Glossary · GxP: good practices
GAMP 5
Also known as: GAMP, GAMP 5 Second Edition, Good Automated Manufacturing Practice
German: GAMP 5
GAMP 5 is the ISPE guide “A Risk-Based Approach to Compliant GxP Computerized Systems”, whose second edition was published in July 2022. It describes a lifecycle approach to specifying, verifying, operating and retiring computerized systems used in GxP work, scaled to risk, system complexity and supplier involvement.
- GxP
- Pharma
In one sentence
GAMP 5 is the ISPE industry guide to risk-based lifecycle management and validation of GxP computerized systems; the second edition dates from 2022.
Example
A pharma company introducing a configurable laboratory information management system classifies it as GAMP category 4, audits the supplier, reuses the supplier's testing, and focuses its own verification on the configured workflows that affect results.
How it applies
- Software categories: GAMP 5 sorts software into category 1 (infrastructure software), 3 (non-configured products), 4 (configured products) and 5 (custom applications). Category 2 was dropped in earlier editions. The category guides the effort, together with the risk to patient safety, product quality and data integrity.
- Critical thinking: The second edition stresses critical thinking over document volume and supports assurance approaches like the FDA's computer software assurance, including unscripted testing where risk allows.
- Suppliers: Supplier documentation and testing can be leveraged when the supplier has been assessed; the regulated company stays accountable.
- Legal status: GAMP 5 is an industry guide, not law. It is widely used to meet Annex 11 and 21 CFR Part 11 expectations.
- Technical documentation: Typical deliverables are user requirements, risk assessments, specifications scaled to the category, test evidence, a traceability matrix and a validation report.
GAMP 5 vs. Annex 11
Annex 11 states what EU GMP requires of computerized systems. GAMP 5 describes one widely accepted way to get there. An inspector checks the Annex 11 requirements; a company may follow GAMP 5 or another documented approach that meets them.