Ultimate GxP Compliance Checklist & System Impact Assessment Guide

In the pharmaceutical manufacturing sector, maintaining compliance with GxP guidelines (Good Manufacturing Practice - GMP, Good Documentation Practice - GDP, and Good Laboratory Practice - GLP) is the thin line between safe product distribution and severe regulatory findings. A structured, evidence-based compliance program is a vital operational tool to ensure that equipment, computerized systems, and data infrastructures remain in a permanent state of control.

Too often, sites treat compliance as a reactive scramble before an audit, or they fall into the trap of "checkbox compliance"—blindly marking "yes" or "no" without verifying the underlying engineering truth. For computerized systems, this passive approach leads directly to inspection observations, data integrity breaches, or massive project delays.

This guide provides an inspection-ready framework designed for quality assurance (QA) professionals, automation engineers, and plant IT managers. Written from the perspective of an automation practitioner with 11 years of hands-on GMP delivery experience, it outlines the core methodology of GxP System Impact Assessments, software classification under GAMP 5, gap remediation, and continuous validation.

1. The Practical Nature of GxP System Impact Assessment (SIA)

A GxP System Impact Assessment (SIA) is the initial gateway in any validation lifecycle. It is the formal process used to evaluate whether a computerized system, software package, or physical equipment has a direct or indirect impact on patient safety, product quality, or data integrity.

Under the Quality Risk Management (QRM) principles outlined in ICH Q9, validation effort must be proportional to the level of risk a system poses to the patient and the product. Performing an SIA prevents two major operational failure modes: 1. Under-validation: Failing to validate a system that directly influences critical process parameters (CPPs) or stores electronic batch records, leaving the site vulnerable to regulatory actions. 2. Over-validation: Treating non-GxP systems with the same level of testing and change control as a chromatography system, wasting engineering hours and slowing system deployment.

An effective SIA must be executed by a cross-functional team comprising the Process Owner, the System Owner, and QA Validation. Rather than relying on subjective opinions, the team must use a structured, reproducible decision-making process to establish the GxP boundary.

For sites seeking to build a robust foundation for their computerized systems, leveraging experienced computer system validation services can help align engineering practices with regulatory expectations.

2. GxP Decision Tree & System Classification

To remove subjectivity from the GxP assessment, organizations must implement a clear decision tree. If a system meets any of the criteria in the decision tree, it is classified as "GxP Impact" and must enter the Computerized System Validation (CSV) lifecycle.

The classification decision tree operates on four core regulatory pillars:

flowchart TD
    Start([Evaluate System / Software]) --> Q1{Pillar 1: Safety<br>Does it affect patient safety?}
    Q1 -- Yes --> GxP([GxP Impact - CSV Required])
    Q1 -- No --> Q2{Pillar 2: Quality<br>Does it monitor/control product quality?}
    Q2 -- Yes --> GxP
    Q2 -- No --> Q3{Pillar 3: Data Integrity<br>Does it generate/store primary GxP records?}
    Q3 -- Yes --> GxP
    Q3 -- No --> Q4{Pillar 4: ERES<br>Does it use electronic signatures?}
    Q4 -- Yes --> GxP
    Q4 -- No --> NonGxP([Non-GxP - Standard IT Controls])

• Pillar 1: Patient Safety: Does the system control, monitor, or execute a process that could directly cause harm to the patient if it fails (e.g., sterilization cycles or distribution temperature tracking)?
• Pillar 2: Product Quality & Critical Process Parameters (CPPs): Does the system measure or log parameters defining product identity, strength, quality, purity, or potency (e.g., a PLC managing bioreactor pH)?
• Pillar 3: Data Integrity & Primary Records: Does the system generate, modify, archive, or retrieve data that supports release decisions, batch history, stability studies, or laboratory analyses? Under the FDA 21 CFR Part 211 GMP regulations, any record used to demonstrate compliance must be secure and fully traceable.
• Pillar 4: Electronic Records & Electronic Signatures (ERES): Does the system utilize electronic records or electronic signatures in place of paper records and hand-written signatures? Under FDA 21 CFR Part 11 and EU GMP Annex 11, ERES controls must be validated to ensure the records are authentic, trustworthy, and equivalent to paper.

If the answer to all four pillars is a verified "No", the system is classified as Non-GxP. It does not require formal CSV, but it must still be managed under standard IT controls (such as regular backups and basic user access management).

3. GAMP 5 Category Selection & Validation Scope

Once a system is identified as GxP, the next step is to categorize the software. The International Society for Pharmaceutical Engineering (ISPE) publishes the GAMP 5 Guide 2nd Edition, which provides a risk-based framework for categorizing GxP software.

The software category directly determines the depth of the validation deliverables, the extent of supplier assessment required, and the testing strategy. GAMP 5 defines four active software categories:

• Category 1: Infrastructure Software: Operating systems, database engines, virtualization, and network tools. These are qualified as part of IT Infrastructure Qualification rather than validated individually.
• Category 3: Non-configured Software: Off-the-shelf packages used without configuration, such as laboratory balance software or simple controllers.
• Category 4: Configured Software: Applications configured to match business processes without custom code, including LIMS, QMS, SCADA, and MES (e.g., configuring user groups, workflows, and alarms).
• Category 5: Custom (Bespoke) Software: Software containing custom code, such as bespoke PLC logic, script integrations, or custom macros for lab data analysis.

To design a tailored validation framework that covers these categories without creating unnecessary overhead, consult the strategies outlined in our GxP compliance and validation playbook.

Table 1: GAMP Category vs. Validation Scope

4. GxP Assessment Checklist: 5-Step Gap Process for New Systems

When introducing a new software package or computerized system into a GxP environment, QA and automation teams must execute a structured gap assessment. This process ensures that compliance gaps are identified and remediated before the system is commercialized or used in active production.

flowchart LR
    Step1[1. Boundary Definition] --> Step2[2. System Impact]
    Step2 --> Step3[3. GAMP Class]
    Step3 --> Step4[4. Regulatory Map]
    Step4 --> Step5[5. Val Strategy]

1. Step 1: System Definition & Boundary Mapping: Detail the physical hardware, software components, database architecture, and human-machine interfaces. Identify all interfaces where data is imported or exported, as these integration points represent high-risk data integrity vulnerabilities.
2. Step 2: System Impact Assessment (SIA): Apply the GxP Decision Tree. Document the answers to the four pillars (Safety, Quality, Data Integrity, ERES) and compile the results into a formal SIA report, which must be signed by the Process Owner, System Owner, and QA.
3. Step 3: GAMP 5 Categorization & Supplier Assessment: Evaluate the software and assign the appropriate GAMP 5 category. Simultaneously, perform a supplier quality assessment of the vendor’s QMS, development practices, and support capabilities.
4. Step 4: Regulatory Mapping (21 CFR Part 11 & Annex 11 Gap Analysis): Map the system’s technical capabilities against regulatory requirements. Focus on data integrity, access control, audit trails, and data preservation. Verify that the system prevents unauthorized data deletion or modification.
5. Step 5: Validation Strategy & Protocol Drafting: Define the validation plan. Based on the GAMP category and the regulatory gaps identified in Step 4, outline the testing requirements. Identify the protocols needed (IQ, OQ, PQ) and establish the change control baseline.

5. Remediation Strategy & GxP CAPA Roadmap

Discovering gaps during a system assessment is common, especially with legacy systems. Identifying a gap is not a failure; failing to document, prioritize, and remediate it is.

Every identified gap must be logged in a centralized Gap Register and evaluated using a Failure Mode and Effects Analysis (FMEA) approach to determine risk priority. Gaps are then addressed through a formal Corrective and Preventive Action (CAPA) roadmap.

The remediation strategy follows three pathways: 1. Technical Remediation: Updating software configurations, enabling native compliance features, upgrading firmware, or applying patches. 2. Procedural Remediation: Establishing SOPs to govern actions that the software cannot enforce (e.g., dual-operator verification or manual paper logbooks). 3. Architectural Remediation: Redesigning the system layout to isolate risk (e.g., moving database storage from a local PC to a secured network share).

Table 2: GxP Risk Prioritization Matrix (FMEA-based)

| SOP forbidding credential sharing; disciplinary action framework; periodic user audit logs review. | | Missing Audit Trail (Legacy System) | High | Medium | High | Upgrade software version supporting electronic audit trails.

| Implement paper run-logs. Implement dual-operator verification at critical process steps. | | Writable Database Files (Local OS Access) | High | Medium | High | Revoke local OS access. Restrict folder permissions using IT domain security policies.

| Annual independent IT security sweep. Database backup checks. | | Lack of NTP Time Sync (Clock Drift) | Medium | High | Medium | Configure NTP client to sync with site master clock. Lock local Windows clock settings.

| Daily manual check of system time vs. master time logged on batch record. | | Manual Data Transcription (HPLC to LIMS) | Medium | Medium | Medium | Build validated software interface (API/ETL) to transfer files directly.

| QA review of 100% of transcribed values against raw instrument printouts. | | Missing Backup Verification | Medium | Low | Low | Automate daily backups. Configure automated email notifications for backup failures.

| Documented monthly backup restoration tests on test environment. |

To maintain compliance and track long-term trends, sites should manage these controls within their overall regulatory compliance standards framework.

6. Case Study: Continuous Validation in SaaS Auto-Update Scenarios

In the era of cloud computing, many software vendors have migrated to Software-as-a-Service (SaaS) models. A major challenge in SaaS deployments is the vendor’s auto-update policy. In traditional on-premise deployments, the pharmaceutical site had complete control over if and when a patch was applied. In a SaaS environment, vendors often push updates automatically. If a system update is applied without validation, the system’s validated state is technically compromised.

The Strategy: Continuous Validation

To maintain compliance without blocking software access, organizations must shift from "periodic validation" to a "continuous validation" framework. This case study details how a site successfully qualified a cloud-based QMS with quarterly auto-updates:

sequenceDiagram
    participant Vendor as SaaS Cloud Vendor
    participant QA as Site QA & CSV Team
    participant Sandbox as Validated Sandbox
    participant Prod as Production Environment

    Vendor->>QA: 1. Release Notes & Impact Assessment (30 days prior)
    QA->>Sandbox: 2. Deploy Update to Sandbox
    QA->>Sandbox: 3. Run Automated Regression Test Suite
    QA->>QA: 4. Review Testing Results & Document Deviations
    QA->>Prod: 5. Approve Change Control & Release Production
    Vendor->>Prod: 6. Deploy Update to Production

1. Vendor Quality Agreement (SLA) & Notification Cadence

The site established a Quality Agreement contractually requiring the vendor to provide release notes 30 days prior to deployment, and a dedicated "Sandbox" environment 15 days before production release.

2. Automated Regression Testing (The Technical Control)

Because manual validation of the entire system quarterly was impossible, the site developed selenium-based automated regression tests. Executed in the Sandbox, these tests simulated critical user pathways (creating deviations, approving CAPAs) in 45 minutes, generating screenshots and verification PDFs.

3. Change Control & Impact Assessment (The Process)

The validation team analyzed the vendor release notes to determine if the update introduced new GxP features. Non-GxP updates were logged under a minor change control with minimal testing documentation. GxP-affecting updates were verified using targeted automated scripts, and the Configuration Specification was updated.

By combining vendor notifications, sandbox testing, and automated scripts, the site reduced the validation timeline for each quarterly release from 20 working days to 2 working days.

7. Actionable GxP Compliance & Inspection-Readiness Checklist

Use this checklist to evaluate your site’s current compliance status. To satisfy regulatory inspectors, teams must present objective evidence for every control.

The following checklist maps key control areas to required proof and regulatory references, including the data management guidelines in PIC/S PI 041-1.

Table 3: The Complete GxP Compliance & Evidence Checklist

| EU GMP Chapter 4,
FDA 21 CFR 211.180 | Master index of controlled documents; signed approval blocks; archived obsolete files. | | GDP-02 | GDP Documentation | Deviation and CAPA Control: All deviations are investigated, and CAPAs are verified for effectiveness.

| EU GMP Chapter 4,
FDA 21 CFR 211.192 | Closed deviation reports with root cause analysis; CAPA verification protocols. | | CAL-01 | Physical Environment | Calibration Traceability: Critical sensors are calibrated against national standards (NIST).

| FDA 21 CFR 211.160,
EU GMP Chapter 3 | Calibration certificates showing NIST traceability; calibration stickers on sensors with due dates. | | CAL-02 | Physical Environment | Environmental Monitoring: Temperature, humidity, and particle counts remain within limits.

| EU GMP Annex 1,
FDA 21 CFR 211.42 | Continuous monitoring logs; differential pressure logs; cleanroom particle count certificates. | | CSV-01 | System Validation | URS & Risk Assessment: Every computerized GxP system has a URS and GAMP risk assessment.

| EU GMP Annex 11,
GAMP 5 2nd Ed | Approved URS; System Impact Assessment; Functional Risk Assessment (FMEA) document. | | CSV-02 | System Validation | IQ/OQ/PQ Execution: Test protocols are completed, signed, and summarize deviations.

| EU GMP Annex 11,
FDA 21 CFR 211.68 | Executed IQ/OQ/PQ test scripts with raw printouts; signed Validation Summary Report (VSR). | | CSV-03 | ERES Controls | Access Control: Unique credentials are required for all users; shared logins are disabled.

| FDA 21 CFR Part 11,
EU GMP Annex 11 | User privilege matrix; Active Directory policy settings; printout of local user registry. | | CSV-04 | ERES Controls | Electronic Signatures: E-signatures include name, timestamp, and signature meaning.

| FDA 21 CFR Part 11,
EU GMP Annex 11 | System configuration screen showing signature settings; sample printed batch report with signed blocks. | | DAT-01 | Data Integrity | Audit Trail Integrity: Audit trails are enabled and cannot be disabled by operators.

| PIC/S PI 041-1,
FDA 21 CFR Part 11 | Admin security role configurations; test log demonstrating an operator account cannot disable logging. | | DAT-02 | Data Integrity | Audit Trail Review: A defined schedule exists for reviewing audit trails before batch release.

| PIC/S PI 041-1,
EU GMP Annex 11 | SOP governing audit trail reviews; signed batch release checklist verifying audit trail review. | | DAT-03 | Data Integrity | Time Synchronization: All GxP clocks sync to a central NTP time source.

| PIC/S PI 041-1,
EU GMP Annex 11 | Network diagram showing NTP master configuration; local registry clock-source settings. | | DAT-04 | Data Integrity | Disaster Recovery & Backup: Automated backups run daily and are verified via restoration tests.

| FDA 21 CFR 211.68,
EU GMP Annex 11 | Backup logs; off-site storage receipts; signed annual backup restoration test report. | | HR-01 | Training & Vendor | Training Records: Training profiles match current SOP versions before operator executes tasks.

| FDA 21 CFR 211.25,
EU GMP Chapter 2 | Training matrix; individual training records; system login timestamped after training completion. | | HR-02 | Training & Vendor | Vendor Qualification: Critical system vendors are audited or qualified at least every 3 years.

| EU GMP Annex 11,
GAMP 5 2nd Ed | Signed Vendor Audit Report or completed supplier qualification questionnaire. |

8. Quy chuẩn GxP Áp dụng Riêng cho Thị trường Việt Nam

Đối với các nhà máy sản xuất Dược phẩm tại Việt Nam, ngoài việc tuân thủ các chuẩn mực quốc tế như EU-GMP hay FDA, việc đáp ứng các quy định của Cục Quản lý Dược (DAV) là bắt buộc. Đặc biệt đối với hệ thống máy tính và đánh giá rủi ro, các tài liệu sau cần được tích hợp vào danh mục kiểm tra:

Sự khác biệt lớn nhất khi triển khai GxP tại Việt Nam là việc kết nối dữ liệu từ các hệ thống sản xuất cục bộ (SCADA/HMI) lên hệ thống báo cáo quản trị, phục vụ việc thanh tra trực tiếp của chuyên viên Cục Quản lý Dược.

9. Downloadable Resource

GxP System Impact Assessment & Classification Template (Excel)

To help your team transition from theory to execution, we have developed a downloadable GxP System Impact Assessment & Classification Template (Excel).

This professional spreadsheet includes: * Pillar-based questionnaires: Automated scoring sheets mapping to Safety, Quality, Data Integrity, and ERES controls. * GAMP 5 Classification Engine: Input system features (e.g., custom code, workflow configurations, default settings) to automatically determine the GAMP Category (1, 3, 4, or 5). * Deliverable Generator: A dynamic tab that generates a list of mandatory validation deliverables (URS, FS, CS, SDS, IQ/OQ/PQ, VSR, Code Review) based on the determined system risk profile.

This template serves as a standardized record to document system impact decisions during internal audits and regulatory inspections.

10. Frequently Asked Questions

What is a GxP compliance checklist?

A GxP compliance checklist is an operational tool assessing a site’s alignment with Good Practice standards, covering document control (GDP), physical environments (GMP), system validation (CSV), data integrity (ALCOA+), and training.

How does GAMP 5 classification affect the validation timeline?

GAMP 5 classification determines validation timelines by defining document scope. Category 3 systems require 3-5 days. Category 4 systems require 2-4 weeks to complete URS, configuration specifications, and IQ/OQ testing. Category 5 custom systems require 2-3 months due to code reviews and custom testing.

What is the difference between a System Impact Assessment and a Risk Assessment?

A System Impact Assessment (SIA) is a high-level classification process to determine whether a system is GxP or Non-GxP. A Risk Assessment (such as an FMEA) is performed after the system is determined to be GxP. The risk assessment evaluates specific functions and components within the system to identify potential failure modes and determine the depth of testing required.

Can we use electronic signatures for all GMP records?

Yes, electronic signatures can replace handwritten signatures, provided the system complies with FDA 21 CFR Part 11 and EU GMP Annex 11. The signatures must be secure, linked to their respective electronic records, and display the signer’s name, the date and time, and the meaning of the signature. Additionally, the system must maintain an independent audit trail.