ISPEExecution MethodologyGuidance
ISPE GAMP 5 (2022)

Good Practice Guide: Compliant GxP Computerised Systems

The ISPE GAMP 5 Second Edition provides a risk-based approach for the validation of computerised systems used in pharmaceutical manufacturing. Updates the original 2008 guide to reflect cloud computing, modern software development, and agile methodologies.

LAST REVISED
April 2022
PRODUCT AREAS
SterileSolid DoseBiotechApi
SCOPE & APPLICABILITY

All GxP computerised systems in regulated industries: process control systems, laboratory instruments, QMS, LIMS, DCS, MES, and clinical data systems.

KEY REQUIREMENTS
  • 01Software category classification: Category 1 (infrastructure), 3 (non-configured), 4 (configured), 5 (bespoke)
  • 02Risk-based validation approach — validation effort proportional to risk and complexity
  • 03Supplier assessment commensurate with system category and risk
  • 04Data integrity by design — ALCOA+ principles built into system specification
  • 05Validation lifecycle: specification → testing → operation → review → retirement
IMPLEMENTATION TIPS
Category 4 systems (like SAP, Veeva, MasterControl) require configuration specification documentation that maps to URS
Cloud-hosted systems need specific supplier qualification addressing data sovereignty, security, and audit rights
Agile teams: validation strategy must define how user stories link to validation testing evidence
REVISION NOTES

Second Edition April 2022. Major updates: cloud computing guidance, agile methodology, modern software development, updated category definitions. First Edition 2008 is obsolete — transition to 2022 edition.

ISPE GAMP 5 (2022): frequently asked questions

Quick answers to common questions about ISPE GAMP 5 (2022).

What is ISPE GAMP 5 (2022)?

ISPE GAMP 5 (2022) — Good Practice Guide: Compliant GxP Computerised Systems — is a guidance issued by the International Society for Pharmaceutical Engineering. The ISPE GAMP 5 Second Edition provides a risk-based approach for the validation of computerised systems used in pharmaceutical manufacturing. Updates the original 2008 guide to reflect cloud computing, modern software development, and agile methodologies.

Who does ISPE GAMP 5 (2022) apply to?

All GxP computerised systems in regulated industries: process control systems, laboratory instruments, QMS, LIMS, DCS, MES, and clinical data systems.

What are the key requirements of ISPE GAMP 5 (2022)?

ISPE GAMP 5 (2022) requires, among other things: Software category classification: Category 1 (infrastructure), 3 (non-configured), 4 (configured), 5 (bespoke); Risk-based validation approach — validation effort proportional to risk and complexity; Supplier assessment commensurate with system category and risk; Data integrity by design — ALCOA+ principles built into system specification.

When was ISPE GAMP 5 (2022) last updated?

The current version of ISPE GAMP 5 (2022) dates from April 2022. Second Edition April 2022. Major updates: cloud computing guidance, agile methodology, modern software development, updated category definitions. First Edition 2008 is obsolete — transition to 2022 edition.

RELATED STANDARDS
RELATED FDA RECALLS
where Validation & Qualification control fails
See all Validation & Qualification recalls →

Live openFDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.

THIS STANDARD IN PRACTICE

Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.

Weekly Briefing

Track the standards that move

When ISPE GAMP 5 (2022) — or any GxP requirement — is revised, recalled against, or clarified by new guidance, the Weekly GxP Briefing surfaces it. Free, one email a week.

Read a past issue →