Computer system validation (CSV) — “computerised system validation” in EU texts — is the process of establishing documented evidence that a computerised system used in GMP activities consistently does what it is intended to do. It covers the software, the configuration, the infrastructure it runs on, the procedures around it and the people who use it.
A typical validation lifecycle starts with user requirements (URS), assesses risk, verifies the system against those requirements through installation, operational and performance qualification or equivalent risk-based testing, and ends with a validation report and release for use. The validated state is then maintained through change control, periodic review and incident management until the system is retired.
Why it matters in GMP
21 CFR 11.10(a) requires validation of systems that hold electronic records, and EU GMP Annex 11 requires computerised systems to be validated on the basis of risk. Software cannot arrive “pre-validated”: validation always relates to the intended use in a particular company, although supplier documentation and testing can be leveraged to reduce effort.
- Define intended use and requirements before testing.
- Focus testing on functions that affect product quality, patient safety and data integrity.
- Keep a traceability matrix from each requirement to its verification.
How Swat iQua Suite supports your validation
Swat iQua Suite is designed to support compliance with Part 11 and Annex 11 — audit trails, e-signatures, access control and segregation of duties are built in. Its computerised system assurance register keeps approved requirements with risk levels, traces them through to test cases and executions, and reports coverage and gaps. Our implementation team supports your validation activities during the 1–3 month go-live.