What Computerized System Audits Cover
Computerized systems are used throughout GMP operations, from laboratory instruments and chromatography data systems to manufacturing execution systems, enterprise resource planning platforms, and quality management systems. Each of these systems generates, processes, or stores GxP data, and each is subject to regulatory requirements for validation, data integrity, and access control.
A GMP audit for computerized systems assesses whether these systems are validated for their intended use, whether data integrity controls are in place and effective, and whether the documentation supports the conclusions. It covers the system lifecycle from requirements through retirement, and it examines the interfaces between systems where data is transferred.
The Regulatory Context
EU GMP Annex 11
Annex 11 of EudraLex Volume 4 covers computerized systems. It requires risk management across the lifecycle, validation, supplier assessment, data integrity controls, incident management, electronic signatures, and business continuity. It applies to all computerized systems used in GMP activities.
FDA 21 CFR Part 11
Part 11 sets requirements for electronic records and electronic signatures. It covers validation, audit trails, access controls, and the ability to generate accurate and complete copies of records. It applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under recordkeeping requirements.
ICH Q9 and Risk-Based Validation
ICH Q9 provides the framework for risk assessment. Applied to computerized systems, it means validation effort should be proportionate to risk, and that critical systems receive deeper scrutiny.
MHRA Data Integrity Guidance
The MHRA guidance addresses computerized systems directly. It requires audit trails that are enabled, protected, and reviewed. It requires individual user accounts. It requires that legacy systems demonstrate progress toward compliance.
PIC/S and WHO
PIC/S Guide PE 009 and WHO GMP guidelines cover computerized systems as part of the broader GMP framework.
What Audits Focus On
System Inventory and Risk Assessment
A complete inventory of GMP computerized systems, with risk assessment for each. The audit should check that the inventory is complete and that risk assessments are current.
Validation Documentation
User requirements, functional specifications, design specifications, installation qualification, operational qualification, performance qualification, and validation summary reports. The audit should check that validation is complete and that it reflects the intended use.
Supplier Assessment
Assessment of the system supplier, including quality system, development practices, and support. The audit should check that supplier assessment is documented.
Data Integrity Controls
Audit trails, access controls, electronic signatures, and data backup. The audit should check that controls are enabled, configured correctly, and reviewed.
Access Management
User accounts, roles, privileges, and periodic review. The audit should check that accounts are individual, that privileges are appropriate, and that reviews are performed.
Electronic Signatures
Compliance with Part 11 requirements for electronic signatures, including uniqueness, verification, and control. The audit should check that signatures are properly configured and used.
Data Transfer and Interfaces
Controls for data transfer between systems, including accuracy and completeness. The audit should check that interfaces are validated and monitored.
Incident Management
Problem reporting, investigation, and resolution. The audit should check that incidents are tracked and that recurring issues are addressed.
Business Continuity
Backup, disaster recovery, and continuity planning. The audit should check that plans are in place and tested.
System Retirement
Data migration, archiving, and retirement. The audit should check that data remains accessible and readable after retirement.
Common Findings in Computerized System Audits
Incomplete System Inventory
Validation That Does Not Reflect Intended Use
Audit Trails Not Enabled or Not Reviewed
Shared or Generic Accounts
Privileges That Exceed Role Requirements
Electronic Signatures Not Properly Configured
Data Transfer Controls That Are Not Validated
Business Continuity Plans That Are Not Tested
Legacy Systems Without a Documented Upgrade Path
Introducing GxP Cellators for Computerized System Audits
GxP Cellators provides GMP audits for computerized systems covering Annex 11 and 21 CFR Part 11. Our audits cover system inventory, risk assessment, validation documentation, supplier assessment, data integrity controls, access management, electronic signatures, data transfer, incident management, business continuity, and system retirement.
We work across FDA, EMA, Health Canada, MHRA, WHO, and PIC/S frameworks, and we adapt the audit scope to the systems in use and the risks they present. Our auditors bring regulatory inspection and industry quality experience, and we deliver clear, prioritized reports with practical remediation guidance.
We also provide data integrity assessments that focus specifically on the controls that protect GxP data, including audit trails, access controls, and review practices.
Strengthen Computerized System Compliance
Visit https://www.gxpcellators.com/gmp-auditing/ for service details. Email or use https://www.gxpcellators.com/contact/ to discuss your computerized system audit.
Frequently Asked Questions About Computerized System Audits
What is Annex 11?
Annex 11 of EudraLex Volume 4 covers computerized systems in GMP environments. It addresses risk management, validation, data integrity, and business continuity.
What is 21 CFR Part 11?
Part 11 sets requirements for electronic records and electronic signatures in FDA-regulated activities. It covers validation, audit trails, access controls, and record copies.
Do all computerized systems need to be validated?
Validation effort should be proportionate to risk. Systems that affect product quality or data integrity need validation, but the depth can vary.
What is a legacy system?
A legacy system is an older system that may not meet current requirements for individual accounts or audit trails. MHRA guidance expects demonstrated progress toward upgrade.
How often should access be reviewed?
At defined intervals, typically annually or more often for critical systems. Reviews should confirm that accounts are still needed and that privileges remain appropriate.
Can you help us prepare for an inspection of computerized systems?
Yes. We conduct readiness reviews and mock inspections that simulate the questions an inspector would ask about your systems.
How do I request a computerized system audit?
Email or use https://www.gxpcellators.com/contact/. Service details are at https://www.gxpcellators.com/gmp-auditing/.
