Computerized System Validation refers to the documented evidence that a computerized system consistently meets its specified requirements throughout its entire life cycle and is suitable for its intended purpose. In GMP and GCP environments, it thereby protects product quality, data integrity and, where applicable, the rights, safety and well-being of study participants.
Purpose and risk-based scope
CSV concerns not only an application such as EDC, eTMF, randomization or laboratory software, but the respective system in its specific configuration and use. The decisive factor is whether functions or data may influence a GxP-relevant decision. Annex 11 requires the scope of validation and data integrity controls to be derived from a justified, documented risk assessment. Patient safety, data integrity and product quality must be explicitly taken into account.
The evidence is not generated solely through a final test. It comprises traceably planned and approved activities covering design, implementation, operation, changes and decommissioning. User requirements describe what the system must be able to do and remain traceable. Acceptance criteria, test protocols, test results, deviations and their assessment together form the evidence that critical requirements have been met. Depending on the risk, audit trails, access rights, data backups, interfaces and data recoverability are also part of the scope of testing.
Life cycle, suppliers and changes
A validated state must be maintained. CSV therefore links requirements, supplier assessment, configuration management, training, operation, incident management and change control. For standard software, the regulated user reviews the documentation provided by the supplier against its own user requirements. If development, hosting or maintenance is outsourced, responsibilities must be defined in writing; the supplier’s suitability is assessed on a risk-based basis.
Changes must not be treated as purely technical routine. Before a change, it must be assessed which requirements, data flows, interfaces and existing evidence are affected. Annex 11 requires validation documentation to include relevant change-control records and deviations identified during validation. Tests and approvals should therefore demonstrate that the change delivers the intended benefit without reopening risks that had previously been controlled.
Distinction from validation and qualification
Validation is the general term for the documented evidence that a process, method, system or procedure permanently meets predefined requirements. Computerized System Validation is its application to computerized systems; it must not be equated with the validation of a manufacturing process or analytical method. It provides evidence of system suitability, but not automatically evidence of the suitability of a product or process.
Qualification must also be distinguished. It concerns the verification of the functionality of a system or technical facilities and may be one component of CSV. For clinical trials, the EMA explains that validation concerns the documented, continuous fulfillment of specified requirements from design through decommissioning or replacement. Uncritical adoption of supplier documentation does not replace the responsibility of the sponsor or regulated user.
For documentation, it is crucial that it corresponds to the actual use. A system inventory provides an overview of GxP-relevant applications and their functions. For critical systems, Annex 11 requires an up-to-date description of architecture, data flows, interfaces, hardware, software and security measures. This also makes the validation understandable to persons who were not involved in the implementation. In migrations, it must additionally be demonstrated that data were transferred completely and correctly and that the traceability of historical records has been preserved. The documented status must make it possible at all times to identify which version is approved and which open risks or limitations exist.
In the validation plan, test documentation and change-control record, the risk assessment, requirements, deviations, test results and approval of the respective system state must be linked comprehensively. These CSV records provide evidence, for the configuration actually in use, of whether critical functions, interfaces and data migration steps correspond to the user requirements and whether the validated state is maintained.
Relevance for clinical trials
In clinical trials, systems for data collection, data management and analysis must be fit for purpose and maintain information in a traceable and integral manner. The sponsor should establish risk-based quality management and assess risks across computerized systems as well. Common weaknesses include incomplete requirements specifications, missing evidence after updates, insufficiently tested interfaces and unclear responsibilities between the sponsor, trial site and service provider.
Full-service CROs such as Mediconomics support the preparation of user requirements and risk-based validation plans, supplier assessments, test coordination, deviation management and the traceable documentation of EDC, eTMF or randomization systems. They can also coordinate change-control processes, training and the provision of evidence for audits and inspections with data management and clinical project management.
Frequently Asked Questions (FAQ)
Must every IT system be fully validated?
The scope is determined by the documented risk assessment. The decisive factors are GxP relevance and possible impacts on participant protection, data integrity or product quality.
Does a software provider’s certificate replace CSV?
No. It may be used as supplier evidence, but must be assessed against the specific intended use, configuration and risks.
When does validation of a system end?
It accompanies the life cycle through controlled decommissioning or migration. The archiving and accessibility of records must also be taken into account.
Regulatory references
- EudraLex Volume 4, Annex 11 “Computerised Systems” – requires risk-based validation and life-cycle documentation.
- ICH E6(R3) Good Clinical Practice – requires fit-for-purpose systems and risk-based quality management in clinical trials.
- EMA, Notice to sponsors on validation and qualification of computerised systems – explains the sponsor’s evidence and responsibilities.