Where a contract manufacturer's technology decisions carry regulatory weight

A manufacturing execution system is worth its validation cost only where it changes what happens on the floor. At Dahej we configured electronic batch records to enforce the order of steps, to block charging into a vessel not recorded as cleaned and released, to read weights directly from balances and to calculate yields without an operator's arithmetic, so that quality reviewers examine exceptions rather than re-reading every entry. That design needed fourteen weeks of recipe authoring per product, more than twice my estimate, which is why we digitised 14 products deeply before the other 24. I work with the plant head on screen design and with quality on what counts as an exception. The Dahej results, review in 1.8 days instead of 6.5 and four documentation errors per 100 batches instead of 31, came from enforcement rather than from screens. Kurkumbh, with smaller campaigns and a high-potency suite, will show whether the approach survives variety.

Regulators in the United States, Europe and India expect GMP records to be attributable, legible, contemporaneous, original and accurate, and electronic records to carry secure audit trails. Part 11 of Title 21 of the US Code of Federal Regulations and Annex 11 of the EU GMP guidelines carry that expectation into how systems are configured: unique user accounts, time stamps users cannot alter, and audit trails that show who changed what and why. India's revised Schedule M has brought comparable expectations for computerised systems into Indian GMP. My part is to build those properties into the systems so that compliance does not depend on memory. At Trivikaya that meant removing shared log-ins from every instrument-linked workstation, synchronising time across plant systems and designing audit-trail reports a reviewer can read by exception. Our head of quality decides what a reviewed record must show. I make sure the system can show it, and that nobody in my team, including me, can quietly alter a GMP record.

Plant control systems and execution servers cannot be patched on an office timetable, because each change to a validated system needs an impact assessment and sometimes requalification. I therefore rely on architecture more than on patching. Control networks at both plants sit in zones separated from corporate IT, traffic between them passes only through defined connections in an intermediate zone, and vendor remote access is brokered, approved for each session and recorded. After the February 2025 ransomware attack, which entered through a contractor's remote-access account on the corporate side, we added immutable offline backups and twice-yearly restore drills. The board now sees measured restore times for ERP, the execution systems, laboratory platforms and the identity servers, the number of plant assets running unsupported operating systems behind segmentation, and every remote session granted. Reporting to CERT-In within six hours of noticing an incident sits in our runbook and is rehearsed with the restore.

A contract manufacturer holds other companies' secrets. At Kurkumbh one historian may record campaigns for customers who compete with each other, and a technology-transfer package can hold years of a customer's process development. I treat segregation as a design rule: each customer's data is tagged at source, access is granted per customer project and reviewed every quarter, and nothing a customer receives is queried live from the plant. In 2023 I declined a large customer's request for live access to our historian and built a segregated platform that delivers validated batch data within two days of completion. It now serves 31 customers. Our commercial team still meets customers who want a live window, and some choose other suppliers. My view is that a customer asking for access to our plant is also asking us to protect its own data from everyone else, and I would rather explain that than grant the access.

Listing changed what our auditors and Audit Committee expect of the systems that feed the financial statements. Statutory auditors in India report on the adequacy and operating effectiveness of internal financial controls, and controls over system access, changes and operations form part of that work. In the year before our November 2023 listing, the auditors had raised 11 deficiencies in those controls, including shared privileged accounts in ERP and developers with standing access to production. I deferred a planned ERP upgrade by a year to close them: we removed 214 generic and privileged accounts, introduced segregation-of-duties rules for 46 sensitive transactions, required independent approval for every production change and began quarterly access reviews signed by business owners. I now take the state of those controls to the Audit Committee each year, with every exception listed by system and owner, and I invite the auditors to test our restore procedures rather than only read them.