Validation of computerized GCP systems - QFINITY
QFINITY · Company · Publications

Validating computerized GCP systems where the rules stay silent.

In a two-part series in Pharm. Ind. (2016, ECV), Oliver Herrmann and Dr. Jenny Gebhardt (QFINITY) develop a sound rationale for validating computerized GCP systems - even though Europe long lacked concrete, legally binding requirements for it. Part 1 lays out the fundamentals and approaches; Part 2 covers how to handle the data - and the challenges that come with it.

Get in touch The article at the publisher
The context

An early assessment of data as the product.

Clinical trials are complex undertakings - processes, people and documentation duties, mapped across a multitude of computerized systems that were drawing growing attention in regulatory inspections as early as 2016. The series sets the fundamentals, the regulatory framework and practical approaches in a risk-based context - taking the view that in clinical research the data itself is the actual result, and that validation begins with the process and its Intended Use, not with the tool.

The series first appeared in 2015 in "IT-Trends im GxP-Umfeld" (Pharma Technologie Journal, ECV) and subsequently in two parts in Pharm. Ind. 78 (2016).

In clinical research, the data is the product - its integrity is not a downstream IT question but the condition for a study to prove what it is meant to prove.
Part 1 · Pharm. Ind. 78 (2), 189-201

Fundamentals and approaches.

The first part sets the stage: from the study types through the regulatory history to the question of how validation can be soundly justified at all - and it consistently separates process and tool.

  • GxP lifecycle and GCP

    Interventional trials under the German Medicines Act (AMG) and the place of GCP in the medicinal product lifecycle - between preclinical development (GLP), manufacturing (GMP) and marketing authorization.

  • Regulatory framework

    From the Declaration of Helsinki through ICH E6 and EU Directive 2001/20/EC to the directly binding EU Regulation 536/2014 - along with the national transposition into the AMG and the GCP Ordinance.

  • Legal uncertainty

    For years, Europe had no concrete validation requirements for GCP systems - they could only be derived indirectly via PIC/S guidance and Annex 11. In the US, by contrast, 21 CFR Part 11 applies unambiguously to electronic records.

  • GAMP as interpretation aid

    GAMP is not legally binding, but it gives organizations a firm footing for interpretation and implementation - and the GAMP R&D and Clinical Systems SIG has made it usable for the GCP domain as well.

  • Process vs. tool

    The purpose comes from the process (Intended Use); the system has only a fixed function and must be suitable for it. Hence the clean separation of validation (process) and qualification (tool) - including the process owner's non-delegable responsibility.

  • Platform and layer model

    Building blocks and the extended layer model frame eClinical platforms as an intermediate layer - validation is process-oriented and risk-based along the data flow from the source through CROs to the sponsor.

Part 2 · Pharm. Ind. 78 (4), 510-520

Handling data, challenges and trends.

The second part follows the data itself: what counts as critical, how to secure its integrity technically, and how it travels safely through an often unconnected, globally scattered system landscape.

  • Identify critical data

    The series distinguishes scientific (clinical) data - inclusion and exclusion criteria, endpoints, adverse events, randomization - from regulatory compliance data (in the Trial Master File, among other places). Both are critical, if for different reasons.

  • Secure data integrity

    The series works through the integrity attributes in the sense of ALCOA++ - from attributable, legible, contemporaneous, original and accurate to complete, consistent, enduring, available and traceable - anchoring each one technically and organizationally.

  • Secure transmission

    When data is exchanged, metadata, audit trail content and, where applicable, e-signatures travel with it; encryption and hashing create a "closed channel" that makes even open networks safe to use.

  • Challenge and trend

    Exploding data volumes, global collection and the demand for reliable quality collide. Staying on top of that takes a genuinely lived quality culture, process knowledge, good risk management and trained staff.

The authors

Written by practitioners of the GCP environment.

The series was written jointly by Oliver Herrmann, Founder and CEO of QFINITY, who initiated the GAMP working group on the compliance of computerized GCP systems (conceived in 2008, first meeting in 2009; merged in 2011 into the global ISPE GAMP R&D and Clinical Systems SIG), and Dr. Jenny Gebhardt (Q-FINITY Qualitätsmanagement, Dillingen).

GAMP R&D and Clinical Systems SIG ISPE GAMP Clinical Trial Management Pharmacovigilance & GCP QM Pharm. Ind. (ECV) · 2016

After studying human medicine at the Charité and completing a Master's in Clinical Trial Management, Dr. Jenny Gebhardt leads QFINITY's quality management focus for clinical research (GCP), conducts audits and supports the validation of computerized systems. The series is an in-house publication - QFINITY's own position, published in Pharm. Ind. 78 (2016), Editio Cantor Verlag. The line continues: the same SIG went on to produce the ISPE GAMP Good Practice Guide "Computerized GCP Systems and Data" (2nd Edition, July 2024) - co-authored by QFINITY, with Frank Henrichmann and Oliver Herrmann as co-leads.

Validierung computergestützter GCP-Systeme - Pharm. Ind. (ECV)↗
Regulatory

Two worlds, one standard.

Perhaps the series' sharpest finding is an asymmetry between the regulatory frameworks of the US and Europe - and its resolution through the risk-based, process-oriented approach. Three stations:

  • The asymmetry (2016)

    In the US, 21 CFR Part 11 is mandatory for electronically represented, FDA-regulated trials; in Europe the AMG and the GCP Ordinance stayed silent for years - the validation obligation could only be derived indirectly via PIC/S guidance and Annex 11.

  • The bridge

    The absence of explicit rules let no one off the hook: inspectors expected validation anyway, because nothing less supports a robust statement on data integrity - the risk-based, process-oriented approach bridged the gap between expectation and regulation.

  • Closed today

    Since September 2023, the EMA guideline on computerised systems and electronic data has spelled out the European expectation; since January 2025, ICH E6(R3) has anchored it globally; in October 2024, the FDA refreshed its reading with its Q&A guidance. Our current perspective: data integrity in the GCP environment.

21 CFR Part 11 EU Regulation 536/2014 ICH E6 PIC/S guidance EU GMP Annex 11
Related topics

From the publication to lived practice.

Data Integrity in the GCP Environment

The core idea carried forward: data as the product of clinical research - and how to secure its integrity along the processes.

→ Explore data integrity

Process Compliance in the Clinic

Process before tool: how to set up and run clinical processes and their supporting systems compliantly.

→ Explore process compliance

Validation of Computerized Systems

The risk-based validation approach across all GxP areas - from 21 CFR Part 11 and Annex 11 to GAMP 5.

→ Explore CSV

Computer Software Assurance

The FDA guidance for risk-based assurance of production and QMS software - effort scaled to Intended Use and process risk, targeted rather than blanket.

→ Explore CSA

Validate GCP systems - risk-based and inspection-ready.

We support the validation of your computerized GCP systems along the data flow - identifying critical data, securing integrity, cleanly separating process and tool. Free initial consultation, about 30 minutes.

Arrange an initial consultation