Computerised systems

Annex 11 applies to any computerised system used as part of a GMP-regulated activity, and the definition is broader than most inventories reflect. The system is not just the software: it is the software, the hardware it runs on, and the business process it supports. That is why validating a package in isolation, without reference to how the site actually uses it, misses the point.

Scope is where sites lose findings. LIMS, MES, ERP and chromatography data systems are always on the list. Spreadsheets performing GMP calculations, standalone instrument software, and small departmental databases usually are not — and all three are systems. An unvalidated spreadsheet computing a release calculation is a common and entirely avoidable finding.

Validation effort should be risk-based and should leverage supplier work rather than duplicate it. A documented supplier assessment can justify reducing the site's own testing for a widely used standard product, whereas configured or bespoke systems carry more of the burden locally. What cannot be delegated is verification that the system works for your intended use, with your configuration and your data.

Audit trails are the requirement most often half-implemented. Being enabled is necessary but not sufficient — Annex 11 expects them to be reviewed. An audit trail that nobody has ever looked at provides no assurance and is trivially easy for an inspector to test by asking who performs the review, how often, and what they found last time.

Hybrid paper-and-electronic arrangements need explicit treatment: which record is the raw data, how the two are reconciled, and how the paper element is controlled. Undefined hybrids are where data integrity gaps concentrate.