A user requirements specification (URS) describes what the regulated company needs a system, piece of equipment or facility to do. It covers the intended use, the process the system supports, data and records, regulatory requirements such as audit trails and electronic signatures, security, interfaces, performance and any constraints. It is written from the user’s point of view, before a solution is chosen or configured.
Good requirements are specific, testable and uniquely identified, and they are classified by criticality — for example whether a requirement affects product quality, patient safety or data integrity. That classification drives how much verification each requirement needs later.
Why it matters in GMP
EU GMP Annex 11 expects user requirements to describe the required functions of a computerised system, based on a documented risk assessment, and to be traceable throughout the lifecycle. Annex 15 applies the same idea to equipment and facilities. Without a URS, validation has nothing to prove: qualification tests can only show that a system meets requirements that were written down.
- Involve QA, users, IT and engineering when writing it.
- Number every requirement so it can be traced to testing.
- Keep the URS under change control as needs evolve.
How Swat iQua Suite supports your validation
Swat iQua Suite’s computerised system assurance register holds approved requirements under version control with risk levels and e-signed approval, and traces each one to its test cases and executions, with a coverage report showing gaps. Combined with built-in Part 11 controls and support from our implementation team, it helps you connect your URS to the evidence that each requirement has been met.