GAMP 5 Example Forms Copyright in the whole and every part of this material is owned by ISPE. No reproduction for commercial purposes, resale, or other commercial use of the whole or any part of this material is allowed without the written agreement of ISPE. Where indicated, purchasers of GAMP 5 are free to use and modify this material for internal use within their organization only. The material is indicative only and intended to be neither exhaustive nor prescriptive. The GAMP 5 example templates, forms, checklists, and questionnaires are provided in Microsoft® Word (suitable for Microsoft® Word 2000 or above) or Adobe® PDF format. Please note that while every effort has been made to provide the Microsoft® Word documents in a reusable format, ISPE does not guarantee that they will appear correctly when opened in Microsoft® Word or another word processing application. The GAMP 5 example templates, forms, checklists, and questionnaires are provided for your convenience. They may be used freely within your own organization; however, they remain the property of ISPE, should not be used for commercial purposes, and are not available for resale. © Copyright ISPE 2008. All rights reserved.

Form 1 Example risk assessment form

Form 2 Example source code review form

Forms 3-5 Example forms to assist with testing

Forms 6-8 Example forms to assist with the process of managing a change

Forms 9-14 Example forms to assist with document management

Form 15 Example format for a traceability matrix

Forms 16-17 Example forms to support validation reporting

Forms 18-20 Example forms to support backup and restore

Forms 21-22 Example forms to support performance monitoring

1

1: Risk Assessment Form Project Title / Risk Assessment Overview

Project Number

Assessment Scope / Assumptions Made

Function

Sub-Function

Assessment of Risk

Measures and Controls

Relevance

(GxP / Business)

Risk

Scenarios

Probability

of Occurrence

Severity

Risk Class

Detectability

Priority

Risk Assessment Approved by:

2

2: Source Code Review Report Review no: Date: Reviewer:

Review subject:

Design Specification reference and version:

Coding Standard reference and version:

Observation ID

Module ID and Version

Observation Recommended Corrective Action Action taken

Completed by (Name and date)

Corrective action(s) completed and checked by

Name: Signature: Date:

3

3: Test Results Sheet SYSTEM Test reference

Controlling test specification ref.

Title of test

Test run number

Test result Enter Details Of Equipment Used (Model, Serial No., Calibration Date, Revision Of Any Software External To Supply, Simulators, Etc.) Result: Pass / Fail Incident report reference Tester

Date

Reviewer (if required)

Date

4

4: Test Incident Sheet SYSTEM Test reference

Controlling test specification ref.

Title of test

Test run number

Incident description (note: Test incident may be raised at any time by any party) Was the test in progress halted by this incident? Yes / No Could the test proceed after immediate short term modifications? Yes / No Detail changes required Tester Reviewer (if required)

Date Date

Repeatable? Yes / No (specify Change Request Number Below) Raised Change Request? Yes / No Actions Close test incident Signature Print name

Date

5

5: Test Progress Sheet System

Number of tests to execute

Type of testing e.g., FAT, SAT

Sheet Of

Test Ref.

Run No.

1

2

3

4

5

6

Result Date

Result Date

Result Date

Result Date

Result Date

Result Date

Result Date

Tester Reviewer (if required)

Date Date

6

6: Change Request REQUEST FOR CHANGE Computerized system: Plant/Dept: Location: Originator: Proposed change: Reason for change:

Change no: Date: Telephone no: Required by date:

CHANGE DISPOSITION & AUTHORIZATION Disposition: Authorized / Rejected* Signature: Signature: Signature:

* Delete as appropriate Job title: Job title: Job title:

Date: Date: Date:

CHANGE DETAILS Comments: (Include either reasons for rejections, details of re-testing, Change Plan reference) Number of Change Notes attached: CHANGE COMPLETION AND APPROVAL Completed signature: Approved by signature: Signature:

Job title: Job title: Job title:

Date: Date: Date:

7

7: Change Request Index System: Sheet: Change number

Description

Disposition accept / reject date

Number of Change Notes

Date closed

8

8: Change Note System: Change number:

Change Note number:

Item number: Item reference:

Item version / issue number:

Details of Change to perform: Implemented by: Signature:

Print name: Date:

9

9: Document Circulation Register Sheet: DOCUMENT DETAILS DOCUMENT TITLE DOCUMENT REFERENCE DOCUMENT ISSUE CONTROLLED CIRCULATION LIST Copy no.

Name and job title

Date issued

10

10: Document History Sheet: DOCUMENT TITLE DOCUMENT REFERENCE Date

Issue

Review / change request number(s)

Updated by (initials)

11

11: Document Transmittal Notice TRANSMITTAL NUMBER: DATE: TRANSMITTAL DETAILS From: Please find enclosed / destroy / return* (*delete as appropriate) Please destroy previous issue(s)* Please return previous issue(s)*

To: The following document(s)

Please acknowledge receipt by signing and returning this notice Signature:

Date:

DOCUMENT DETAILS Document title

Document reference

Document issue

Copy number

12

12: Master Document Index Document reference

Document title

Issue Status

13

13: Review Report Review no: Date: Sheet: of: Persons present: Review subject: Observation number

Observation

Corrective action, Agreed by, Signature and Completion date

Date cleared and Backup evidence

Corrective action(s) completed and checked Signature: Print name: Title: Date:

14

14: Review Summary Sheet: of: Review number

Observation number

Action agreed by

Agreed completion date

Date notification sent

Date closed

15

15: Example Format for a Traceability Matrix 1.URS reference number

2. Description 3. GxP impact (inc 21CFR11)? (Y/N)

4 Other Impact (Y/N)

5. Functional Specification Reference

6. Design Specification Reference

7. Test or Verification Reference (e.g., IQ, OQ, PQ)

8. Comments

1.0 Text... Y Y FS02 3.1.4 (a) DS_DOC1 4.5. SATEST3 7.8

2.0 Text ... Y N FS33 1.3.2 DS_DOC99 1.2 Verified by Evalreport2 2.78

2.1.1 Text... N Y Met by SOP565 N/A PQ TST45

2.1.2 Text ... N N FS33 1.2.2 DS_DOC99 1.1 SATEST2 9.3

Key to table columns 1. URS Reference Number All requirements should be listed. 2. Description Optional. Could be the full URS definition or a brief reference to assist cross checking. 3. GxP Impact? (Y/N) If Y, then there must be a test reference in column 7, or a reference showing that this requirement is verified in some other way. 4. Other Impact The system may require some formal verification or testing for reasons other than GxP, (e.g., Safety, Health, Environment, Commercial) and for which it

would be good practice to trace from requirement through design to testing. It is recommended this column notes the reason for ‘Other Impact’. 5. Functional Specification Reference Enter the FS reference answering the URS. Where the system will not provide the functionality, this should be made clear with a notation such as ‘Not

Met’, or an SOP reference providing procedural control. Some requirements may be met by means other than software, and verified by means other than testing.

6. Design Specification Reference Enter the Design, or Configuration, Specification answering the FS. 7. Test or Verification Reference A reference must be present where GxP impact = Y. 8. Comments Include any comments that add information particularly where reference needs to be made to additional testing or requirements that have arisen as part

of the exercise.

16

16: Example Problem Reporting Summary

Incident #

Test

Problem Description

Cause / Solution

Action

Justification

530

T130/009

Test Failure - Software does not save updated records in the Purchasing Module when following Long Receipt method

Identified as software error – confirmed by Vendor, Patch fix ref. 1223444 will correct problem

No Action

Function will not be used by business, no impact elsewhere

531

T132/006

Test Failure - Standard reports would not print when requested

Printer set-up error Update printer configuration and retest

Change Notice 1643

N/A

533

T138/001

Test Failure – Label L_MAI_001 not produced due to system error

Print Server configuration incorrectly set up – did not recognize printer driver for label printing device LP44165

Change Notice 1645

N/A

534

T142/064

Report not available at time of test

Custom report yet to be created.

Test when report available prior to system acceptance

N/A

17

17: Example Format for a Validation Certificate Project Name: Project Number:

Controlling Specification Reference: FINAL SYSTEM VALIDATION APPROVAL

The signatories below have reviewed the validation documentation for the [name of company and name of system] Computerized System. This review included assessment of the phase reports listed below, including details of the execution of approved test scripts, the Recommended Actions, Conclusions and an assessment of Project Status derived from the outcome of each phase:

[List documents required by Validation Plan in section below] Test Report / Document Title [those listed are for example only] Report / Document

Reference Functional Specification Reference

Project Environment Detail Design Document PE/5P961/250 FS/4F1956/001

Project Environment System Architecture PE/5P961/251 FS/4F1956/001

Installation Tests – Peripherals TR/4F1956/573 RS/4F1956/045

Installation Tests – Project Environment TR/4F1956/213 FS/4F1956/047

Test Plan SP/4F1956/128 Not Applicable

Test Report – Purchasing Modules TR/4F1956/173 FS/4F1956/014

Test Report – Sales Modules TR/4F1956/174 FS/4F1956/015

Test Report – Financials Modules TR/4F1956/175 FS/4F1956/016

Test Report – Quality & Production Support Modules TR/4F1956/176 FS/4F1956/069

Test Report – Custom Interfaces TR/4F1956/178 FS/4F1956/012

Test Report – Security TR/4F1956/181 FS/4F1956/092

STATUS

As a result it is determined that the [name of system] Project has been validated to date in accordance with the requirements of [Validation Plan reference] and can be used in the operational environment by suitably trained and authorized business personnel.

It is recognized that continued performance monitoring of the system will proceed after Go-Live in order to maintain the full validation requirements for this system.

APPROVAL DATE

[Must be prior to “go-live” date] By signing below, each individual approves the validation status of the [name of system] Project:

Name Job Title Signature Date

[Project Leader]

[Project Manager – IT]

[Validation]

[Quality Assurance]

18

18: Example forms for the Documentation of Data Backup: Page 1 Organization of data backup for <designation of computerized system installation>

Page 1

Data backup type

Interval

Number of generations

Behavior in the case of a failure

Remarks

Labeling of backup media

Complete backup

Sat

4

Repetition

<System designation > <Date of first application> <Number of generation> 1 Etc.

Complete backup

After change of software

1

Repetition

< System designation> <Date of first use> <Reason> Etc.

Incremental

Mon - Thur

4

No repetition

< System designation> <Date of first use> <the first two letters of the day of the week> <Number of the generation> Etc.

1) The number of the generation is specified for every week in a calendar at the beginning of the year.

19

19: Example forms for the Documentation of Data Backup: Page 2 Organization of data backup for <designation of computerized system installation> Page 2 Duration of use:

2 years

Type of backup media:

DAT

Storage of backup media:

Safe in the office of the person responsible for the PLT-system

Data backup tool:

SAM

Procedure:

xxxxxxx

Call:

Automatically Manually: xxxxxxxx

Review:

Visual check of backup protocols, to be signed

Check of 1:1 Copy:

To be evaluated

Signature / Date Person responsible for the computerized system: _________________________________

20

20: Example Form for Restoration of Data Restoration of Data Applicant: __________________________________________ Date/Time: __________________________________________ System/application name/identification Data to be restored/files: _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________

Reason: _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ Owner of data: __________________________________________ Date/Time: __________________________________________ Restored: __________________________________________ (Date/Time/person responsible for system) Side effects:

21

21: Example Template for a Monitoring Plan Monitored Parameter

Warning Limit

Frequency of Observation

Monitoring Tool

Notification Mechanism

Where Results are Documented

Retention Period

22

22: Example of a Monitoring Log of a Server-based LIMS Monitored Parameter

Warning Limit

Frequency of Observation

Monitoring Tool

Notification Mechanism

Where Results are Documented

Retention Period

CPU- Utilization

> 25 % at the average over 24 hours

Every 10 minutes

System procedure

System console

File with 24 hour CPU statistic

6 month

Disk Filling Grade

> 90 %

Hourly

System procedure

Mail to system operator

File with mail

30 days

System Error Message

Error count increased by severe system error (defined in the tool)

Every second

Tool “CheckSys“

Mail to system operator Message to operator pager with error number

According to SOP “Problem Management”

According to appropriate GxP regulations

Critical Batch Jobs: • All monitor- jobs • Fullbackup.com • Dircheck.com Automatic • Check_ print queues.com • Stop_ database.com • LIMS

If batch job is lost

Every 10 minutes

System procedure

Automatic restart of batch jobs by system procedure

File with mail

30 days

Critical Processes: • LIMS • Pathworks • Oracle • Perfect disk • UCX • DECnet • Security Audit

If process is not running

Every minute

Tool “CheckSys“

Mail to system operator

File with mail

30 days