Validation Scope Planner

Systematic scope planner for computerized systems. Classifies GAMP category, GxP impact, Part 11 relevance, data integrity exposure, and supplier risk into a practical validation plan.

WHAT THIS CALCULATES

How much validation evidence a computerised system justifies — full lifecycle, risk-based package, or documented verification — from its GAMP category, GxP impact, Part 11 exposure, data-integrity exposure and supplier status. It exists to make the scope conversation explicit before anyone starts writing the plan.

THE METHOD

category

the GAMP 5 software category number: 1 infrastructure · 3 non-configured · 4 configured · 5 custom

gxpImpact

+3 where the system has direct GxP impact

part11

+2 where electronic records or signatures are in scope

dataIntegrity

+1 low · +2 medium · +3 high — high meaning the system creates or approves GMP records

supplierStatus

+1 qualified · +2 limited evidence · +3 new or unqualified

GAMP 5 (2nd ed., 2022) uses categories 1, 3, 4 and 5 — category 2 was retired, and a picker still offering it is out of date. The additive score is a SPEQ planning heuristic, not a GAMP construct: it makes the inputs to the scope decision visible and repeatable. GAMP 5 and ICH Q9(R1) both put effort proportionate to risk; this scores the factors that drive it.

THE INPUTS, AND WHAT THEY MEAN

GAMP software category

What kind of software it is, which sets the baseline. A configured commercial product (4) and a custom application (5) differ mainly in how much of the risk is yours rather than the supplier’s.

Direct GxP impact

Whether the system affects product quality, patient safety or a regulatory record. This is the single largest factor, and the one most often assumed rather than assessed.

Electronic records / signatures in scope

Whether 21 CFR Part 11 or EU GMP Annex 11 apply — which brings audit trail, access control and signature-manifestation requirements independent of the validation itself.

Data integrity exposure

High means the system creates or approves GMP records; medium means it supports a critical process; low means neither. This is what determines how much attention audit trails and record controls need.

Supplier status

How much of the supplier’s own evidence you can leverage. A qualified supplier with a credible development lifecycle lets you test less; an unqualified one means you carry that burden yourself.

HOW TO READ THE OUTPUT

• ›The scope band sets the deliverable list, which is where the effort actually goes — the score itself is only a way of getting there defensibly.
• ›Leveraging supplier evidence is the point of a risk-based approach, and it is only legitimate where the supplier has been assessed. Leveraging documentation you have not evaluated is not risk-based; it is unvalidated.
• ›GAMP category alone does not decide scope. A category 3 system creating GMP records can justify more rigour than a category 4 system that does not, which is why impact and data integrity carry more weight here than the category number.
• ›Document the rationale, not just the outcome. An inspector asks why the scope was chosen — the inputs above are the answer, and they are more defensible than a category label.

WORKED EXAMPLE

A configured LIMS with direct GxP impact, electronic records in scope, creating and approving GMP records, from a supplier already qualified.

GAMP category

4 — configured product

Direct GxP impact

yes (+3)

Part 11 in scope

yes (+2)

Data integrity exposure

high (+3)

Supplier status

qualified (+1)

It lands exactly on the threshold, and the qualified supplier is what keeps it there rather than higher — an unqualified supplier would add 2 and put it clearly inside full lifecycle. That is the practical lesson: supplier qualification is the lever that most changes validation effort, and it is worth doing before the project rather than during it. Drop Part 11 from scope and the same system falls to 11 and a risk-based package.

REGULATORY BASIS

ISPE GAMP 5 (2nd ed., 2022)

The software categories and the risk-based, scalable lifecycle approach this planner implements — including the retirement of category 2.

EU GMP Annex 11

Computerised systems requirements for the EU: risk management, supplier assessment, validation, data integrity and audit trails.

21 CFR Part 11

US requirements for electronic records and signatures, which apply independently of validation scope wherever such records are used.

ICH Q9(R1)

The principle that the formality of effort should be proportionate to risk — the basis for scaling validation at all.

LIMITATIONS — READ BEFORE YOU RELY ON THIS

• ›This is an analytical aid, not a validated system, and the additive score is a SPEQ planning heuristic rather than anything GAMP publishes. Reproduce the decision in your own validation risk assessment — the weights are published above so you can.
• ›It does not perform the risk assessment. It scores factors you have already judged, and a wrong judgement about GxP impact makes the output confidently wrong.
• ›It cannot assess your supplier. "Qualified" is an input here and an audit in reality, and the difference is the whole basis for leveraging their evidence.
• ›The deliverable lists are typical, not mandatory. Your validation procedure and the system’s intended use decide what is actually required.

RELATED ON SPEQ