellows, or principal investigators to maximize speed and research agility.

The second estate comprises compliance and operational applications. This includes electronic Quality Management Systems (eQMS), electronic Batch Records (eBR), electronic Trial Master Files (eTMF), Learning Management Systems (LMS), and Enterprise Resource Planning (ERP) platforms. These systems directly support Good X Practice (GxP) guidelines, including Good Laboratory Practice (GLP), Good Clinical Practice (GCP), and Good Manufacturing Practice (GMP). They are tightly controlled by Quality Assurance (QA) and Regulatory Affairs teams under strict change-control procedures.

According to the ISO/IEC 19770 standard family for Software Asset Management, ITAM requires the systematic control of software lifecycles, entitlements, and active deployments. In life sciences, this control must align with the ISPE GAMP 5 (Good Automated Manufacturing Practice) framework. GAMP 5 categorizes software from Category 1 (infrastructure software) to Category 5 (custom applications) to determine validation requirements.

When ITAM operates independently of GAMP 5 classifications and configuration management data, license tracking breaks down. Validation teams maintain static spreadsheets of validated systems, while IT asset managers rely on separate procurement logs. Neither team has a complete view of actual software deployments.

Why Validated Systems Don’t Protect You From a Licensing Audit

A common misconception among pharmaceutical executives is that software validation guarantees software asset compliance. It does not.

Computer System Validation (CSV) and the FDA’s updated Computer Software Assurance (CSA) framework verify that a software application consistently fulfills its intended purpose and maintains data integrity. Validation auditors check system specifications, testing protocols, and electronic signatures under 21 CFR Part 11. They do not verify whether the software deployed on a server matches the purchase order or if user counts exceed contractual license agreements.

Independent research highlights the financial exposure associated with unmonitored software deployment:

• According to Flexera’s 2026 State of ITAM Report, 48% of global enterprises were subjected to a software vendor audit in the past year.
• The same report indicates that 44% of audited organizations paid over $1 million in unbudgeted audit settlements and true-up costs over a three-year period.
• Flexera’s data reveals that only 36% of organizations possess complete visibility into their IT asset footprint, leaving a 64% blind spot across hybrid environments.
• On September 24, 2025, the FDA’s Center for Devices and Radiological Health (CDRH) and Center for Biologics Evaluation and Research (CBER) issued final guidance titled Computer Software Assurance for Production and Quality System Software (Docket FDA-2022-D-0795). This guidance shifts regulatory focus toward objective risk-based testing. To establish a defensible risk model, organizations must maintain an accurate, automated inventory of all software CIs.

Five Ways License Records and Validated Records Diverge

1. Uninventoried LIMS or ELN Instances
   Laboratory teams deploy local software instances or add custom modules to meet immediate research deadlines.
   Result: An FDA or EMA inspector identifies active software components that are missing from the Validation Master Plan (VMP), raising concerns regarding data integrity.
2. Unlinked Software Entitlements and Infrastructure CIs
   Software purchase contracts are managed by procurement, while virtual servers housing the applications are managed by infrastructure teams.
   Result: The organization incurs double payment for database or middleware licenses across different research facilities without realizing it.
3. Shadow SaaS Adoption in R&D Workflows
   Research scientists adopt cloud-based data analysis software using departmental expense accounts to bypass lengthy IT onboarding.
   Result: Proprietary research data is processed in unapproved software environments, creating regulatory exposure and unmonitored subscription costs.
4. Publisher Audits on Validated Infrastructure
   A major software vendor performs a license audit and identifies over-deployment on virtual servers hosting GxP applications.
   Result: IT cannot simply remove or alter the software to remediate the license breach without triggering mandatory formal change-control reviews and re-validation tasks.
5. Unreconciled Software Estates Following M&A or CRO Integration
   Corporate acquisitions unite disparate R&D pipelines, legacy CMDBs, and software contracts under one umbrella.
   Result: The organization pays redundant licensing fees and cannot produce a unified software asset record during corporate compliance audits.

See how pharmaceutical IT leaders establish Trusted Runtime Truth™ to eliminate R&D software licensing blind spots and streamline GxP audit readiness.

What Software Misalignment Costs

For Chief Information Officers and IT Leadership

Unmonitored software deployment exposes the organization to unbudgeted financial liabilities and potential regulatory delays. When software vendor audits coincide with FDA inspections, leadership faces compounding financial penalties and operational disruptions that can stall drug development pipelines.

For ITAM Managers and CMDB Owners

IT asset managers and configuration managers spend hundreds of hours manually cross-referencing software purchase orders, vendor portals, and validation logs against static spreadsheets. This manual reconciliation process decays rapidly as R&D teams deploy new virtual machines and cloud resources.

For Quality Assurance and Regulatory Compliance Teams

Under the FDA’s risk-based CSA guidance, QA teams require clear visibility into software assets and infrastructure dependencies. Without automated asset discovery, QA teams must re-verify software inventories manually before every regulatory audit, diverting valuable resources away from core quality oversight.

For Procurement and Finance Leaders

Software spend represents a major component of pharmaceutical IT budgets. Without centralized visibility into software deployments across R&D and manufacturing sites, procurement teams lack leverage during software contract renewals, leading to over-licensing and wasted capital.

Closing the Gap: Discovery as the Entitlement Source of Truth

To bridge the gap between R&D agility and regulatory compliance, pharmaceutical organizations require an automated, discovery-sourced foundation that ties physical, virtual, and cloud software assets to business services and compliance records.

1. Automated Infrastructure and Software Discovery

Automated IT discovery software continuously scans on-premises servers, cloud environments, laboratory workstations, and network devices. Scheduled discovery identifies installed applications, software versions, host relationships, and active user connections across R&D and operational environments, removing reliance on manual inventory tracking.

2. CMDB-Integrated License Reconciliation

A centralized Virima CMDB links discovered software assets directly to contract terms, purchase orders, and user entitlements. This integration enables automated comparison between active software deployments and contract agreements, allowing ITAM teams to address software licensing in pharma R&D before vendor audits occur. For a detailed breakdown of this mechanism, review our guide to software license management.

3. Change Control and ITSM Workflow Integration

Bi-directional integration with enterprise ITSM platforms, including ServiceNow, Jira Service Management, and Ivanti, ensures that software lifecycle updates automatically feed into formal change-management workflows. When a software patch, upgrade, or license change occurs, the update is logged alongside the corresponding configuration item. For details on integrating IT asset management with configuration management, see our guide on CMDB asset management vs ITAM.

Note: Virima provides the underlying IT asset discovery, CMDB relationship mapping, and infrastructure inventory. Virima does not perform Computer System Validation (CSV), manage 21 CFR Part 11 electronic signatures, or classify GxP data content. It supplies the accurate operational data layer required for compliance and quality teams to maintain validated states.

Aligning ITAM Rollout With Your Regulatory Audit Calendar

Transitioning to an automated ITAM framework requires a structured implementation plan aligned with regulatory and vendor audit schedules:

1. Establish Baseline Discovery Across All Networks
   Deploy agent-based and agentless discovery across corporate networks, laboratory subnets, and cloud tenants. Capture an accurate baseline of all installed software, database instances, and operating systems before attempting entitlement reconciliation.
2. Reconcile Software Entitlements Against Discovered Installs
   Upload software contracts, purchase orders, and license keys into the ITAM repository. Correlate discovered software assets with contractual entitlements to identify over-deployment or under-utilized software licenses.
3. Incorporate GAMP 5 Risk Classifications into the CMDB
   Collaborate with Quality Assurance to append GAMP 5 software categories and validation status fields to configuration items in the CMDB. This ensures that IT teams recognize validated software assets before executing patches or updates.
4. Integrate ITAM Data Into Change Management Workflows
   Connect ITAM and CMDB data to your ITSM change-control process. Ensure that any proposed software modification, license tier adjustment, or server migration automatically flags relevant GxP validation requirements.
5. Establish High-Frequency Discovery Cycles for Audit Readiness
   Schedule recurring discovery scans aligned with your internal audit calendar and software renewal dates. Maintaining an updated software inventory eliminates pre-audit fire drills and ensures continuous compliance.

To understand how unified asset data supports broader risk management, explore our guide on healthcare IT asset management.

Organizations building comprehensive asset governance can explore how Virima delivers Trusted Runtime Truth™ across complex, regulated IT environments. To see how ViVID™ service mapping visualizes application dependencies across your enterprise, request a demo with our technical team.

Frequently Asked Questions