GAMP 5 Second Edition (2022) provides the pharmaceutical industry's risk-based framework for validating computerised systems. It emphasises critical thinking, scalable evidence generation and alignment with FDA's Computer Software Assurance (CSA) approach — reducing scripted testing burden while maintaining inspection-ready evidence.
Software categories and validation effort
GAMP 5 classifies software from Category 1 (infrastructure — minimal validation) to Category 5 (custom software — maximum evidence). Most commercial MES, LIMS, QMS and ERP systems are Category 4 (configurable). Validation effort scales with category and the GMP risk of the intended use, not system size.
Critical thinking and CSA alignment
GAMP 5 Second Edition and FDA's CSA guidance both emphasise that validation evidence should focus on critical thinking — where are the risks? what could go wrong? — rather than scripted testing volume. Supplier test documentation can be leveraged to reduce in-house IQ/OQ testing. Validation effort concentrates on regulated functions: electronic records, audit trails, e-signatures and GxP calculations.
Key validation deliverables
A complete GAMP 5 Category 4 package includes: Validation Plan, User Requirement Specification (URS), Supplier Assessment Report, Configuration Specification (CS), IQ/OQ/PQ protocols and reports, Validation Summary Report, and ongoing change control and periodic review procedures.
How to use this page
Use this GAMP 5 Second Edition Validation Guide page as a planning checkpoint before vendor selection, architecture review, validation scoping or implementation sequencing. The strongest next step is to compare the guidance with your current SOPs, system inventory, batch records, data flows and QA review routines so the discussion starts from evidence instead of assumptions.
Evidence to prepare
For GAMP 5 Second Edition Validation Guide, prepare the records, owners, risks and decision criteria linked to software categories and validation effort, critical thinking and csa alignment, key validation deliverables. Useful evidence includes current process maps, interface lists, audit trail expectations, exception workflows, data retention rules and the business reason for changing the current operating model.
Frequently asked questions
What is the difference between GAMP 5 Category 4 and Category 5 validation?
Category 4 covers configurable commercial software such as MES, LIMS, QMS, and ERP. Validation focuses on configuration specifications and testing that the configured system performs its GxP functions correctly — supplier documentation is used extensively. Category 5 covers custom software where source code review and more rigorous testing of all custom functions is expected. Most commercial pharmaceutical software is Category 4. Custom integrations, scripts and bespoke applications handling regulated data should be assessed as Category 5.
What is Computer Software Assurance (CSA) and how does it relate to GAMP 5?
FDA's Computer Software Assurance (CSA) guidance (released 2022) is a risk-based approach that explicitly discourages excessive scripted testing and IQ/OQ documentation for low-risk functions. It aligns with GAMP 5 Second Edition's critical thinking approach — both focus validation effort on functions critical to product quality, patient safety and data integrity. Under CSA, teams can leverage supplier test documentation, reduce scripted protocols, and document their critical thinking rationale rather than executing testing for well-understood low-risk configurations.
Does GAMP 5 validation need to be repeated when a validated system is upgraded?
Not necessarily. GAMP 5 supports a change control approach to upgrades: assess the impact of the upgrade on validated functions, execute regression testing for affected critical functions, update the Configuration Specification and generate an amended Validation Summary Report. If the upgrade does not touch GxP-critical configurations — for example, a security patch or infrastructure update — a reduced validation scope with an impact assessment memo may be sufficient.