Computer System Validation (CSV) in GMP is a documented, risk based, lifecycle process that proves a computerized system is fit for its intended use, consistently reliable, and compliant with regulatory requirements (e.g., FDA 21 CFR Part 11, EU GMP Annex 11). It ensures data integrity, product quality, and patient safety by validating that the system performs as intended throughout its entire lifecycle.
Core Definition
CSV is the formal process of establishing documented evidence that provides a high degree of assurance that a computerized system will consistently function according to its predetermined specifications and quality attributes throughout its lifecycle.
Key Objectives
– Ensure fitness for intended use: Verify the system meets user requirements and regulatory expectations.
– Guarantee data integrity: Ensure electronic records are ALCOA+ (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available).
– Demonstrate regulatory compliance: Satisfy mandates from FDA, EMA, and other health authorities.
– Protect patient safety: Minimize risks from system errors in manufacturing, testing, and release.
Regulatory & Industry Frameworks
– FDA 21 CFR Part 11: Governs electronic records and electronic signatures.
– EU GMP Annex 11: Provides detailed rules for computerized systems in GMP.
– GAMP® 5 (ISPE): The global de facto standard for risk based CSV lifecycle management.
– ICH Q9 (Quality Risk Management): Guides risk assessment for validation scope and depth.
CSV Lifecycle (GAMP 5 Approach)
CSV is not a one time test; it spans the entire system lifecycle:
- Planning & Risk Assessment
Define scope, intended use, and criticality.
Perform risk assessment to prioritize validation effort (focus on high risk functions affecting product quality/data integrity).
- Specification
URS (User Requirements Specification): What the system must do (business/user needs).
FS (Functional Specification): How the system will meet URS.
DS (Design Specification): Technical design details.
- Configuration / Development
Build/configure the system per specifications.
- Qualification (IQ/OQ/PQ)
IQ (Installation Qualification): Verify correct installation per specs.
OQ (Operational Qualification): Test functions under normal/abnormal conditions.
PQ (Performance Qualification): Confirm consistent performance in real world use.
- Validation Report & Approval
Summarize all activities; obtain formal approval to release the system.
- Operation & Maintenance
Ongoing monitoring, periodic reviews, change control, and re validation as needed.
- Retirement / Decommissioning
Secure data archiving/migration; document system shutdown.
What Systems Require CSV?
Any computerized system that impacts GMP activities:
– Manufacturing execution systems (MES)
– Laboratory information management systems (LIMS)
– Batch records, electronic batch records (EBR)
– Quality management systems (QMS)
– SCADA, PLCs, and process control systems
– ERP systems for GMP data
– Electronic signature and audit trail systems
Key Distinction: Validation vs. Verification
– Verification: Did we build the system correctly? (Check against specs).
– Validation: Did we build the right system? (Prove it works as intended for its use case).
In short, CSV is the regulatory and quality foundation for trusting computerized systems in pharmaceutical and biotech manufacturing.
