In this article we will share examples of GAMP software categories that are related to The Good Automated Manufacturing Practices (GAMP5) Guide for Validation of Automated Systems in Pharmaceutical Manufacture. But before we start, what is GAMP5 all about?
GAMP5 Key Objectives:
- Patient Safety
- Product Quality
- Data Integrity
- Regulatory Compliance Requirements
The GAMP5 software categories – An introduction
Based on the GMP impact (Product Quality, Patient Safety, Data Integrity and Regulatory Compliance Requirements) the level of verification through software testing will be determined.
Because the GAMP5 software categories can be open to interpretation implementing a risk-based approach is a key element to ensure the correct level of validation effort is executed.
A risk-based approach is used to identify, evaluate, control and review the identified risks. The outcome of the risk assessment (level of risk and potential system impact) will be used to determine if validation is required and what elements must be validated.
GAMP5 key principles of product and process understanding, quality risk management, and leveraging suppliers’ activities is fully aligned with the Computer System Assurance (CSA) risk-based approach.
The GAMP5 categories
Category 1: Infrastructure software
Category 2: This category is not live in GAMP 5. (Its present in old version GAMP 4)
Category 3: Non-configured products
Category 4: Configured products
Category 5: Custom applications
GAMP Software Category 1 – Infrastructure Software
This includes "established or commercially available layered software" and "infrastructure software tools" that are themselves validated from within rather than from the infrastructure.
Infrastructure software in its most simple form is the operating system on which the application software resides. Infrastructure is qualified but not validated. The validation is performed on the hosted application not on the infrastructure.
Infrastructure should be built, configured and deployed in accordance with the applicable procedures including configuration management.
GAMP5 Software Category 1 – Infrastructure software examples:
- Standard operating systems (e.g., Windows XP, Linux)
- Anti-virus software
- Operating Systems
- Anti-virus Software
- Active Directory / Domain Controller
- Database Software (SQL / Oracle)
- Server and Network Hardware
- Virtual Environments
- Firewalls, including configuration
- Server and Network Monitoring Tools
- Backup Systems
GAMP Software Category 3 – Non Configurable products
This includes software packages where existing code can be selected and set points can be used either unconfigured or with the standard defaults provided by the software supplier."
Non Configurable Software is also referred to as COTS (Commercial-Off-The-Shelf-Software) or just OTS (Off-The-Shelf-Software). The software is capable of operating and automating the business process without any modification.
There is no fixed rule as to the validation approach for GAMP Category 3 systems.
GAMP5 Software Category 3 – Non Configurable products examples:
- Programmable Logic Controllers (PLC’s)
- Electronic chart recorder
- Commercial off the shelf software (COTS),
- Laboratory Instruments
- Laboratory Software
- Remote Terminal Units
- Vernier calipers
- Analytical balance
- Building Management System (BMS)
- Environmental Monitoring System (EMS)
- Stand-alone HPLC system
- Quality Control (QC) equipment
GAMP Software Category 4 – Configured products
GAMP5 software category 4 includes configured software where the user has the means and knowledge to change the functionality of the software application. GAMP Category 4 software is software applications that are configured to meet user specific business needs. This is possibly the biggest and most complex category. The functionality of the software can be configured to return different outputs depending on the configuration.
GAMP5 Software Category 4 – Configured products examples:
- Laboratory Information Management System (LIMS)
- Supervisory Control And Data Acquisition (SCADA)
- Distributed Control System (DCS)
- Clinical Decision Support System (CDS)
- DCS / SCADA Mimics
- Alarm handling functionalities
GAMP Software Category 5 – Custom applications
This includes any "application, module, user-defined program, or macro" that has been written in-house or by a third party that "needs to be specified, version controlled, built, and tested (including integration testing with the commercial application, as applicable) as a minimum to ensure the quality of the software."
Custom Software is software that is generally written from scratch to fulfil the business need. This software could be written in-house and is possibly the highest risk of the software categories as it is customized and there is a higher level risk of errors within the application code.
GAMP5 Software Category 5 – Custom applications examples:
- PLC logic (Ladder, Sequence Flow Chart, C++)
- Custom scripts within SCADA / DCS system
- Electronic batch record