Which regulations does the assessment benchmark against?
EU GMP Annex 11, 21 CFR Part 11, PIC/S PI 041-1 and the FDA Data Integrity and Compliance with Drug CGMP Q&A (2018). Risk is ranked using ICH Q9(R1).
Data Integrity & CSV Gap Assessment for Pharmaceutical Automation Systems
For pharmaceutical plants running or upgrading SCADA, cleanroom BMS/EMS, historians, equipment data capture or batch record systems, which need to know where the gaps are before an inspection or a modernisation investment.
What we assess — five control areas
Each in-scope system is scored across five control areas and benchmarked against EU GMP Annex 11, 21 CFR Part 11, PIC/S PI 041-1 and the FDA Data Integrity and Compliance with Drug CGMP Q&A (2018). Risk is ranked using ICH Q9(R1).
- Access & accounts — individual accounts, role-based privileges, administration separated from operators
- Audit trail — what is captured (old/new value, who, when, why), who reviews it and how often
- Time & original data — NTP synchronisation, location of original records, behaviour on network loss
- Backup, archive, restore — tested restores and defined retention periods
- Change control & validated state — configuration and software change control, risk-based revalidation
Approach
Four steps. 1) Pre-visit review of the system inventory, architecture and SOPs. 2) On-site work — interviews with operations, QA and IT/OT, plus live checks on the systems. 3) Scoring per system across the five areas, with gaps ranked by GMP data risk. 4) Report and debrief with plant management and QA.
Deliverables
The engagement delivers a gap report per system with the applicable regulatory clause for each finding, a risk heatmap across the five control areas, and a 30/90/180-day remediation roadmap split into SOP-only fixes, configuration fixes and system upgrades. Scope is agreed after an initial call — contact us for a quotation.
Who delivers it
Nam Pham (Phạm Đức Phương Nam): GMP Pharma Automation Engineer and Sales Manager at ESTC (ESEC Group). More than 10 years in EMS/BMS/SCADA/MES/CSV in Vietnam, working in GxP environments since 2018. Member of ISPE and ISA, with a published contribution to ISPE Pharmaceutical Engineering (iSpeak). The assessment scope covers the automation layer — SCADA, BMS/EMS, historians, equipment data capture and batch record systems. ESTC signs the contract and delivers the engagement.
- Relevant training: Foundations of GMP (USP, 10/2026)
- Scilife GxP courses (10/2026): EU GMP Annex 11, Data Integrity & Governance, CAPA, Deviation & RCA, QRM, GxP records management
- Credentials and memberships on the About page see
- Contact: nam.pham@esec.vn
Regulatory references
Benchmarks are the primary regulatory sources, not secondary commentary: EudraLex Volume 4 Annex 11 (2011) — "This annex applies to all forms of computerised systems used as part of a GMP regulated activities"; 21 CFR 11.1(b); PIC/S PI 041-1 §9.5 — "Shared login credentials do not allow for traceability to the individual who performed the activity"; ICH Q9(R1) (2023) for risk ranking; and the FDA Data Integrity and Compliance with Drug CGMP Q&A (December 2018).
Frequently asked questions
Who performs the assessment?
Nam Pham — GMP Pharma Automation Engineer and Sales Manager at ESTC — performs the assessment within his automation-layer scope (SCADA, BMS/EMS, historians, equipment data capture and batch record systems). ESTC signs the contract and delivers the engagement.
What does the engagement deliver?
A gap report per system citing the applicable regulatory clause for each finding, a five-area risk heatmap, and a 30/90/180-day remediation roadmap covering SOP-only fixes, configuration fixes and system upgrades.
How are scope and pricing defined?
Scope is agreed after an initial call based on your system inventory and risk profile. Pricing is provided in a quotation after that call — this page does not list prices.