GAMP 5 in pharma automation: what to document and test
GAMP 5 is a good-practice guide for computerized systems used in a GxP context. It is neither a software certification nor a universal document checklist. Scope depends on intended use, risks to patient safety, product quality and data integrity, and the site quality system.
ISPE describes GAMP 5, Second Edition, published in July 2022, as a risk-based approach for computerized systems that are fit for intended use and compliant with applicable requirements. The edition also covers iterative development, service providers, cloud services, software tools and test automation.
Where GAMP 5 applies in an automation project
A PLC, SCADA, batch system or MES interface may execute or record functions that affect the process, product quality or GxP data. The first step is to state the intended use and identify the functions that have a real effect on those elements.
The product name does not determine the effort. Two installations using the same PLC may need different verification if one controls a critical process and the other controls a utility with no direct quality impact. The assessment concerns the function, configuration, interfaces and data used to make decisions or release a batch.
What to define before testing
A usable project baseline includes at least:
- user requirements and acceptance criteria;
- functional descriptions for sequences, alarms, recipes and interfaces;
- hardware and software architecture, including relevant versions;
- risk assessment for functions and data;
- responsibilities across the client, OEM, integrator and quality team;
- the test strategy and deviation process;
- configuration, backup and change-control rules.
The form of those records varies with the QMS. GAMP 5 does not require duplicate documents when existing records cover the need properly. It calls for critical thinking and verification proportionate to risk.
Connect specifications to evidence
Each critical requirement needs an identifiable means of verification. On a batch system, this may cover a phase transition, parameter range, interlock, alarm, recipe handling, audit trail or status exchange with the MES.
Tests should retain the execution conditions, expected result, observed result and decision taken for any deviation. A single screenshot does not always prove the full sequence. Conversely, repeating every supplier test without a rationale can add volume without improving coverage of critical functions.
GAMP 5, CQV and ISA-88 have different roles
GAMP 5 guides the life cycle of GxP computerized systems. Pharma CQV organises commissioning, qualification and evidence that facilities and systems are fit for intended use. ISA-88 and IEC 61512 structure batch-control models and terminology.
The frameworks can work together. An ISA-88 architecture makes units, phases and recipes explicit. The GAMP 5 strategy then defines how computerized functions are specified, verified and maintained according to risk. Neither replaces quality approval or site procedures.
Prepare a PLC or SCADA change
Before changing a production system, identify the controlled baseline, affected functions, dependent interfaces and evidence needed to authorise return to service. Rollback, backups and access rights belong in the change plan.
A limited change may justify targeted testing when supported by a defensible impact assessment. A migration or sequence redesign normally needs wider coverage. The final scope belongs to the site quality system and its authorised approvers.
Practical example: changing a PLC alarm in a GMP environment
Consider an illustrative example, not a client case: the alarm threshold for a monitored temperature in a pharmaceutical utility must change. Start with the measurement's intended use. Does the alarm simply inform maintenance, or does it support a decision that could affect product quality or data integrity? The answer drives the impact assessment and verification scope.
| Check | Evidence to prepare according to impact |
|---|---|
| Controlled baseline | Dated PLC program, HMI/SCADA configuration, parameters and backup |
| Changed requirement | Old/new threshold, rationale, units, tolerance and alarm recipients |
| Risk assessment | Incorrect threshold, lost measurement, communication failure or inappropriate acknowledgement |
| Dependent interfaces | Operator display, historian, audit trail and MES transfer if applicable |
| Targeted verification | Tests below, around and above the threshold, with timestamps and expected/observed results |
| Return to service | Deviations, quality approval if required, backup and rollback strategy |
This is a worked method, not a mandatory qualification checklist. A non-critical function may require less evidence; a parameter used in batch-release decisions may require substantially broader verification and formal QMS decisions. FAT or SAT evidence does not automatically constitute IQ/OQ evidence: reuse depends on relevance, traceability and site approval.
The same logic applies to replacing an obsolete PLC CPU. Even when process logic is unchanged, migration can affect scan times, communications, diagnostics, fault handling and interfaces. See our approach to PLC retrofit and production restart.
Vanguard Systems works on automation studies, development, commissioning and documentation in GMP environments. Our qualification and validation service covers FAT, SAT, IQ and OQ. The automation engineering office handles PLC and SCADA modifications and their technical preparation.
Frequently asked questions
Is GAMP 5 a mandatory standard?
GAMP 5 is an ISPE good-practice guide, not a regulation or certification. Its application should be defined alongside regulatory requirements, the QMS and the system's intended use.
Does GAMP 5 require a V-model life cycle?
No. The second edition states that its specification and verification approach is not inherently linear and can support iterative or incremental methods.
How does GAMP 5 apply to a PLC or SCADA system?
Start from intended use, identify GxP functions and data, assess their risks, link requirements to testing, then manage versions, deviations and changes under the site QMS.