Ultimate GxP Compliance Checklist & System Impact Assessment Guide
In the pharmaceutical manufacturing sector, maintaining compliance with GxP guidelines (Good Manufacturing Practice - GMP, Good Documentation Practice - GDP, and Good Laboratory Practice - GLP) is the thin line between safe product distribution and severe regulatory findings. A structured, evidence-based compliance program is a vital operational tool to ensure that equipment, computerized systems, and data infrastructures remain in a permanent state of control.
Too often, sites treat compliance as a reactive scramble before an audit, or they fall into the trap of "checkbox compliance"—blindly marking "yes" or "no" without verifying the underlying engineering truth. For computerized systems, this passive approach leads directly to inspection observations, data integrity breaches, or massive project delays.
This guide provides an inspection-ready framework designed for quality assurance (QA) professionals, automation engineers, and plant IT managers. Written from the perspective of an automation practitioner with 11 years of hands-on GMP delivery experience, it outlines the core methodology of GxP System Impact Assessments, software classification under GAMP 5, gap remediation, and continuous validation.
1. The Practical Nature of GxP System Impact Assessment (SIA)
A GxP System Impact Assessment (SIA) is the initial gateway in any validation lifecycle. It is the formal process used to evaluate whether a computerized system, software package, or physical equipment has a direct or indirect impact on patient safety, product quality, or data integrity.
Under the Quality Risk Management (QRM) principles outlined in ICH Q9, validation effort must be proportional to the level of risk a system poses to the patient and the product. Performing an SIA prevents two major operational failure modes: 1. Under-validation: Failing to validate a system that directly influences critical process parameters (CPPs) or stores electronic batch records, leaving the site vulnerable to regulatory actions. 2. Over-validation: Treating non-GxP systems with the same level of testing and change control as a chromatography system, wasting engineering hours and slowing system deployment.
An effective SIA must be executed by a cross-functional team comprising the Process Owner, the System Owner, and QA Validation. Rather than relying on subjective opinions, the team must use a structured, reproducible decision-making process to establish the GxP boundary.
For sites seeking to build a robust foundation for their computerized systems, leveraging experienced computer system validation services can help align engineering practices with regulatory expectations.
2. GxP Decision Tree & System Classification
To remove subjectivity from the GxP assessment, organizations must implement a clear decision tree. If a system meets any of the criteria in the decision tree, it is classified as "GxP Impact" and must enter the Computerized System Validation (CSV) lifecycle.
The classification decision tree operates on four core regulatory pillars:
- Pillar 1 — Patient safety. Does the system affect patient safety? Yes → GxP impact, CSV required. No → continue.
- Pillar 2 — Product quality. Does it monitor or control product quality? Yes → GxP impact, CSV required. No → continue.
- Pillar 3 — Data integrity. Does it generate or store primary GxP records? Yes → GxP impact, CSV required. No → continue.
- Pillar 4 — Electronic records and signatures. Does it use electronic signatures or ERES-controlled records? Yes → GxP impact, CSV required. No → Non-GxP: standard IT controls apply.
A single "Yes" on any pillar puts the system in GxP scope. Only a system that answers "No" to all four falls outside CSV.
- Pillar 1: Patient Safety: Does the system control, monitor, or execute a process that could directly cause harm to the patient if it fails (e.g., sterilization cycles or distribution temperature tracking)?
- Pillar 2: Product Quality & Critical Process Parameters (CPPs): Does the system measure or log parameters defining product identity, strength, quality, purity, or potency (e.g., a PLC managing bioreactor pH)?
- Pillar 3: Data Integrity & Primary Records: Does the system generate, modify, archive, or retrieve data that supports release decisions, batch history, stability studies, or laboratory analyses? Under the FDA 21 CFR Part 211 GMP regulations, any record used to demonstrate compliance must be secure and fully traceable.
- Pillar 4: Electronic Records & Electronic Signatures (ERES): Does the system utilize electronic records or electronic signatures in place of paper records and hand-written signatures? Under FDA 21 CFR Part 11 and EU GMP Annex 11, ERES controls must be validated to ensure the records are authentic, trustworthy, and equivalent to paper.
If the answer to all four pillars is a verified "No", the system is classified as Non-GxP. It does not require formal CSV, but it must still be managed under standard IT controls (such as regular backups and basic user access management).
3. GAMP 5 Category Selection & Validation Scope
Once a system is identified as GxP, the next step is to categorize the software. The International Society for Pharmaceutical Engineering (ISPE) publishes the GAMP 5 Guide 2nd Edition, which provides a risk-based framework for categorizing GxP software.
The software category directly determines the depth of the validation deliverables, the extent of supplier assessment required, and the testing strategy. GAMP 5 defines four active software categories:
- Category 1: Infrastructure Software: Operating systems, database engines, virtualization, and network tools. These are qualified as part of IT Infrastructure Qualification rather than validated individually.
- Category 3: Non-configured Software: Off-the-shelf packages used without configuration, such as laboratory balance software or simple controllers.
- Category 4: Configured Software: Applications configured to match business processes without custom code, including LIMS, QMS, SCADA, and MES (e.g., configuring user groups, workflows, and alarms).
- Category 5: Custom (Bespoke) Software: Software containing custom code, such as bespoke PLC logic, script integrations, or custom macros for lab data analysis.
To design a tailored validation framework that covers these categories without creating unnecessary overhead, consult the strategies outlined in our GxP compliance and validation playbook.
Table 1: GAMP Category vs. Validation Scope
| GAMP Category | System Type Example | Mandatory Deliverables | Testing Strategy | QA Audit Focus |
|---|---|---|---|---|
| Category 1 (Infrastructure) |
Windows Server, Oracle DB, Hyper-V, Network switches | Infrastructure Qualification Protocol, Version Control Logs | Basic installation verification, network connectivity checks | Patch management, physical security, disaster recovery |
| Category 3 (Non-configured) |
QC Lab Balance, pH Meter controller, standard firmware | URS, IQ/OQ Protocol, Validation Summary Report (VSR) | Verification of default functions, URS challenge tests | Data storage path, user login capabilities, audit trail presence |
| Category 4 (Configured) |
LIMS, QMS, SCADA, MES, standard ERP modules | URS, FS, Configuration Spec (CS), IQ/OQ, Risk Assessment, VSR | Workflow-based testing, security role profiling, data boundaries | Audit trail trigger points, electronic signature manifestation |
| Category 5 (Custom / Bespoke) |
Custom PLC logic, custom integrations, macros | URS, FS, CS, Software Design Spec (SDS), Code Review, IQ/OQ/PQ, Traceability Matrix | White-box testing, boundary analysis, error path execution, structural test | Custom code comments, vendor software quality audit, logic maps |
4. GxP Assessment Checklist: 5-Step Gap Process for New Systems
When introducing a new software package or computerized system into a GxP environment, QA and automation teams must execute a structured gap assessment. This process ensures that compliance gaps are identified and remediated before the system is commercialized or used in active production.
- Boundary definition — fix what is inside and outside the system under assessment.
- System impact — direct, indirect, or no impact on product quality and patient safety.
- GAMP classification — Category 1, 3, 4, or 5 per GAMP 5 Second Edition.
- Regulatory mapping — which clauses of 21 CFR Part 11 and EU GMP Annex 11 apply.
- Validation strategy — testing depth and evidence set derived from the four steps above.
- Step 1: System Definition & Boundary Mapping: Detail the physical hardware, software components, database architecture, and human-machine interfaces. Identify all interfaces where data is imported or exported, as these integration points represent high-risk data integrity vulnerabilities.
- Step 2: System Impact Assessment (SIA): Apply the GxP Decision Tree. Document the answers to the four pillars (Safety, Quality, Data Integrity, ERES) and compile the results into a formal SIA report, which must be signed by the Process Owner, System Owner, and QA.
- Step 3: GAMP 5 Categorization & Supplier Assessment: Evaluate the software and assign the appropriate GAMP 5 category. Simultaneously, perform a supplier quality assessment of the vendor’s QMS, development practices, and support capabilities.
- Step 4: Regulatory Mapping (21 CFR Part 11 & Annex 11 Gap Analysis): Map the system’s technical capabilities against regulatory requirements. Focus on data integrity, access control, audit trails, and data preservation. Verify that the system prevents unauthorized data deletion or modification.
- Step 5: Validation Strategy & Protocol Drafting: Define the validation plan. Based on the GAMP category and the regulatory gaps identified in Step 4, outline the testing requirements. Identify the protocols needed (IQ, OQ, PQ) and establish the change control baseline.
5. Remediation Strategy & GxP CAPA Roadmap
Discovering gaps during a system assessment is common, especially with legacy systems. Identifying a gap is not a failure; failing to document, prioritize, and remediate it is.
Every identified gap must be logged in a centralized Gap Register and evaluated using a Failure Mode and Effects Analysis (FMEA) approach to determine risk priority. Gaps are then addressed through a formal Corrective and Preventive Action (CAPA) roadmap.
The remediation strategy follows three pathways: 1. Technical Remediation: Updating software configurations, enabling native compliance features, upgrading firmware, or applying patches. 2. Procedural Remediation: Establishing SOPs to govern actions that the software cannot enforce (e.g., dual-operator verification or manual paper logbooks). 3. Architectural Remediation: Redesigning the system layout to isolate risk (e.g., moving database storage from a local PC to a secured network share).
Table 2: GxP Risk Prioritization Matrix (FMEA-based)
| Risk Area / Gap | Severity | Probability | Risk Priority | Technical Control (Primary Mitigation) | Procedural Control (Secondary Mitigation) |
|---|---|---|---|---|---|
| Shared Login Credentials | High | High | Critical | Integrate Active Directory / LDAP. Disable generic Windows auto-logins on HMI. |
| SOP forbidding credential sharing; disciplinary action framework; periodic user audit logs review. | | Missing Audit Trail (Legacy System) | High | Medium | High | Upgrade software version supporting electronic audit trails.
| Implement paper run-logs. Implement dual-operator verification at critical process steps. | | Writable Database Files (Local OS Access) | High | Medium | High | Revoke local OS access. Restrict folder permissions using IT domain security policies.
| Annual independent IT security sweep. Database backup checks. | | Lack of NTP Time Sync (Clock Drift) | Medium | High | Medium | Configure NTP client to sync with site master clock. Lock local Windows clock settings.
| Daily manual check of system time vs. master time logged on batch record. | | Manual Data Transcription (HPLC to LIMS) | Medium | Medium | Medium | Build validated software interface (API/ETL) to transfer files directly.
| QA review of 100% of transcribed values against raw instrument printouts. | | Missing Backup Verification | Medium | Low | Low | Automate daily backups. Configure automated email notifications for backup failures.
| Documented monthly backup restoration tests on test environment. |
To maintain compliance and track long-term trends, sites should manage these controls within their overall regulatory compliance standards framework.
6. Case Study: Continuous Validation in SaaS Auto-Update Scenarios
In the era of cloud computing, many software vendors have migrated to Software-as-a-Service (SaaS) models. A major challenge in SaaS deployments is the vendor’s auto-update policy. In traditional on-premise deployments, the pharmaceutical site had complete control over if and when a patch was applied. In a SaaS environment, vendors often push updates automatically. If a system update is applied without validation, the system’s validated state is technically compromised.
The Strategy: Continuous Validation
To maintain compliance without blocking software access, organizations must shift from "periodic validation" to a "continuous validation" framework. This case study details how a site successfully qualified a cloud-based QMS with quarterly auto-updates:
| Step | From → To | Action |
|---|---|---|
| 1 | SaaS vendor → Site QA/CSV | Release notes and impact assessment issued ahead of the release window (30 days is a contractual target, not a regulatory requirement) |
| 2 | Site QA/CSV → Validated sandbox | Deploy the update to the validated sandbox environment |
| 3 | Site QA/CSV → Validated sandbox | Run the automated regression test suite against GxP-critical workflows |
| 4 | Site QA/CSV (internal) | Review test results and document deviations |
| 5 | Site QA/CSV → Production | Approve change control and authorise the production release |
| 6 | SaaS vendor → Production | Deploy the update to the production environment |
1. Vendor Quality Agreement (SLA) & Notification Cadence
The site established a Quality Agreement contractually requiring the vendor to provide release notes 30 days prior to deployment, and a dedicated "Sandbox" environment 15 days before production release.
2. Automated Regression Testing (The Technical Control)
Because manual validation of the entire system quarterly was impossible, the site developed selenium-based automated regression tests. Executed in the Sandbox, these tests simulated critical user pathways (creating deviations, approving CAPAs) in 45 minutes, generating screenshots and verification PDFs.
3. Change Control & Impact Assessment (The Process)
The validation team analyzed the vendor release notes to determine if the update introduced new GxP features. Non-GxP updates were logged under a minor change control with minimal testing documentation. GxP-affecting updates were verified using targeted automated scripts, and the Configuration Specification was updated.
By combining vendor notifications, sandbox testing, and automated scripts, the site reduced the validation timeline for each quarterly release from 20 working days to 2 working days.
7. Actionable GxP Compliance & Inspection-Readiness Checklist
Use this checklist to evaluate your site’s current compliance status. To satisfy regulatory inspectors, teams must present objective evidence for every control.
The following checklist maps key control areas to required proof and regulatory references, including the data management guidelines in PIC/S PI 041-1.
Table 3: The Complete GxP Compliance & Evidence Checklist
| Control ID | Category | Check Item & Control Objective | Regulatory Reference | Objective Evidence / Audit Proof Required |
|---|---|---|---|---|
| SIA-01 | SIA & System Classification | System Impact Assessment (SIA): Evaluate direct/indirect impact on product quality, patient safety, and GxP regulatory data to establish the system boundary and validation criticality. | ICH Q9, EU GMP Annex 11, Clause 1 | Approved System Impact Assessment (SIA) form with QA sign-off, functional risk assessment matrix, and system inventory record. |
| SIA-02 | SIA & System Classification | User Requirements Specification (URS): Establish clear, unambiguous, testable GxP requirements and map each critical function to downstream verification scripts. | EU GMP Annex 11, Clause 4, GAMP 5 Second Edition | Approved User Requirements Specification (URS) document with uniquely numbered requirements and signed Requirements Traceability Matrix (RTM). |
| GAMP-01 | GAMP 5 Category & Validation Scope | Software Categorization: Classify system components into GAMP software categories (Cat 1/3/4/5) to define lifecycle deliverables, supplier dependency, and testing depth. | GAMP 5 Second Edition, EU GMP Annex 11, Clause 4 | Approved Validation Plan (VP) documenting GAMP software categorization (Cat 1/3/4/5), testing rationale, and supplier assessment report. |
| GAMP-02 | GAMP 5 Category & Validation Scope | Qualification Protocol Execution (IQ/OQ/PQ): Verify system installation, boundary operating parameters, and continuous performance under production conditions with formal discrepancy handling. | 21 CFR Part 11.10(a), EU GMP Annex 11, Clause 4 | Executed and QA-approved IQ/OQ/PQ protocols with executed test scripts, raw data printouts/attachments, deviation resolution logs, and signed Validation Summary Report (VSR). |
| DI-01 | Data Integrity / ALCOA+ | Contemporaneous & Original Record Capture: Enforce direct, real-time automated data acquisition from production instruments, prohibiting manual transcription or delayed data recording. | PIC/S PI 041-1, EU GMP Chapter 4 | Electronic batch run records with system timestamps, raw instrument data files with cryptographic checksums, and validated automated interface data flow diagram. |
| DI-02 | Data Integrity / ALCOA+ | Time Synchronization (Clock Authority): Synchronize all GxP workstations, HMIs, and database servers to an authenticated, centralized NTP time authority to preserve chronological data integrity. | 21 CFR Part 11.10(e), PIC/S PI 041-1 | Network configuration sheet demonstrating client synchronization to site master NTP clock, locked local operating system time settings, and automated time-drift alert logs. |
| ERES-01 | Electronic Records & Signatures | Signature Manifestation & Meaning: Ensure printed and displayed electronic records clearly manifest the signatory's full name, date/time stamp, and the specific signing intent (e.g., review, approval, author). | 21 CFR Part 11.50, EU GMP Annex 11, Clause 14 | Sample electronic batch record PDF export displaying indelible signature blocks with printed full name, timestamp, and manifest statement of signature purpose. |
| ERES-02 | Electronic Records & Signatures | Signature-to-Record Cryptographic Linking: Securely link electronic signatures to their respective electronic records to ensure signatures cannot be truncated, excised, or transferred to other documents. | 21 CFR Part 11.70, EU GMP Annex 11, Clause 14 | Technical architecture specification detailing SHA-256 (site policy) digital signature / cryptographic binding mechanism, and executed test script proving signature invalidation upon record alteration. |
| AT-01 | Audit Trail | Automated Audit Trail Generation & Protection: Capture computer-generated, time-stamped logs of all GxP record creates, edits, and deletions; ensure audit logging cannot be modified or disabled by operators or administrators. | 21 CFR Part 11.10(e), EU GMP Annex 11, Clause 9 | Exported system audit trail log showing old value, new value, user ID, timestamp, and reason for change; executed security test proving admin accounts cannot disable audit trails. |
| AT-02 | Audit Trail | Routine Audit Trail Review: Establish a formal procedural schedule and documented process for reviewing critical audit trails prior to batch certification and product release. | EU GMP Annex 11, Clause 9, PIC/S PI 041-1 | Approved SOP for GxP audit trail review, risk-based audit trail review frequency matrix, and completed batch release checklists signed by QA/QP confirming audit trail review completion. |
| SEC-01 | Access Control & Security | Unique User Identification: Require unique, individual credentials for every user accessing GxP systems; prohibit shared, generic, or group accounts across all workstations and cleanroom HMIs. | 21 CFR Part 11.10(d), EU GMP Annex 11, Clause 12 | Active Directory / LDAP user inventory export showing unique identity naming convention, disabled generic/guest accounts, and cleanroom HMI account configuration report. |
| SEC-02 | Access Control & Security | Role-Based Access Control (RBAC): Enforce least-privilege authority checks ensuring only explicitly authorized roles can configure systems, enter data, execute approvals, or modify database records. | 21 CFR Part 11.10(g), EU GMP Annex 11, Clause 12 | Approved User Access Matrix (RBAC matrix), executed security challenge test protocol, and annual user access recertification audit log signed by the system owner. |
| CC-01 | Change Control & Configuration | Formal GxP Change Control: Subject all system patches, software version increments, script adjustments, and hardware modifications to pre-approval, GxP risk assessment, and regression verification. | EU GMP Annex 11, Clause 10, EU GMP Chapter 4 | Approved Change Control record documenting regulatory impact evaluation, pre-implementation test protocol, executed regression test results, and QA closure sign-off. |
| CC-02 | Change Control & Configuration | Configuration Management & Version Tracking: Maintain an approved, baselined configuration specification and ensure software versions and database schemas match approved operational releases. | 21 CFR Part 11.10(k), EU GMP Annex 11, Clause 10 | Baselined Configuration Specification document, version-controlled git commit / release build report, and signed configuration verification audit record. |
| BKP-01 | Backup / Restore / Archive | Automated Scheduled Backups: Execute routine automated backups of all GxP databases, transaction logs, audit trails, and raw data files; store copies in a secure, isolated off-site or cloud location. | EU GMP Annex 11, Clause 7, 21 CFR Part 11.10(c) | Daily automated backup job execution logs, backup checksum / hash verification report, and physical receipt or cloud replication log for off-site storage. |
| BKP-02 | Backup / Restore / Archive | Periodic Backup Restoration Verification: Periodically test the physical restoration of GxP backup media to a non-production test environment to verify recovery capability, data integrity, and completeness. | EU GMP Annex 11, Clause 7, PIC/S PI 041-1 | Executed Disaster Recovery & Backup Restoration test report detailing end-to-end restore to sandbox, record count/checksum reconciliation, and QA approval sign-off. |
| SUP-01 | Supplier & SaaS Auto-Update | Supplier Qualification & Quality Agreement: Formally audit and qualify critical GxP software vendors and establish formal, legally binding Quality Agreements defining GxP support, notice periods, and audit rights. | EU GMP Annex 11, Clause 3, GAMP 5 Second Edition | Executed Supplier Quality Agreement (SQA) signed by both parties, completed supplier audit report or formal vendor questionnaire, and Approved Supplier List (ASL) entry. |
| SUP-02 | Supplier & SaaS Auto-Update | Continuous Validation for SaaS Releases: For cloud SaaS applications with auto-updates, review advance release notes 30 days (contractual, site policy) prior and execute automated regression test suites in a sandbox prior to production release. | EU GMP Annex 11, Clause 3, EU GMP Annex 11, Clause 10 | Vendor 30-day advance release notice, executed sandbox automated regression test suite run report, and approved fast-track change control authorization record. |
| GDP-01 | Training & GDP Documentation | SOP Lifecycle & Version Control: Maintain approved, version-controlled SOPs covering all critical GxP system operations, routine use, administrative procedures, data handling, and contingency recovery. | EU GMP Chapter 4, 21 CFR Part 11.10(k) | Master Document Index showing current effective SOP versions, signed approval history pages, and automated document repository record confirming archival of obsolete versions. |
| GDP-02 | Training & GDP Documentation | Role-Based Training Verification: Ensure all personnel operating or administering GxP computerized systems complete training on relevant SOPs and Good Documentation Practices before receiving system access. | 21 CFR Part 11.10(i), EU GMP Annex 11, Clause 2 | Learning Management System (LMS) training completion matrix, signed training attendance records, and audit proof showing user account creation date occurs strictly after training certification. |
| PR-01 | Periodic Review | Periodic System Evaluation: Conduct regular periodic evaluations of GxP computerized systems to confirm maintenance of validated state, security adherence, change history, and procedural compliance. | EU GMP Annex 11, Clause 11, ICH Q9 | Approved Periodic Review Report (PRR) signed by System Owner and QA, compiling change control history, deviation logs, open CAPAs, security re-certifications, and maintenance records. |
| PR-02 | Periodic Review | Long-Term Archival & Retrieval Readiness: Ensure archived GxP records, batch data, and audit trails remain permanently readable, accessible, and securely stored throughout the mandatory statutory retention period. | EU GMP Annex 11, Clause 17, 21 CFR Part 11.10(c) | Archival procedure, storage index, and documented test report proving successful search, retrieval, and human-readable rendering of archived historical data older than 5 years (site retention policy). |
| CAPA-01 | Incident/CAPA | System Deviation & Incident Logging: Log, classify, and formally investigate all computerized system faults, security breaches, data integrity discrepancies, and unexpected deviations with root-cause analysis. | EU GMP Annex 11, Clause 13, EU GMP Chapter 1 | QMS incident/deviation records with automated timestamps, root-cause investigation records (e.g., 5-Why or Ishikawa diagrams), and QA impact assessment. |
| CAPA-02 | Incident/CAPA | CAPA Implementation & Effectiveness Verification: Implement corrective and preventive actions arising from system incidents or audit findings, and formally evaluate their long-term effectiveness prior to closure. | ICH Q10, EU GMP Chapter 1 | Approved CAPA plan with defined responsibilities and milestones, executed technical remediations or SOP revisions, and documented CAPA effectiveness review report signed by QA. |
| EU GMP Chapter 4,
FDA 21 CFR 211.180 | Master index of controlled documents; signed approval blocks; archived obsolete files. |
| GDP-02 | GDP Documentation | Deviation and CAPA Control: All deviations are investigated, and CAPAs are verified for effectiveness.
| EU GMP Chapter 4,
FDA 21 CFR 211.192 | Closed deviation reports with root cause analysis; CAPA verification protocols. |
| CAL-01 | Physical Environment | Calibration Traceability: Critical sensors are calibrated against national standards (NIST).
| FDA 21 CFR 211.160,
EU GMP Chapter 3 | Calibration certificates showing NIST traceability; calibration stickers on sensors with due dates. |
| CAL-02 | Physical Environment | Environmental Monitoring: Temperature, humidity, and particle counts remain within limits.
| EU GMP Annex 1,
FDA 21 CFR 211.42 | Continuous monitoring logs; differential pressure logs; cleanroom particle count certificates. |
| CSV-01 | System Validation | URS & Risk Assessment: Every computerized GxP system has a URS and GAMP risk assessment.
| EU GMP Annex 11,
GAMP 5 2nd Ed | Approved URS; System Impact Assessment; Functional Risk Assessment (FMEA) document. |
| CSV-02 | System Validation | IQ/OQ/PQ Execution: Test protocols are completed, signed, and summarize deviations.
| EU GMP Annex 11,
FDA 21 CFR 211.68 | Executed IQ/OQ/PQ test scripts with raw printouts; signed Validation Summary Report (VSR). |
| CSV-03 | ERES Controls | Access Control: Unique credentials are required for all users; shared logins are disabled.
| FDA 21 CFR Part 11,
EU GMP Annex 11 | User privilege matrix; Active Directory policy settings; printout of local user registry. |
| CSV-04 | ERES Controls | Electronic Signatures: E-signatures include name, timestamp, and signature meaning.
| FDA 21 CFR Part 11,
EU GMP Annex 11 | System configuration screen showing signature settings; sample printed batch report with signed blocks. |
| DAT-01 | Data Integrity | Audit Trail Integrity: Audit trails are enabled and cannot be disabled by operators.
| PIC/S PI 041-1,
FDA 21 CFR Part 11 | Admin security role configurations; test log demonstrating an operator account cannot disable logging. |
| DAT-02 | Data Integrity | Audit Trail Review: A defined schedule exists for reviewing audit trails before batch release.
| PIC/S PI 041-1,
EU GMP Annex 11 | SOP governing audit trail reviews; signed batch release checklist verifying audit trail review. |
| DAT-03 | Data Integrity | Time Synchronization: All GxP clocks sync to a central NTP time source.
| PIC/S PI 041-1,
EU GMP Annex 11 | Network diagram showing NTP master configuration; local registry clock-source settings. |
| DAT-04 | Data Integrity | Disaster Recovery & Backup: Automated backups run daily and are verified via restoration tests.
| FDA 21 CFR 211.68,
EU GMP Annex 11 | Backup logs; off-site storage receipts; signed annual backup restoration test report. |
| HR-01 | Training & Vendor | Training Records: Training profiles match current SOP versions before operator executes tasks.
| FDA 21 CFR 211.25,
EU GMP Chapter 2 | Training matrix; individual training records; system login timestamped after training completion. |
| HR-02 | Training & Vendor | Vendor Qualification: Critical system vendors are audited or qualified at least every 3 years.
| EU GMP Annex 11,
GAMP 5 2nd Ed | Signed Vendor Audit Report or completed supplier qualification questionnaire. |
8. Quy chuẩn GxP Áp dụng Riêng cho Thị trường Việt Nam
Đối với các nhà máy sản xuất Dược phẩm tại Việt Nam, ngoài việc tuân thủ các chuẩn mực quốc tế như EU-GMP hay FDA, việc đáp ứng các quy định của Cục Quản lý Dược (DAV) là bắt buộc. Đặc biệt đối với hệ thống máy tính và đánh giá rủi ro, các tài liệu sau cần được tích hợp vào danh mục kiểm tra:
| Quy định / Thông tư | Lĩnh vực áp dụng | Điểm lưu ý cốt lõi (SIA Focus) |
|---|---|---|
| Thông tư 28/2025/TT-BYT (thay thế TT 35/2018/TT-BYT, hiệu lực 01/07/2025) | GMP (Thuốc hóa dược, Thuốc sinh học) | Yêu cầu nghiêm ngặt về Hồ sơ Lô điện tử (EBR) và Chữ ký điện tử. Mọi thay đổi dữ liệu phải có Audit Trail và được bảo lưu. |
| Thông tư 36/2018/TT-BYT | GSP (Thực hành Tốt Bảo quản) | Hệ thống BMS/EMS giám sát nhiệt độ, độ ẩm kho phải được thẩm định IQ/OQ/PQ và hiệu chuẩn cảm biến định kỳ. Hệ thống cảnh báo tự động là bắt buộc. |
| Thông tư 04/2018/TT-BYT | GLP (Thực hành Tốt Phòng thí nghiệm) | Quản lý vòng đời dữ liệu phân tích (ALCOA+). Máy sắc ký (HPLC, GC) phải phân quyền User rõ ràng, tuyệt đối cấm dùng chung tài khoản nội bộ. |
Sự khác biệt lớn nhất khi triển khai GxP tại Việt Nam là việc kết nối dữ liệu từ các hệ thống sản xuất cục bộ (SCADA/HMI) lên hệ thống báo cáo quản trị, phục vụ việc thanh tra trực tiếp của chuyên viên Cục Quản lý Dược.
9. Downloadable Resource
GxP System Impact Assessment & Classification Template (Excel)
To help your team transition from theory to execution, we have developed a downloadable GxP System Impact Assessment & Classification Template (Excel).
This professional spreadsheet includes: * Pillar-based questionnaires: Automated scoring sheets mapping to Safety, Quality, Data Integrity, and ERES controls. * GAMP 5 Classification Engine: Input system features (e.g., custom code, workflow configurations, default settings) to automatically determine the GAMP Category (1, 3, 4, or 5). * Deliverable Generator: A dynamic tab that generates a list of mandatory validation deliverables (URS, FS, CS, SDS, IQ/OQ/PQ, VSR, Code Review) based on the determined system risk profile.
This template serves as a standardized record to document system impact decisions during internal audits and regulatory inspections.
10. Frequently Asked Questions
What is a GxP compliance checklist?
A GxP compliance checklist is an operational tool assessing a site’s alignment with Good Practice standards, covering document control (GDP), physical environments (GMP), system validation (CSV), data integrity (ALCOA+), and training.
How does GAMP 5 classification affect the validation timeline?
GAMP 5 classification determines validation timelines by defining document scope. Category 3 systems require 3-5 days. Category 4 systems require 2-4 weeks to complete URS, configuration specifications, and IQ/OQ testing. Category 5 custom systems require 2-3 months due to code reviews and custom testing.
What is the difference between a System Impact Assessment and a Risk Assessment?
A System Impact Assessment (SIA) is a high-level classification process to determine whether a system is GxP or Non-GxP. A Risk Assessment (such as an FMEA) is performed after the system is determined to be GxP. The risk assessment evaluates specific functions and components within the system to identify potential failure modes and determine the depth of testing required.
Can we use electronic signatures for all GMP records?
Yes, electronic signatures can replace handwritten signatures, provided the system complies with FDA 21 CFR Part 11 and EU GMP Annex 11. The signatures must be secure, linked to their respective electronic records, and display the signer’s name, the date and time, and the meaning of the signature. Additionally, the system must maintain an independent audit trail.