A structured approach to validating computerised systems: science-based risk management applied across five control areas and fourteen control points, with effort calibrated to each system's GAMP software category and its GxP impact.
GAMP 5, the ISPE guide to good automated manufacturing practice now in its Second Edition, sets out how regulated organisations validate computerised systems through life cycle models and science-based risk management. Effort is calibrated to each system's software category and GxP impact; the systems that carry patient, product and data-integrity risk receive the greatest rigour, and the rest are handled proportionately.
A GAMP 5 compliant system, in ISPE's terms, is a structured approach to validating computerised systems using life cycle models and science-based risk management. The framework organises that approach into five control areas and fourteen control points; each area below opens a dedicated page setting out what it covers, why it matters and the named output we produce.
GAMP 5 classifies software into categories that set the validation approach and the documentation burden. The Second Edition retired the former Category 2; software is now classified as Category 1, 3, 4 or 5. We apply the appropriate rigour based on the system's category and its GxP impact.
As an Asset Lifecycle Performance Implementation Partner, we approach validation as an asset and process reliability programme with a regulatory reporting requirement: compliance and reliability designed to reinforce each other, not compete.
We are technical practitioners rather than generalist advisors; our outputs are inspection-ready rather than interim; and every engagement transfers capability, leaving your teams better equipped than it found them. Prospective or retrospective, a single system or a site-wide programme, we scope to your regulatory context, product portfolio and operating reality.
The framework maps to the references that define validated state across the markets you serve.
GAMP 5 (Second Edition, 2022) — the ISPE risk-based framework; the V-model retained for traceability and applied proportionately.
EU GMP Annex 11 and Annex 15 — the European requirements for computerised systems and for qualification and validation.
FDA 21 CFR Part 11 and Part 211 — electronic records and signatures, and current good manufacturing practice.
ICH Q9 — quality risk management; the basis for concentrating validation effort where risk is greatest.
ALCOA+ — the data-integrity principles a validated system must preserve across its records.
The V-model, applied proportionately — every requirement specified, built and verified, with depth calibrated to category and risk.