Validation
Validation drafts your team completes and signs
One ZIP with the validation plan, requirements, risk assessment, system description and IQ, OQ and PQ scripts, drafted from the system's own specification.
Why it matters
Requirements, risks and tests that trace to each other
“User Requirements Specifications should describe the required functions of the computerised system and be based on documented risk assessment and GMP impact. User requirements should be traceable throughout the life-cycle.”
“Risk management should be applied throughout the lifecycle of the computerised system taking into account patient safety, data integrity and product quality. As part of a risk management system, decisions on the extent of validation and data integrity controls should be based on a justified and documented risk assessment of the computerised system.”
“Evidence of appropriate test methods and test scenarios should be demonstrated.”
“Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.”
What is inside
Everything a validation team starts from
Validation Plan
DOCXWhat will be validated, by whom and how, with the acceptance criteria and the release rule.
User Requirements Specification
DOCXWhat the system must do: each requirement with its source, its tests and a column for your review.
Risk Assessment
DOCXEach function rated high, medium or low with its rationale, and a starting audit trail review frequency.
System Description
DOCXComponents, cameras, data flow, interfaces, security and versions, with prompts for your network details.
Installation Qualification Protocol
DOCXInstallation checks: components, running version, clock, backups, evidence storage and accounts.
Operational Qualification Protocol
DOCXOperational tests of every function, with steps, expected results and blank result columns.
Performance Qualification Protocol
DOCXChecks in normal production: detection against staff review, review times, restore and continuity.
Part 11 and Annex 11 Assessment
DOCXEach Part 11 and Annex 11 requirement, with an assessment column for your quality unit.
Validation Summary Report
DOCXA template for your results, deviations, open items and the release decision.
Supplier Quality Agreement
DOCXA template for a quality agreement with ConductScience, with the responsibilities split.
Traceability matrix
XLSXRegulation to requirement to function, risk and test, with blank columns for your results.
Every requirement from Part 11, Parts 211 and 314, FDA guidance and Annex 11, quoted, with who meets it.
Change control record
PDFEvery release with its changes, the functions it touched and its validation impact.
Read-me, manifest and checksums
TXTCSVThe order to work in, every file with its size, and SHA-256 checksums in the format sha256sum -c reads.
One specification
The documents cannot drift apart
- system functions, 9 rated high risk
- 14
- user requirements
- 29
- test scripts: 6 IQ, 19 OQ and 4 PQ
- 29
- regulatory requirements mapped
- 60
Risk-based testing
Testing matched to risk
- High risk
- A failure could hide or misstate a finding, a decision or a record. Scripted tests of every path, and performance tests in production where use matters.
- Medium risk
- A failure would mislead or delay, but the source record is unaffected or the error is easy to notice. Scripted tests.
- Low risk
- No effect on product quality or GMP records. Checked within other tests.
Who does what
Your team keeps the decisions
The software
- Drafts every document from the system specification
- Ships test scripts with steps, expected results and blank result columns
- States each release's validation impact in the change control record
- Keeps every requirement traced to its source and tests
Your team
- Reviews, changes and approves the drafts
- Runs the scripts and records the actual results
- Resolves deviations
- Signs the summary report and releases the system for GMP use
Site deployment
What the installation at your site adds
- URS-11Signing shall require the signer’s user ID and password, and each signature shall belong to one named person.
- URS-17Each person shall sign in with their own account from the site’s identity provider, and creation, change and removal of access shall be recorded.
- URS-24Records shall be backed up, restorable and readable for the whole retention period.
- URS-25Detection and clip storage shall keep running when the workspace is unavailable, and cases from that time shall reach the workspace when it returns.
Questions
Common questions
- Does the package validate the system for us?
- No. It gives your team drafts to review, change and approve. Your team runs the tests, records the results and decides whether the system is fit for its intended use.
- Which GAMP 5 category should we use?
- That is your assessment. Configured products are usually category 4 and custom parts category 5. The validation plan leaves the category for your team to set.
- Do the test scripts have room for our results?
- Yes. Every step has columns for the actual result, pass or fail, and initials and date, and each protocol ends with a summary and a signature table.
- What happens when a new release comes out?
- Each release comes with a change control record: what changed, the functions it touched and which tests to repeat before you use it for GMP records.
- How do we get the package?
- Request a walkthrough. We send the package, built from the demo workspace with sample data, so your validation lead can review it.
See it with sample data
We show the review queue, a signed monitoring report, the audit trail review and the validation package, then answer your team's questions.