What is computer system validation (CSV)?
Computer system validation (CSV) is the documented proof that a computer system used in a GxP process does what it is meant to do, reliably and every time. GxP is the umbrella term for good practice rules such as GMP and GDP. The company that uses the system is responsible for validating it, to a depth that matches the risk to patients, product quality and data. Software suppliers contribute documentation and tests, but they cannot validate the system on your behalf.
Source: EudraLex Volume 4, EU GMP Annex 11: Computerised Systems
T. LozerCompliance Strategy Specialist · entroit GmbH
· Updated
Where computerised system validation is required
In the EU, EU GMP Annex 11 states that applications used in GMP-regulated activities are validated and the IT infrastructure behind them is qualified. The EU GDP guidelines ask wholesalers to show, before a system goes live, that it produces accurate, consistent and reproducible results. In the US, 21 CFR Part 11 requires validation of systems that hold electronic records.
A risk-based approach
Annex 11 asks you to base the extent of validation on a justified and documented risk assessment. A function that releases batches or blocks stock needs more testing than a report layout. Standard software that you only configure usually needs less testing than code written for you. Many companies follow GAMP 5, an industry guide that sorts software into categories and scales the effort accordingly.
The steps of a validation
| Step | What it proves |
|---|---|
| User requirements | What the system must do in your processes, based on risk |
| Supplier assessment | That the supplier develops and maintains the software under a suitable quality system |
| Installation qualification (IQ) | The system is installed and set up as specified |
| Operational qualification (OQ) | The functions work as intended across their expected range |
| Performance qualification (PQ) | The system works reliably in your real processes, with your data and users |
| Validation report | The results, deviations and the decision to release the system for use |
Validation does not end at go-live. Changes go through change control, and you evaluate the system periodically to confirm it is still in a validated state.
Who is responsible
The regulated company owns the validation, not the vendor. Annex 11 requires formal agreements that define what a supplier does, and it expects you to review the supplier’s documentation against your own requirements. A supplier’s test protocols save you work; they do not replace your own judgement.
What CSV means for your ERP and warehouse system
Choose a system that comes with what your validation team needs: requirements traceability, test protocols and clear release notes for every update. entroit offers a validation package with IQ/OQ/PQ, risk assessment, a traceability matrix and test protocols, available on request in every plan. For a pharmaceutical wholesaler, the scope usually covers goods receipt, quarantine and release, batch tracking and the audit trail.