What is a pharma LIMS? Features, compliance and how to choose (2026 guide)

Sample and testing management

Samples should be registered once and then move through defined states — pending, in testing, in review, in approval, completed — with the specification version frozen at registration. If someone revises the specification while the sample is open, the sample must still be tested against the version that applied when it was registered.

Specification management

Specifications are controlled documents. Look for versioned approval with review and approval by different people, alert and action limits, method trees and a clear history of what changed between versions. Multi-site groups also need a way to share a global specification read-only while allowing a controlled local copy.

Stability studies

A stability module should calculate pull dates from time zero for each storage condition, block pulls until the protocol is approved, flag late pulls and turn each pull into a laboratory sample. Trend and shelf-life reporting in line with ICH Q1E saves weeks of spreadsheet work at the end of a study.

Instruments, reagents and standards

Calibration and maintenance records should be append-only, with due dates recalculated from the records themselves. The strongest systems stop an analyst from using an instrument that is out of calibration. Reagents, columns and reference standards need expiry tracking and controlled labels.

Environmental monitoring

Sterile sites need cleanrooms, monitoring points, versioned alert and action limits, excursion handling and gowning qualification records — ideally in the same system as testing, so an excursion can block what it should block.

CoA and reporting

The CoA should be generated from approved results, not typed. Contract labs also need a client-facing way to request testing and download released reports.

No regulation says “you must buy a LIMS”. What the regulations require is that laboratory records are complete, accurate, attributable and protected — and once those records are electronic, the controls for computerised systems apply.

• 21 CFR 211.194 (US) sets out what laboratory records must contain, including a complete record of all data from each test and the initials or signature of the person who performed and the person who reviewed the test.
• 21 CFR Part 11 covers electronic records and signatures: validation, audit trails, access control and signature controls.
• EU GMP Annex 11 (UK, EU and PIC/S) covers computerised systems: risk management, validation, data checks, audit trails, security and periodic review.
• ALCOA+ — attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available — is the data-integrity language MHRA, FDA, WHO and PIC/S inspectors use.
• Revised Schedule M (India) and WHO GMP both expect controlled laboratory records, OOS investigation and qualified equipment.

Software on its own cannot be “Part 11 compliant”. Compliance comes from a system designed with the right controls, validated for your intended use and operated under your procedures. Be wary of any vendor that claims otherwise.

Data-integrity controls worth testing in a demo

• Can a submitted result be edited? It should lock, with send-back to the analyst as the only route to change it.
• Is every change recorded with old value, new value, user, time and reason?
• Can the analyst also review or approve their own result? The system should refuse — with no admin bypass.
• Where is the original instrument or spreadsheet file kept, and can it be altered?
• Can an auditor filter the audit trail by record, user and date, and export it?

Instrument integration is often where LIMS projects stall. Direct interfacing with every balance, HPLC and dissolution bath is expensive to build and to validate, and many laboratories still transcribe results by hand — which is exactly what data-integrity inspectors look for.

A practical middle path is controlled result import. The instrument or chromatography software exports a file; the LIMS imports it only through an approved import profile, shows a preview without saving anything, and commits the values with a reason. The original file is retained unaltered as raw data, and every value is still reviewed by a second person before it counts.

Ask any vendor exactly how results reach the GMP record: typed, imported through a controlled profile, or delivered over an API. Then ask how the raw file is protected and how you would show an inspector the link between the file and the reported value.

1. Map your real workflows first — sample types, test routes, review steps, stability and EM — and score vendors against them, not against a generic feature list.
2. Check segregation of duties: analyst, reviewer and approver must be different people, enforced by the server.
3. Check specification control: versioning, freeze at registration, and what happens to open samples when a specification changes.
4. Check how results get in: manual, controlled file import or API — and how raw data is preserved.
5. Check the audit trail from an inspector’s point of view: readable, filterable, exportable, with reasons.
6. Check e-signatures: re-authentication at signing, and the name, meaning and date shown on the signed record.
7. Check what else connects: OOS and lab investigations, CAPA, deviations, training and batch release. Every hand-off between separate systems is a reconciliation risk.
8. Check hosting and security: multi-factor login, role-based access, backups and where your data is stored.
9. Check validation support: what documentation and help the vendor provides, and what remains your responsibility.
10. Check the rollout: realistic go-live timeline, data migration from your current records and training.

Standalone LIMS or integrated suite?

A standalone LIMS can be the right choice for a pure testing laboratory. Manufacturers usually find that the hard problems sit at the boundaries — an OOS result that needs a CAPA, a material that cannot be released until QC approves it, an EM excursion that should hold a batch. If your LIMS, QMS and batch records are separate, those links live in email and spreadsheets.

• Buying for the demo dataset instead of your own sample types and test routes.
• Assuming the vendor’s validation pack means you do not need to validate for your intended use.
• Treating instrument integration as a phase-one requirement, then stalling the whole project on it.
• Ignoring the contract-lab or multi-site needs you will have in two years.
• Leaving data migration to the end, so historical specifications and results never make it across.

Swat iQua Suite includes a LIMS designed for pharmaceutical QC, built on the same platform as its quality management, batch records and release modules. It is designed to comply with 21 CFR Part 11, EU GMP Annex 11, WHO GMP and Revised Schedule M, following ALCOA+ data-integrity principles.

• Sample and testing management from registration to CoA, with the specification version frozen at registration and results locked once submitted.
• Server-enforced segregation of duties: reviewer ≠ analyst, approver ≠ analyst and reviewer, with no admin bypass, and optional e-signatures on approval.
• Controlled result import from Excel/CSV and instrument files through approved import profiles — preview, then commit with a reason — plus a secure REST API. Raw data is stored with a SHA-256 checksum and logged downloads.
• Versioned specifications with e-signed review and approval, alert and action limits and cross-site sharing.
• Stability studies with server-computed pull schedules, late-pull flags and ICH Q1E trend and shelf-life reporting.
• Instrument calibration and maintenance with append-only records, due-date reminders and an optional block on uncalibrated instruments.
• Environmental monitoring with versioned limits, gowning qualification and excursions that raise a deviation.
• Reagent and standard inventory with expiry tracking and controlled labels, and a client portal for contract testing labs.

Because the LIMS shares one audit trail with the rest of Swat iQua Suite, an OOS investigation, its CAPA and the batch release decision are linked records rather than separate files. Typical go-live is 1–3 months, depending on the modules and sites in scope.