How to use this document
Copy the template below into your quality system. Replace every <<FILL: ...>> placeholder with your company, system, and process specifics, then route it through your own document control, review, and approval. The filled specimen shows one worked example; adapt the numbers and scope to your operation and verify each cited regulation or standard against the current source before you rely on it.
This is a generic, originally worded starting point. It contains no confidential, proprietary, or employer material, it is drafted with AI assistance and reviewed, it is not legal or compliance advice, and adopting it does not by itself create or prove compliance. See the Disclaimer and Terms.
This is a ready-to-use worksheet for classifying a computerized system by its GAMP 5 category and crosswalking that against the Validation Master Plan’s own GxP-impact risk tier, so the resulting validation plan reflects both what the system is built from and what a failure in it would actually cost. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows.
1. Purpose
This worksheet records a computerized system’s GAMP 5 category, its GxP-impact risk tier under the site or program’s Validation Master Plan, and the validation deliverables the combination of the two actually calls for, so validation depth is set deliberately rather than defaulted to whichever framework happened to be applied first.
2. Scope
Applies to <<FILL: system name and version>>, used for <<FILL: intended GxP function, e.g. release testing data capture, batch record execution, environmental monitoring>>.
3. GAMP 5 category assessment
Select the single category that best describes the system as actually deployed; a system with both a configured commercial core and a custom-coded add-on is assessed as Category 5 for the custom portion and Category 4 for the rest, documented as two linked lines rather than forced into one category.
4. VMP risk-tier assessment
5. Crosswalk: validation deliverables by category and tier
The category sets what evidence exists to build on; the tier sets how much validation depth the resulting plan needs. Neither cell above is a substitute for a system-specific risk assessment; use this table to scope the plan’s starting point, not to skip the assessment.
6. Scoping decision
7. References
See the paired article, Validation Master Planning for a Clinical-Stage Biotech, for how the VMP’s risk-tier framework and GAMP 5’s category vocabulary fit together.
ISPE GAMP 5, A Risk-Based Approach to Compliant GxP Computerized Systems, 2nd edition (2022). Confirm the current edition before citing.
EU GMP Annex 11, Computerised Systems.
8. Revision history
9. Approvals
Filled specimen
Extract for an illustrative chromatography data system used for release testing.
A second specimen line, for contrast: an internally coded lab scheduling tool with no product-quality data role.
Common findings this worksheet prevents
- A Tier 1 system’s validation scoped from its GAMP category alone, missing the periodic review and data integrity risk assessment the tier itself requires.
- A Tier 3, no-GxP-impact system over-validated to its GAMP category’s nominal depth, spending Category 5 effort on a system the VMP’s own scoping test already excluded.
- A GAMP category asserted with no stated basis, so a later reviewer cannot tell whether “Category 4” was a considered classification or a guess.
- No reference to the current GAMP 5 edition or EU Annex 11 version in a system’s validation plan.
How to adapt this worksheet
- Complete section 3 by assessing the system as actually deployed, not as marketed by the vendor; a heavily customized “configured” product is often really a Category 5 system for the customized portion.
- Pull the risk tier in section 4 directly from the VMP’s existing risk classification, never re-derive it independently for this worksheet.
- Use section 5 as a starting point and document any departure in section 6’s rationale field; a system with unusual complexity or a novel failure mode may need more than the table’s default.
- Re-run this worksheet when the system is upgraded to a new major version, when its configuration changes materially, or on the VMP’s periodic review cycle.
