GAMP 5 software categories and risk-based validation
How a system's software category and criticality decide how much specification and testing it needs, and why that is a judgement, not a formula.
What GAMP 5 is, and isn't
GAMP 5, published by ISPE (second edition 2022), is the industry's guide to a risk-based approach to computerised systems. It is guidance, not law: regulators everywhere expect validation that fits the risk, and GAMP 5 describes one widely accepted way to get there. The PIC/S and ICH texts in the international core use the same risk-based thinking.
The software categories in brief
The category describes how much of the software is standard and how much is specific to your company. The more specific, the more of it your company has to specify and verify itself.
- Infrastructure software: operating systems, databases, network and security software. Qualified as part of the platform rather than validated one by one.
- Standard products used as supplied, perhaps with parameters set. Verified against their intended use.
- Configured products: standard software configured to your business process, such as a laboratory, ERP or quality system. Your configuration is what you specify and test.
- Custom applications: software written for you, including macros, scripts and interfaces. Specified and tested in full.
Category is not the whole story
A configured product that supports batch release needs more scrutiny than a custom script that formats a report. That is why the category is combined with the system's criticality: its impact on patient safety, product quality and data integrity. Together they set the depth of specification, the testing approach (scripted or unscripted) and the frequency of periodic review. The decision stays with the people who know the process, and it is written down with its reason.
With the GxP Validation Assistant
How the assistant applies it
Plain questions
A wizard asks what the system does and how it is built, and suggests the category and criticality. Every suggestion can be overridden, with a reason.
Scaled suggestions
Category and criticality set which documents are expected, how detailed the requirements are, whether tests are scripted, and how often the system is reviewed.
Platform and systems
Servers, databases and networks are recorded as components that several systems share, qualified once.
In its own words
GAMP 5 text is copyrighted; the assistant follows the approach as a method, explains it in its own words and never reproduces it.
GAMP® is a registered trademark of ISPE. The GxP Validation Assistant is not affiliated with or endorsed by ISPE.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.