Computerized system validation: the GAMP 5 method, step by step
"The software needs to be validated." The sentence often comes up at the end of a project, as a box to tick, and then takes on disproportionate dimensions. It is in fact a structured process, and GAMP 5, the industry's reference guide, exists precisely to avoid spending too much effort in the wrong place. Here is what validation covers, and how GAMP 5 puts it in order.
What do the regulations require, and where does GAMP 5 fit in?
No text imposes GAMP 5: the frameworks require a validation, and GAMP 5 proposes a way to carry it out. In other words, the regulations set the result and the guide organizes the approach. Three notions frame the subject.
- GAMP 5
- Good Automated Manufacturing Practice, 5th edition: a good practice guide published by ISPE (second edition, 2022) for the validation of computerized systems in GxP environments. It is an industry guide, not a regulation or an enforceable standard; it proposes a risk-proportionate approach, not a list of obligations.
- GAMP software categories
- A classification that adapts the validation effort to the nature of the software: category 1 (infrastructure software), 3 (standard product used as is, not configured), 4 (product configured to your process, such as a configured LIMS, MES or ERP), 5 (custom development). The higher the category, the broader the demonstration expected.
- V-model
- The representation that links each level of specification to its level of verification: the URS (user requirements) to performance qualification (PQ), the functional specification to operational qualification (OQ), the design or configuration to installation qualification (IQ). GAMP 5 accepts it as one form among others, including iterative cycles.
| Framework | What it requires in practice |
|---|---|
| ISO 13485 | Document and apply the validation of the application of the software used in the quality system and in production, in proportion to the risk associated with its use. The standard cites neither GAMP nor a mandatory IQ/OQ/PQ model. |
| MDR / IVDR & 21 CFR Part 11 | They require control and integrity of records and, for systems within the scope of Part 11, validation of the systems concerned. They prescribe properties, not a methodology. |
| GAMP 5 (ISPE) & FDA CSA | GAMP 5 is an industry guide that structures a risk-proportionate validation; the FDA Computer Software Assurance guidance (2026) points in the same direction. You rely on these methods; you do not endure them as obligations. |
Operational summary: it replaces neither reading the texts nor the opinion of your regulatory affairs lead. Start by determining which frameworks apply to your organization.
What should you do? CSV in six steps
GAMP 5 follows a life cycle: specify, categorize, assess risk, verify, trace, maintain. Taken in the right order, it avoids both undersizing and a mountain of useless documents.
- Write the URS (user requirements specification) before choosing the tool, and categorize the software according to GAMP (1, 3, 4 or 5): that category and the risk size everything else.
- Carry out a risk analysis based on the intended use and the impact of a failure on the product and the patient, then a more detailed analysis of the critical functions.
- Reuse what the supplier has already demonstrated (development documentation, tests, version management), after assessing its quality and relevance; GAMP 5 explicitly encourages this.
- Carry out proportionate verification activities: IQ/OQ/PQ following the V-model, or a CSA-style risk-based approach focused on the functions whose failure matters.
- Trace each URS requirement to its test with a traceability matrix, and conclude with a validation report that rules on fitness for use.
- Maintain the validated state: change control, impact analysis of updates, periodic review. A validation frozen at go-live goes out of date.
A vendor that documents its GAMP category and supports you
Arianis is a product configured to your settings, typically category 4 in GAMP terms. Cerebellis provides the documentation and the method to carry out the CSV within your quality system, instead of leaving you to start from a blank page.
- Development documentation, version management and release contents, reusable in your validation file.
- CSV support: URS, risk analysis, IQ/OQ/PQ protocols or a risk-based approach, and traceability matrices.
- Time-stamped audit trail, named accounts and permissions per module: the integrity properties expected of records.
- Designed, developed and hosted in France; the validation remains yours, but you carry it out with a vendor that knows it well.
The Cerebellis software related to this topic
Further reading
Software for regulated production: ISO 13485, MDR and 21 CFR Part 11
No software is "ISO 13485 certified": what the frameworks require concerns your records and a validation you remain responsible for.
Medical device traceability: reconstruct a lot in seconds
What ISO 13485 and the MDR require of lot traceability, the six practical requirements to meet, and a simple test to see where yours stands.
Producing PMS and PSUR reports without rebuilding the data by hand
A PSUR links exposure, incidents, trends and actions. Why this data lives in two systems, production and quality, and how to bring it together to produce the report without re-entry.