Computer system validation software — with the traceability built in.

Who validates what

Under 21 CFR Part 11, EU GMP Annex 11 and GAMP 5, validation is the regulated company’s responsibility: you define what the system must do for your process, assess the risk, and test proportionately. The supplier’s job is to build the system under control, provide the technical controls the regulations expect, and support your validation with evidence and expertise. Swat iQua Suite is designed around that split.

From scripted testing to assurance

Traditional CSV often meant exhaustive scripted protocols for every screen. FDA’s computer software assurance approach and GAMP 5 second edition both encourage critical thinking instead: establish the intended use, decide which functions directly affect product quality, patient safety or data integrity, and focus documented testing there — using lighter, unscripted testing where the risk is lower.

A typical risk-based lifecycle

1. Intended use and user requirements — what your processes need the system to do
2. Risk assessment — which requirements touch product quality, patient safety or data integrity
3. Configuration — sites, roles, workflows and masters set up and recorded
4. Verification — testing proportionate to risk, with evidence traced to each requirement
5. Release and periodic review — go-live sign-off, then change control, audit-trail review and periodic evaluation

Installation, operational and performance qualification (IQ, OQ and PQ) remain familiar milestones in many quality systems. Whether you keep that structure or move to a CSA-style approach, the evidence still needs to trace back to approved requirements — which is what the register is for.

Swat iQua Suite is designed to support a GAMP 5 risk-based validation approach. Validation of each installation remains the regulated company’s responsibility.

Audit trail — 21 CFR 11.10 and Annex 11

Every write and its audit-trail entry are committed in one database transaction, with old and new values, user, time, operating site and a mandatory reason. A read-only report spans every module’s logs, filterable by site, module, date, user and activity, with a cross-referenced trail across related records and logged PDF and Excel exports.

Electronic signatures — 21 CFR 11.50 and 11.200

Signatures re-authenticate the signer with a password, or a password plus a one-time code, configured per module and per site — three e-signature levels in all. Each signature records the signer’s name, designation at the time of signing and the time, bound to the action signed.

Access and authority checks

• A role-based permission matrix assigned per site, with every change logged — permissions added and removed
• Multi-factor login with an authenticator app or email code, and a password policy per site
• Forced password change at first login and on expiry; time-limited lockout after repeated failures
• Only internal, active users can perform GMP actions
• Segregation of duties enforced by the server in 25 modules

Periodic review and data integrity

Annex 11 expects audit trails to be reviewed and systems to be evaluated periodically. Risk-based audit-trail review runs flag deletions and voids, privileged changes, configuration changes, after-hours activity and changes after approval; the signals are frozen when the review starts so it can be reproduced, and findings can raise a CAPA. Evidence packages export with a SHA-256 checksum manifest.

Hosting and time

Swat iQua Suite is cloud-hosted, with encrypted connections, scheduled backups, automatic log archiving and your data stored in your chosen region. Every entry is time-stamped centrally and shown in the local time of the site where the work was done.