How do you verify and validate the data integrity and security of a GAMP 5 software system during PQ?

The title of this article is misleading. GAMP 5 provides guidance on the validation of computerised systems used for GXP regulated activities. There is no such thing as a GAMP 5 software system. Also while the traditional qualification terms IQ, OQ and PQ are one way to conduct computer system validation, they are not mandatory. GAMP 5 does not use these terms but instead refers to verification against specification. For example, User Acceptance Testing is performed to verify the system does what the regulated company needs the system to do and that it is fit for purpose/intended use. It would help if the collaborative articles on computer system validation stopped propagating the use of IQ, OQ, PQ.

Why do you execute a PQ during CSV with a reference to a GAMP 5 "software" system (application), when GAMP defines not to use PQ for CSV? This question is illogical or even stupid from all aspects. The same question would be: Which airport do you use to park your car?

The purpose of PQ is to confirm that all business processes meet end user requirement. Comprehensive testing that covers all business processes to ensure they function as intended in the expected setting.

Requirement testing is what it is called as PQ for CSV, first of all it depends on the type of software (GAMP-5) and its category whether open or close accordingly relevant checks and verifications are applicable to ensure that all the requirement specifications shall be met. 21 cfr part 11 specifies the controls for open and close systems which further ensures the data integrity principle ( ALCOA++).

From my POV try to test and demonstrate DI compliance until PQ is too late and maybe not all the topics would be covered. Additional the scope of the PQ needs to be defined on risk based approach.

The PQ protocol can Verify that the system is synced to an authorised time server. Ensure that all user activities are logged automatically (audit trailed) including and not limited to changes to parameters and data, the old and new values in case of changes, the user's name and id who changed parameters along with time stamps, login attempts along with failed login attempts. Verify security to ensure the audit trail / log cannot be modified and can be printed in human readable form without the ability to modify. PQ should ensure that RBAC is enforced consistently across all functions and features. Verification that admin and backend database access is unavailable to the end user can be included.

Data Integrity: 1. Check time synchronisation and verify that time cannot be changed by user. 2. Check proper data exchange in all the interfaces with other systems (if applicable) 3. Verify that software and data (system, logic) can not be accessed by user 4. Check for proper recording of user name, time stamp and action in audit trail Security: 1. Check for latest and proper versions of required backend software/framework 2. Check for proper RBAC with positive and negative tests 2. Check for air gaping wherever possible and disabled unused ports

Create detailed PQ protocols that include specific tests for data integrity and security features. Define acceptance criteria for each test to ensure that the system meets the predefined requirements.

Validation and verification typically involve rigorous testing, documentation, and adherence to industry standards for ensuring data integrity and security. 1. Performance Testing: Assess the system's performance under various conditions, such as stress testing, load testing, & scalability testing, to ensure it meets performance requirements. 2. Security & Access Control: Verify that the software implements adequate security measures & access controls, protecting data integrity & ensuring compliance. 3. Data Integrity Checks: Perform tests to ensure the integrity of data throughout the software processes, including data input, processing, storage, & output. 4. Audit Trail Review: Validate the effectiveness of the audit trail functionality.

Conduct performance testing to ensure that the system maintains data integrity and security under expected operational conditions. Perform robust testing to evaluate the system's behavior under peak loads and ensure that data integrity and security controls remain effective.

Document all PQ activities, including test execution, results, deviations, and corrective actions. Ensure that the documentation provides a clear and traceable record of how data integrity and security were verified and validated.

This article contains many inaccuracies and would require a lot of effort to correct. It propagates the idea that PQ is mandatory. It is not. If the GAMP 5 framework for computer system validation is to be followed, then it is important to read what it says.

If we talk about GAMP5, then this content is not enough for Performance qualification. GAMP5 has detailed explanation for each activities with respect to each type of software category. So as per my opinion, this should be revised so member can comments it on accordingly. Thank you...