GAMP 5 and CSA: Validating Manufacturing Software by Risk
Test what matters most to product and patient hardest, lean on assessed supplier evidence and keep the system validated after go-live.
In Short
- Validate for your intended use.
- Scale testing to risk.
- Change control keeps it validated.
Electronic Records & Inspection Readiness Buyer Guide
For quality, regulatory, validation and IT teams evaluating electronic records, signatures and inspection readiness. Use it with or without V5.
- See what a signature must show.
- Check corrections keep the original.
- Know where Part 11 applies.
We ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
Electronic Records & Inspection Readiness Buyer Guide
For quality, regulatory, validation and IT teams evaluating electronic records, signatures and inspection readiness. Use it with or without V5.
21 CFR 11.10(a) requires validated closed systems, and 211.68 requires controls over computer systems used in drug manufacture. GAMP 5 and FDA's computer software assurance (CSA) approach both scale testing to risk to product quality and patients. Sources checked 3 Oct 2026.
Start with intended use
Write down what the system does in your process and which records or decisions depend on it. A label printer setting and an electronic batch release step carry very different risk, so they should not get the same testing effort.
Rate Risk per Function
For each function, ask what happens to product or patient if it fails, and whether anyone would notice. High-risk functions get scripted testing with recorded evidence; lower-risk ones can use unscripted or exploratory testing, documented briefly.
Worked Example: Testing by Risk
| Function | Risk | Testing |
|---|---|---|
| Release signature | High | Scripted, recorded evidence |
| Batch record calculations | High | Scripted with boundary values |
| Report layout | Low | Unscripted check, brief note |
- Release signature
- Risk
- High
- Testing
- Scripted, recorded evidence
- Batch record calculations
- Risk
- High
- Testing
- Scripted with boundary values
- Report layout
- Risk
- Low
- Testing
- Unscripted check, brief note
Use supplier evidence
GAMP 5 expects you to lean on the supplier's own testing and quality records where you have assessed them. Read what the supplier provides, note any gaps, and test what is specific to your configuration.
Keep validated state
Change control, periodic review and access control keep a system validated after go-live. Record each change, its risk assessment and the testing done, and re-review the system on a schedule your procedures set.
Who owns what
The regulated company owns validation for its intended use. The supplier can supply evidence and, by agreement, help with qualification.
Before you sign the validation report
More on who owns what
Approval of protocols and reports sits with your quality unit.
Questions
Does CSA replace validation?
No. It describes a risk-based way to reach confidence in software. Validation of systems under 11.10(a) still applies.
Is GAMP 5 a regulation?
No. It is ISPE industry guidance. Regulators accept risk-based approaches like it, but the regulation sets the requirement.
Can a supplier validate the system for us?
A supplier can provide evidence and support. You remain responsible for validating it for your intended use.
What does V5 provide?
Enterprise plans include an IQ/OQ validation pack and validation support. You run PQ and approve your validation.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
