URSUser Requirements Specification
A User Requirements Specification is the single most important document in any GxP IT project — it states, in business language, what the system must do, and it is the anchor every later artefact (Functional Spec, Design Spec, IQ/OQ/PQ, traceability matrix, audit defence) traces back to. This page covers what a URS must contain, how GAMP 5 expects it to be structured, the regulatory clauses it must address (Part 11, Annex 11, data integrity), the failure modes that kill validation projects, and how V5 Ultimate ships a pre-written URS template.
01What a URS is
A User Requirements Specification (URS) is the document that captures, in business and regulatory language, what a computerised system must do. It is the starting artefact of the GAMP 5 V-model: every subsequent specification (FS, DS) describes how the system meets it, and every test script (IQ, OQ, PQ, PPQ) proves that it does.
The URS is owned by the customer, not the supplier. The supplier may help draft it (especially for configured Category 4 products like V5), but final sign-off must come from the business owners and Quality. If Quality doesn't sign the URS, the validation project is built on sand.
02What a URS must contain
- Scope — what the system is for, what is in scope, what is out of scope.
- Business process requirements — workflows the system must support (formula approval, work-order release, kiosk dispense, batch close, QC, deviation, CAPA).
- Data requirements — what is captured, by whom, when, retention period, archive format.
- Regulatory requirements — Part 11, Annex 11, data integrity (ALCOA+), industry-specific (FSMA 204, MoCRA, DSCSA, 820.30, etc.).
- Security requirements — RBAC, e-signature, audit-trail, password policy, session management.
- Interface requirements — what the system must integrate with (ERP, LIMS, scales, printers, label printers, MES).
- Performance and capacity — number of users, transactions per hour, storage, RPO/RTO.
- Constraints — environments (on-prem, cloud), browser support, languages, accessibility.
03Numbering and traceability
Every line in the URS must have a unique, immutable identifier — typically URS-001, URS-002, URS-003 and so on. This identifier is what the FS references, what the test script references, what the traceability matrix lists, and what the auditor follows when they ask 'show me where you tested this requirement'.
04The regulatory baseline a URS must address
| Area | Minimum URS content |
|---|---|
| 21 CFR Part 11 §11.10 | Closed system access controls, audit trail, e-signature, record retention, training. |
| 21 CFR Part 11 §11.50 | E-signature manifestation (name, date/time, meaning). |
| 21 CFR Part 11 §11.200 | Two-component e-signature, non-repudiation. |
| EU GMP Annex 11 | Risk management, supplier qualification, validation, data integrity, change/configuration management. |
| Data integrity (ALCOA+) | Attributable, Legible, Contemporaneous, Original, Accurate + Complete, Consistent, Enduring, Available. |
| Industry-specific | BMR for pharma (211.188), eDHR for med-device (820.184), FSMA 204 KDE/CTE for food, MoCRA PIF for cosmetics, etc. |
05Common URS failures
- Requirements stated as vague verbs ('the system shall support...') with no acceptance criterion.
- Mixing requirements with design ('the system shall use Postgres') — design belongs in the DS.
- No risk classification — every requirement treated as equally critical.
- Regulatory clauses copied without being made testable ('shall be Part 11 compliant').
- Renumbered partway through, invalidating every downstream document.
- Drafted by IT alone, never signed by Quality or the business process owners.
06How V5 ships URS
V5 ships a pre-written URS template covering the Part 11 / Annex 11 baseline plus per-industry extensions — pharma (BMR, MMR), medical device (eDHR, DHF, 820.30), food (FSMA 204, HACCP, allergen), supplements (111.255), cosmetics (PIF, MoCRA), radiopharma (212, RG 1.86).
Frequently asked questions
Q.Who writes the URS?+
The customer's business process owners and Quality. The supplier may provide a template and consult on industry baseline, but Quality must own the final sign-off.
Q.Can the URS change after sign-off?+
Yes, via formal change control. Every change is versioned, two-person approved and traced through to updated test scripts.
Q.How long should a URS be?+
For a configured GxP MES/QMS like V5, expect 80–200 numbered requirements. Less than that and you have gaps; more than that and you have noise.
Primary sources
Further reading
V5 Ultimate ships with the URS controls already wired in — audit trail, e-signatures, validation evidence. Free trial, no credit card, onboard in days, not months.