Validate your computerized systems based on their use and risk

This first step determines whether the system falls within GxP scope and builds a CSV/CSA strategy proportionate to its criticality, complexity and level of configuration.

The engagement may include:

• GxP applicability assessment
• system classification per GAMP 5
• identification of critical data and functions
• definition of the CSV or CSA approach
• allocation of responsibilities between business, IT and supplier
• definition of validation activities and deliverables
• development of the validation schedule

Possible deliverables:

System Impact Assessment, validation strategy, validation plan, responsibility matrix and activity schedule.

This engagement is a good fit when you:

• are deploying a new system
• are replacing an existing solution
• are unsure which level of validation to apply
• want to streamline an overly document-heavy validation approach

Discuss your validation strategy

We help you formalise clear, verifiable user requirements suited to the system's intended use.

Risk analysis then identifies the functions and data requiring the highest level of control. Requirements, risks and tests are thus linked in a coherent, traceable approach.

The engagement may include:

• requirements-gathering workshops
• drafting or review of User Requirements Specifications
• identification of regulatory requirements
• functional risk assessment
• Data Integrity risk analysis
• identification of existing controls
• definition of acceptance criteria
• construction of the traceability matrix

Possible deliverables:

URS, risk analysis, critical function register, acceptance criteria and traceability matrix.

This engagement is a good fit when:

• user requirements are incomplete or scattered
• URS were written after the system was configured
• tests aren't clearly linked to risks
• a targeted requalification needs to be defined

Secure your requirements and risk analyses

Using a Cloud or SaaS solution does not transfer regulatory responsibility to the vendor.

We assess the vendor's capabilities, the services offered and the available documentation to determine what evidence can be used and what checks must remain your responsibility.

The engagement may include:

• assessment of the vendor's quality system
• analysis of its software development lifecycle
• review of available documentation and tests
• assessment of version and change management
• review of access, backup and continuity measures
• analysis of contractual responsibilities
• assessment of data reversibility and return
• identification of gaps requiring additional controls

Possible deliverables:

Supplier questionnaire, Supplier Assessment, audit report, gap analysis and responsibility matrix.

This engagement is a good fit when you:

• are selecting a new SaaS solution
• have little vendor documentation
• need to justify using its tests
• want to strengthen oversight of a critical vendor

Assess your vendor or SaaS solution

We define and carry out verification activities centred on the system's intended use and risks.

When the project includes a migration, we also verify that transferred data remains complete, accurate, consistent, traceable and interpretable in the target system.

The engagement may include:

• definition of the test strategy
• review and leverage of supplier testing
• drafting of test scenarios
• IQ, OQ, PQ or UAT as appropriate
• scripted or exploratory testing based on risk
• test data management and prerequisites
• evidence collection and review
• defect management
• regression testing
• source-to-target data mapping
• reconciliation and verification of migrated data

Possible deliverables:

Test protocols and scenarios, execution evidence, defect reports, traceability matrix, migration protocol and verification report.

This engagement is a good fit when you:

• are preparing a system qualification
• need to complement supplier testing
• are migrating historical data
• need to redo an insufficiently documented test campaign

Discuss your testing or migration

We help you embed the necessary controls into routine activities and assess the impact of changes, incidents and new versions.

The engagement may include:

• change management
• impact assessment of updates
• defect and incident management
• definition of periodic reviews
• access and privilege review
• audit trail governance
• tracking of vendor commitments
• backup and restoration verification
• targeted requalification
• archiving, migration and system retirement

Possible deliverables:

Procedures, impact analyses, test plans, periodic review reports, remediation plans and requalification reports.

Discuss maintaining your validated state