What is Computer System Validation – CSV?

The validation proves with documentation that computer systems used in industrial production adequately fulfill their automatic functions and contribute to ensure the traceability of produced batches and meets GMP regulations. Every computer system that has a direct or indirect relation to the production of the medicine, product for health or impact on traceability, must be validated, because it is a GxP system. The first important activity of the Computer Systems Validation professional is to gather all the available documentation about the system which is object of the study.

METHODOLOGY

Validation Based on Risk Approach

The study of the existing documentation to survey the risk scenarios is extremely important to know the particularities of the system to be validated and to meet cGMP guidelines. However, after some systems have been validated by the professional, some risk scenarios are invariably presented, such as the system behavior facing power outage, study of access profiles, access security, quality of electronic record produced by the system including audit trail, application of electronic signatures, etc.

Multidisciplinary Team & Mitigation Strategy

It is important to emphasize that Functional Risk Assessment must be done by a multidisciplinary team due to the need of adopting mitigation measures for the risks which result in ‘medium’ and ‘high’ levels. The acceptance of these mitigation measures must be agreed among the team aiming to really be functional, whether they are adopting new work procedures or improvements in the system. The measures to be adopted become the validation strategy and they are the main points where GxP validation should focus.

* For the Functional Risk Assessment, the participation of the system supplier or developer is recommended. When this is not available, a professional can be hired with knowledge in this type of system that is being assessed.

ESSENTIAL BUSINESS VALUE

Why Do I Need to Validate?

In addition to contributing for data quality and data integrity, the GMP validation lifecycle is valuable because it allows:

Resource Utilization

Extracting all the needed available resources in the system to cover the specific process safely.

✔ Process Optimization

Opening the "Black Box"

Make the technical knowledge team more in-depth about the system, avoiding that the knowledge stays entirely on the hands of the supplier (opening the ‘black box’).

✔ Internal Autonomy

Knowledge Retention

Document technical discoveries, avoiding the loss of knowledge in an eventual exit of professionals of the company (risk to the business!).

✔ Continuity Shield

Repeatability & Reproducibility

Explore all possible automatic features in order to avoid manual steps, leading to repeatability and reproducibility for the process (target of validation!).

✔ Core Validation Target

Disaster Recovery & Contingency

Direct the team to analyze necessary actions and documented procedures for contingency planning, data backup and application, and disaster recovery, reducing production downtime (risk to the business!).

✔ Downtime Reduction

Information Reliability

Reliability of process information avoiding operational errors.

✔ Error Prevention

ISPE™ GAMP® Framework

GAMP5® Validation Guide & Framework

GAMP5® is a Good Automated Manufacturing Practice guide, the 5th version of 1st edition was released in 2008. Recently, in 2022, they published the 2nd edition of the guide. Since then, it has revolutionized the Validating Computer Systems method. The guide is the main source of “inspiration” for Computer Validation professionals and has as its central axis the risk-based validation strategy (‘A Risk-Based Approach to Compliant GxP Computerized Systems’).

GxP is a general term for the application of good practices. The ‘x’ indicates the area in which good practices are related (manufacturing, distribution, clinical research, laboratory, etc.). The relevant GxP system is any and all system that has impact on:

Patient Health

Product Quality

Data Integrity

Prospective vs Concurrent Validation

The best way to validate is undoubtedly, risk-based, whether it is a new system (prospective validation) or a legacy system (concurrent validation).

Critical Protocol: If the risk results in ‘medium’ and ‘high’ levels, a mitigation measure should be envisaged. If mitigation or upgrade isn’t possible, system exchange should be considered.

DOCUMENTATION & QUALIFICATION

URS – User Requirement Specification & Testing Phases

Normally, these ‘medium’ and ‘high’ risk mitigation measures are detailed in the User Requirement Specification (URS), which becomes the reference document for system validation. If it is a non-configurable system, tests should basically be drawn up to prove that URS requirements have been met and some other typical system tests covered in the following GMP testing phases:

PHASE 1

IQ – Installation Qualification

Documented verification that the system components, hardware, software environment, and network connections have been installed in compliance with approved vendor designs and cGMP standards.

PHASE 2

OQ – Operational Qualification

Documented testing verifying that all system functions, security features, access profiles, and electronic records operate according to functional and user requirements throughout specified operating ranges.

PHASE 3

PQ – Performance Qualification

Documented evidence that the computerized system reliably and repeatedly performs in the actual production or testing operational environment, consistently producing compliant results.

Configured & Customized Systems

If the system is configured or customized to meet the needs of the user company, specification documents must be produced. Some examples: Functional Specification, Hardware Design, Software Design.

CLASSIFICATION MATRIX

Classification / Categorization of Computerized Systems (GAMP5®)

Categorizing systems ensures that the validation rigor, documentation depth, and testing effort are proportional to system complexity and patient risk.

GAMP Category

Category Name

Description & Typical Examples

Validation Approach

Category 3

Non-configurable Product

Standard Commercial Off-The-Shelf (COTS) software, firmware-controlled laboratory instruments.

Verify against URS, supplier assessment, standard IQ/OQ testing.

Category 1

Infrastructure Software

Operating systems, database engines, network monitoring tools, virtualization platforms.

Verify installation, record version, qualification of infrastructure.

Category 4

Configured Product

Configurable software tailored to business processes (e.g., LIMS, ERP, MES, SCADA, QMS).

URS, Functional Specifications, Risk Assessment, Configuration Specs, full IQ/OQ/PQ.

Category 5

Custom Application

Bespoke software or custom code built specifically for the organization’s unique requirements.

Complete SDLC lifecycle, design specs, code reviews, rigorous risk-based IQ/OQ/PQ.

Crucial Document Lifecycle Insight

• It is important to note that acquiring the vendor’s document package doesn’t reflect the completion of the validation work. It is necessary to ‘open’ the document life cycle, with the issuance of the Validation Plan, Functional Risk Assessment and URS and ‘close’ the lifecycle with the issuance of the performance test protocol, Traceability Matrix and Validation Report, documents that are not normally part of the solution provider’s scope.

REGULATORY REQUIREMENT

FDA 21 CFR Part 11 Compliance

It is the FDA standard that establishes rules for use of electronic registration in the Life Sciences industries. In a very brief way, the system must broaden:

Electronic tamper-proof files or database to ensure data integrity

Audit Trail

Access control

Electronic signature = ID + password

Accounts use guarantee by its genuine users

Appropriate methods to prevent unauthorized access

Compliance Strategy & Legacy Systems

The requirements of FDA 21 CFR Part 11 are currently quite common in the market and if foreseen at the beginning of the project, it brings safety and necessary traceability for the good use of the system.

Legacy Systems Protocol:

For legacy systems that do not comply with the regulation, the best way is the Risk Analysis. We suggest studying precisely the absence of these electronic security.

DATA QUALITY STANDARD

Data Integrity & ALCOA+ Principles

One of the key requirements for the computer system is to ensure that the generated data in production is complete from the beginning to the end of the process. It means that the system must be able to keep records of who entered the system, when, what was the action, why it was done and where it was done. Normally, the impact on data integrity is primarily related to this production batch data traceability (depending on the validation focus system).

WHO

Entered the system & executed the action

WHEN

Exact timestamp & date of occurrence

WHAT

Accurate definition of the modification

WHY

Documented reason or justification

WHERE

Workstation or system interface location

Modern Paperless e-Validation

Next-Generation Validation Platforms

Through platforms like GO!FIVE® and paperless validation solutions, organizations adopt modern paperless e-validation with standardized libraries according to process or system to validate, incorporating market good practices and strict regulatory compliance.

* GAMP5® is a guide that has its intellectual rights reserved by ISPE™. Available for purchase at ispe.org.

Ready to Ensure Complete GxP Compliance?

Partner with GXPWAY to execute structured, risk-based Computer System Validation that stands up to FDA, EMA, and ISO audits while safeguarding data integrity.