What is GAMP 5?
GAMP 5 is a guide published by ISPE that regulated companies use to validate computerised systems based on risk. It is not a law, but inspectors accept it as a way to meet the validation requirement in EU GMP Annex 11. How deeply you validate depends on the GAMP 5 software category and on the risk of each function.
Source: EU GMP Guide, Annex 11: Computerised Systems (European Commission)
T. LozerCompliance Strategy Specialist · entroit GmbH
· Updated
Where GAMP 5 comes from
GAMP stands for Good Automated Manufacturing Practice. It is published by the International Society for Pharmaceutical Engineering (ISPE). The first edition of GAMP 5 appeared in 2008, the second in 2022. The obligation to validate comes from EU GMP Annex 11. GAMP 5 describes how to meet it without testing more than you need to.
The GAMP 5 categories
The category determines how much validation a system needs. Since the first edition of GAMP 5 there have been four:
| Category | Examples | Validation |
|---|---|---|
| 1 · Infrastructure | Operating system, database, middleware | Record the version, add it to the inventory and to patch management |
| 3 · Non-configured | Standard software that runs without set-up | Risk-based functional testing |
| 4 · Configured | Standard software set up for your business | Requirements, configuration specification, risk assessment, IQ, OQ and PQ |
| 5 · Custom | Software and extensions built specifically for you | Full life cycle with design specification and code review |
ISPE dropped category 2, for firmware, from GAMP 4 when it published GAMP 5. An inventory management system for pharmaceutical wholesale is almost always category 4. If a vendor builds something specifically for you, treat that part as category 5.
How a GAMP 5 validation works
GAMP 5 follows a V-model in which every requirement is matched by a test. For a configured inventory management system, you produce these documents:
- The user requirements specification (URS) describes what the system must do for your business. It is derived from Good Distribution Practice (GDP), Annex 11 and your processes, and it comes from you, not the vendor.
- The risk assessment sets out which functions are GxP-critical and what happens if they fail.
- The configuration specification records how the system is set up for your business.
- The supplier assessment checks whether the vendor has quality management, a test strategy and version control. You may reuse the vendor’s documented tests in your own validation.
- Installation, operational and performance qualification (IQ, OQ and PQ) prove installation, function and operation under real conditions. GAMP 5 allows you to combine the three in one test.
- A periodic review, typically every 12 to 24 months, confirms that the system is still in its validated state.
What risk-based means
You do not test every function, only those whose failure could put patients, product quality or data integrity at risk. In an inventory management system, that means goods receipt with quarantine, release, batch transactions, the audit trail and interfaces. How this fits into the wider process is covered under computer system validation.