GAMP 5 is industry guidance, not a regulation. Regulators do not require it by name, but they recognise it widely as good practice for meeting computerised-system requirements such as 21 CFR Part 11 and EU GMP Annex 11. Its central idea is that validation effort should be proportionate to the risk a system poses to patient safety, product quality and data integrity — and should lean on what the supplier already does well.
Key concepts
- Product and process understanding — knowing what the system does in your process is the basis for every risk decision.
- A life cycle approach within your quality management system — concept, project, operation and retirement.
- Scalable life cycle activities — the depth of specification, testing and documentation scales with risk, complexity and novelty.
- Science-based quality risk management — focus effort on functions that affect patient safety, product quality and data integrity.
- Leveraging supplier involvement — use the supplier’s documentation, testing and expertise rather than repeating them.
GAMP software categories
GAMP 5 groups software into categories to guide the validation approach: Category 1 for infrastructure software, Category 3 for standard products used as supplied, Category 4 for configured products, and Category 5 for custom applications. The second edition stresses that categories are a starting point for risk-based thinking, not a substitute for it. A configurable platform like Swat iQua Suite is typically treated as a configured product, with your own assessment deciding how each function is handled.
Critical thinking and CSA
The second edition places critical thinking at the heart of validation and aligns with the Computer Software Assurance (CSA) approach promoted by the FDA: concentrate assurance activities on high-risk functions, use unscripted and exploratory testing where it fits, and avoid documentation that adds no value. Originally written for medical device production and quality system software, CSA principles are widely applied in pharma.