Validation projects have a reputation for running late that they have mostly earned. What is less often examined is where the time actually goes — because the assumption that it goes into regulatory thinking is wrong, and it leads people to fix the wrong thing.
Five causes recur. They are not equally expensive and they are not equally fixable, and the ones that cost most are rarely the ones that get attention.
1. Document assembly, which is most of it
Ask a validation lead what consumed their last project and you will not hear "the risk assessment". You will hear: drafting a URS from a vendor specification, writing protocols that follow a predictable structure, formatting evidence, and rebuilding a traceability matrix by hand every time a requirement moved.
This is why adding contractors produces a linear cost increase rather than a step change — more hands do not help when the bottleneck is assembly. It is also why validation is unrewarding work for skilled people: the judgement that justifies their salary is a small share of the week.
Fixable: yes, and this is where the largest single saving sits. GxP Copilot drafts the deliverable set so the lead reviews and decides rather than types.
2. Categorisation decided defensively
A configured commercial product treated as a custom application can double the document set and add months. The error is usually caution rather than analysis — nobody felt confident enough to argue for the lower category, so the project paid for the higher one.
It is decided in the first week by the person least able to push back, and it is almost never revisited, because revisiting it means admitting the plan was wrong.
Fixable: yes, cheaply. It costs nothing but a defensible written rationale, and GAMP 5 Second Edition consulting work frequently starts by rechecking exactly this.
3. Approval cycles nobody scheduled
Every document needs review and approval, and in most plans the time for that is assumed rather than booked. A protocol sits in someone's queue for nine days because they are on an inspection. Then the next one does.
Across a package of twenty controlled documents, approval latency routinely exceeds the drafting time it was supposed to follow — and it is invisible in the plan because it is nobody's task.
Partly fixable. You cannot make approvers faster, but you can make what they approve smaller. A revision that shows the changed sections rather than a regenerated document is reviewed in an afternoon rather than a week.
4. Requirements that cannot be tested
A requirement saying the system shall be user-friendly cannot be verified. One bundling three obligations into a sentence passes when two of them hold. Both are cheap to fix at drafting and expensive at execution — which is when they are found, by a tester who cannot work out what they are supposed to prove.
The rework is not just the test. It is the requirement, its approval, the protocol, the protocol's approval, and the traceability matrix.
Fixable: yes, by checking testability before the requirement set is approved rather than after.
5. Scope that arrives late
An interface nobody mentioned. A second site. A reporting module that turned out to be in scope after all. Late scope is expensive in validation specifically because it invalidates work already approved — a new requirement means a new risk assessment, new tests, and a traceability matrix that no longer balances.
Least fixable of the five. You can reduce the damage by making re-derivation automatic rather than manual, so a late requirement updates risk and coverage instead of triggering a reconciliation exercise. You cannot stop the business from remembering things late.
What this means for a plan
If you are estimating a validation project, estimate the document assembly and the approval latency honestly, and treat the regulatory judgement as the small, high-value share it actually is. Most plans do the reverse, which is why most plans are wrong in the same direction.
Our CSV services and CSA services practices size projects this way, and it is usually the approval latency that surprises people rather than the drafting.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.