Our CSV and CSV AI Auditing Services

Computerized systems run almost every critical process in the life sciences today. They control manufacturing, hold clinical data, manage distribution, and support regulatory submissions. When those systems are not properly validated, the data they produce cannot be trusted, and regulators will treat that data as unreliable. GxP Cellators provides Computer System Validation auditing services for regulated systems across the product lifecycle. We also provide CSV AI support for organizations adopting artificial intelligence and machine learning in GxP environments.

Global Regulatory Frameworks for CSV

FDA 21 CFR Part 11

FDA 21 CFR Part 11 establishes requirements for electronic records and electronic signatures. The regulation applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirement set forth in FDA regulations. Part 11 requires that electronic records be trustworthy and reliable, and that electronic signatures be equivalent to handwritten signatures. Key requirements include validation of systems to ensure accuracy, reliability, and consistent intended performance. Systems must have the ability to generate accurate and complete copies of records. Systems must protect records to enable accurate and ready retrieval throughout the records retention period. Systems must limit system access to authorized individuals. Systems must use secure, computer generated, time stamped audit trails.

Summary of Key FDA 21 CFR Part 11 Requirements:

Requirements for electronic records and signatures
Applies to records created under FDA regulations
Records must be trustworthy and reliable
Signatures equivalent to handwritten
Systems must be validated
Systems must generate accurate copies
Systems must protect records for retention
Systems must limit access to authorized individuals
Systems must use secure audit trails
Audit trails record date and time of entries

EU GMP Annex 11 (2025 Draft)

EU GMP Annex 11 covers Computerised Systems and was revised in January 2011. A new revision is anticipated in 2025. The annex applies to all forms of computerized systems used in GMP regulated activities. It requires that computerized systems be validated, with the validation approach based on a risk assessment. The annex covers system lifecycle, personnel, suppliers and service providers, data, security, incident management, electronic signature, batch release, business continuity, archiving, and operation. The 2025 draft includes new requirements for Quality Risk Management across the lifecycle, a new System Requirements section, reframed Supplier and Service Management, a new Alarms section, significant changes to Qualification and Validation, expanded Identity and Access Management with MFA, and Data Integrity as a central focus with ALCOA+ explicit.

Summary of Key EU GMP Annex 11 Requirements:

Applies to all computerized systems in GMP
Validation based on risk assessment
Covers system lifecycle
Covers personnel and suppliers
Covers data and security
Covers incident management
Covers electronic signature
Covers batch release and business continuity
2025 draft adds Quality Risk Management
2025 draft adds System Requirements section
2025 draft adds Alarms section
2025 draft expands Identity and Access Management
Data Integrity central focus with ALCOA+

MHRA Data Integrity Requirements

The MHRA has issued specific guidance on GxP Data Integrity. This guidance states that computerized systems should provide retained audit trails showing all changes to or deletion of data while preserving the original record. Audit trails should be enabled, protected from unauthorized alteration, and available for review as justified by a risk assessment. The guidance emphasizes that organizations should be able to associate data and data changes with specific individuals, and that shared or generic user accounts should not be used for systems generating, modifying, or storing GxP data. A particularly important footnote states that GMP facilities with industrial automation and control equipment should be able to demonstrate working towards system upgrades with individual login and audit trails. This expectation applies to legacy systems including programmable logic controllers, HMIs, and SCADA platforms.

Summary of Key MHRA Data Integrity Requirements:

Retained audit trails showing all changes
Original record preserved
Audit trails enabled and protected
Available for review based on risk
Data associated with specific individuals
Shared accounts not used for GxP data
Legacy systems should demonstrate progress
Individual login and audit trails expected

Health Canada CSV Requirements

Health Canada requires that computerized systems used in GMP activities be validated and that data integrity be maintained. Health Canada has published guidance on data integrity that addresses computerized systems and electronic records.

Summary of Key Health Canada CSV Requirements:

Computerized systems must be validated
Data integrity must be maintained
Guidance on data integrity published
Addresses computerized systems
Addresses electronic records

GAMP 5

GAMP 5 provides a risk based approach to compliant GxP computerized systems. The guide helps organizations validate systems in a way that is proportionate to risk and compliant with regulatory expectations.

Summary of Key GAMP 5 Requirements:

Risk based approach to compliant systems
Validation proportionate to risk
Compliant with regulatory expectations

Audit Types We Provide

System Inventory and Risk Assessment

Everything starts with knowing what systems you have and how much risk each one carries. We help you build or review your system inventory and your risk classification. High risk systems include manufacturing execution, LIMS, and safety databases. Medium risk systems include quality management and training systems. Low risk systems include administrative and reporting systems.

Summary of System Inventory and Risk Assessment:

Build or review system inventory
Risk classification for each system
High risk: manufacturing execution, LIMS, safety databases
Medium risk: quality management, training systems
Low risk: administrative and reporting systems
Validation expectation based on risk

Validation Lifecycle Audits

We audit the full validation lifecycle from requirements through retirement. This includes User Requirements Specification review, design qualification and specifications, installation qualification verification, operational qualification testing, performance qualification execution, and traceability matrix from requirements to tests.

Summary of Validation Lifecycle Audits:

URS review
Design qualification and specifications
Installation qualification verification
Operational qualification testing
Performance qualification execution
Traceability matrix from requirements to tests

Data Integrity Audits

Data integrity has become the single most common finding in GMP inspections worldwide. We assess your data governance framework against the ALCOA plus principles and the expectations of the FDA and MHRA. We review whether audit trails are enabled and reviewed, whether user access rights are appropriate, whether shared logins are in use, whether electronic signatures are compliant with 21 CFR Part 11, whether paper records are protected, and whether data transfers between systems are validated.

Summary of Data Integrity Audits:

ALCOA plus principles assessment
Audit trail functionality and review
User access rights appropriate for roles
No shared logins or generic accounts
Electronic signatures compliant with Part 11
Paper records protected from alteration
Data transfers validated

21 CFR Part 11 Compliance Audits

We audit your systems for compliance with FDA 21 CFR Part 11 requirements. This includes electronic records trustworthiness, electronic signatures equivalence to handwritten, system validation documentation, record protection and retention, access limitation controls, and audit trail generation and security.

Summary of 21 CFR Part 11 Compliance Audits:

Electronic records trustworthiness
Electronic signatures equivalence
System validation documentation
Record protection and retention
Access limitation controls
Audit trail generation and security

Annex 11 Compliance Audits

We audit your systems for compliance with EU GMP Annex 11 requirements. This includes risk management across lifecycle, system requirements ownership and traceability, supplier and service management, personnel training and qualifications, data integrity controls, incident management procedures, and business continuity planning.

Summary of Annex 11 Compliance Audits:

Risk management across lifecycle
System requirements ownership and traceability
Supplier and service management
Personnel training and qualifications
Data integrity controls
Incident management procedures
Business continuity planning

CSV AI Auditing Services

We provide CSV AI support for organizations adopting artificial intelligence and machine learning in GxP environments. This includes AI and ML system validation approaches, training data quality and governance, model development and validation documentation, algorithm transparency and explainability, ongoing performance monitoring, human oversight requirements, and regulatory expectation alignment for AI in GxP.

Summary of CSV AI Auditing Services:

AI and ML system validation approaches
Training data quality and governance
Model development and validation documentation
Algorithm transparency and explainability
Ongoing performance monitoring
Human oversight requirements
Regulatory expectation alignment

Vendor and Supplier Audits

We audit software vendors and service providers to verify that their systems and services meet regulatory requirements. This includes assessing vendor procedures and documentation, reviewing SLAs and KPIs, evaluating vendor quality systems, and assessing supplier risk during validation.

Summary of Vendor and Supplier Audits:

Assess vendor procedures and documentation
Review SLAs and KPIs
Evaluate vendor quality systems
Assess supplier risk during validation

Periodic Review Audits

We conduct periodic reviews of validated systems to verify that they remain in a validated state. This includes scheduled system reviews based on risk, change impact assessment, configuration auditing, performance monitoring review, and regulatory update assessment.

Summary of Periodic Review Audits:

Scheduled system reviews based on risk
Change impact assessment
Configuration auditing
Performance monitoring review
Regulatory update assessment

Who We Work With and Our Partners

Clients We Serve

We serve pharmaceutical manufacturers, biotechnology companies, medical device manufacturers, contract manufacturing organizations, contract research organizations, clinical trial sponsors, distribution companies, and software vendors.

Summary of Clients We Serve:

Pharmaceutical manufacturers
Biotechnology companies
Medical device manufacturers
Contract manufacturing organizations
Contract research organizations
Clinical trial sponsors
Distribution companies
Software vendors

Our Partners

We collaborate with software vendors, automation vendors, validation service providers, IT infrastructure providers, training providers, and regulatory consultants.

Summary of Our Partners:

Software vendors
Automation vendors
Validation service providers
IT infrastructure providers
Training providers
Regulatory consultants

Our CSV Audit Process

Phase	Activities	Output
Planning	System inventory, risk assessment	Audit plan
Document review	URS, validation protocols, test scripts	Pre audit analysis
System walkthrough	Configuration review, access controls	Working notes
Data review	Audit trails, backup logs, migration records	Findings
Close out	Classification and CAPA discussion	Draft findings
Report	Final report with prioritized actions	Audit report
Follow up	CAPA verification and closure	Closure letter

Summary of CSV Audit Process:

Planning: system inventory, risk assessment
Document review: URS, protocols, test scripts
System walkthrough: configuration, access controls
Data review: audit trails, backup, migration
Close out: classification and CAPA
Report: final report with prioritized actions
Follow up: CAPA verification and closure

Why Choose GxP Cellators for CSV and CSV AI Auditing

Auditors with CSV and IT compliance experience
Coverage of FDA, EMA, Health Canada, MHRA, WHO, and GAMP frameworks
Strong focus on data integrity and 21 CFR Part 11
Practical support for Annex 11 compliance
CSV AI support for emerging technologies
Reports designed for quality and IT teams

Summary of Why Choose GxP Cellators:

Auditors with CSV and IT compliance experience
Coverage of FDA, EMA, Health Canada, MHRA, WHO
Coverage of GAMP frameworks
Strong focus on data integrity
Practical support for Annex 11
CSV AI support for emerging technologies
Reports for quality and IT teams

Contact Us for CSV and CSV AI Auditing Support

If you need to validate a computerized system, assess data integrity, or prepare for an inspection, our CSV auditing team can help. Contact us to discuss your systems and compliance needs.

Contact:

Source: GxP Cellators GxP Auditing page