A shortcoming of this guidance is the lack of definition support for the basic terms ‘qualification’, ‘validation’, ‘off-the-shelf’, ‘good documentation practice (GDocP)’, and ‘computer software assurance (CSA)’ (see Appendix G2). One oversight, which the new guidance states is its prime directives in providing practical guidance on, is to ‘establish a common language and terminology’ used in the GxP sector. Once a meaningful risk rating is applied to a part of a system that is being validated (or the whole system), based on risks to patient safety, product quality, and data integrity, the system can be validated based on this risk.

A risk-based approach, a common term that is often misunderstood and misrepresented, simply means that validation is not meant to be applied to a system in broad strokes, but instead, used as a tool to identify where real focus of testing and documentation should be applied. Each company must create and maintain their own validation program, tailored for their own use, based on what the company does and what type of products and services they provide. Validation is really a practice of common sense and is not too complicated of an idea. I interpret this document as the minimum set of activities and actions that a GxP company should perform to increase their success factor when validating and managing a computerized system. First off, it is very important to note that GAMP®5 is not a regulation, and that following the ideas and guidance put forward in this document will not guarantee system compliance.

Gamp 5 guidelines pdf