In this post we would like to highlight the relevance of appropriate computer system classification based on GAMP 5 guidelines.
GAMP 5 establishes a framework for validating computerized systems in the healthcare sectors.
Computer systems should be properly classified in order to determine the amount of risk associated with
a system as well as the controls required to reduce those risks.
Those actions dictate the validation effort.
GAMP 5 divides computer systems into three categories: 3, 4, and 5.
(There is another category for software but it's for Infrastructure Software, Tools, and IT services)
Here is the definition of the different categories:
| Category 3 | Off-the-Shelf products used for business purposes, which includes systems that cannot be configured and that are configurable but for which only the default configuration is used. |
| Category 4 | Configurable software products that provide standard interfaces and functions that enable configuration of user specific business or manufacturing processes. This typically involves configuring predefined software modules and possibly developing further customized modules. |
| Category 5 | Customized systems are developed to meet the specific needs of the users. Custom development may be a completely new system or an extension to an existing system. Complex systems often have layers of software, with one system including components of several software categories; these are commonly treated as Category 5. |
V shape model Category 3
For example, UV system that runs on all the spectrumand user’s privileges can’t be changed.
V shape model Category 4
For example, UV system that I can billed different protocol with different light spectrums to fit my needs.
V shape model Category 5
For example, a QMS system that connects to a lab system to collect the date from there and when there is a deviation in the test automatically the QMS will open a deviation form.
As we have seen there is an impact for the different categories on the validation that is need to be performed.
So, let's go to the most important question, How do we determine what category, the system we have or the one we want to purchase?
In order to do that we will need first to determine whether this system have any impact on cGxP according to the following bullets:
- Automation or control any of: Manufacturing, Sterilization, Formulation, Labeling, Inventory, or Critical Environment Controls
- System will be an original source of data for the automation or control of any of: Manufacturing, Sterilization, Formulation, Labeling, Inventory, or Critical Environment Controls
- System will use raw and in-process material, clinical data analysis, automated inspection equipment and laboratory data system
- System is used to generate, manage and analyze data concerning Product Quality, Safety, Efficacy, Strength Stability or identify
- Supporting any GxP Functions such as Calibration, Maintenance Scheduling, and Quality Trending
- Manage market complaints or adverse event reporting or electronic document submission/reporting to regulatory agencies
- Handle Corrective Action and Preventative Action (CAPA), Change Controls, Incidents, Audits, testing, lab events
- Maintaining records of personnel training
- Maintaining copies of protocol pertaining to non-clinical study?
If your answer is No then great, we stop the process here.
If you have one answer of Yes, so the system is related to cGxP, and we should move to the next set of questions to decide the systems category.
- Was the system developed specifically for the company or any customization done to this application?
If your answer is yes then your system is Category 5
If not we will go to the next question
- Is the system a standard product developed by a Vendor where the System-Level Configuration is being modified (excluding Run-Time Configuration) to fit the company’s business process/flow?
If your answer is yes then your system is Category 4
If not we will go to the next question
- Is the software a standard product developed by a Vendor and is either
- not configurable or
- configurable but only the default configuration like run time? (Category 3 – Non-Configured)
If this is the correct then your system is Category 3
If You are not sure contact us for further assistance
This article was prepared by:
Rafael Port
Validation & Engineering Project Manager
