EU GMP Annex 11 Checklist: Free 45-Point Readiness Check

01 Principle and risk management

Annex 11 clause Principle, 1.

• 1

  Is every GMP computerised application validated and its IT infrastructure qualified?

  Cl. Principle

  If not: List every GMP application and the infrastructure it runs on, and schedule validation or qualification for each one without a current record.

• 2

  Where a system replaced a manual step, have you shown that quality, process control and overall risk are no worse?

  Cl. Principle

  If not: For each manual step a system replaced, write a short comparison showing quality, process control and risk are no worse, and file it with the validation.

• 3

  Is risk management applied across the whole system lifecycle, covering patient safety, data integrity and product quality?

  Cl. 1

  If not: Add patient safety, data integrity and product quality to the risk assessment template and revisit it at each lifecycle stage, not only at go-live.

• 4

  Is the extent of validation and of data integrity controls set by a justified, documented risk assessment?

  Cl. 1

  If not: Record, per system or function, the risk decision that sets how much validation and which data integrity controls apply, with the reason.

02 Personnel

Annex 11 clause 2.

• 5

  Do process owner, system owner, Qualified Persons and IT work together with defined responsibilities?

  Cl. 2

  If not: Name the process owner, system owner, QP contact and IT owner for each system and write their responsibilities into the system's governance document.

• 6

  Do users have the right qualifications and access levels for their role?

  Cl. 2

  If not: Map roles to required training and access levels, and check current users against that map before the next access review.

03 Suppliers and service providers

Annex 11 clause 3.1 to 3.4.

• 7

  Are there formal agreements with third parties, including internal IT, that state each party's responsibilities?

  Cl. 3.1

  If not: Put a written agreement in place with each supplier and with internal IT that states who is responsible for what, including data and backups.

• 8

  Are suppliers selected on competence and reliability, with the need for an audit decided by risk?

  Cl. 3.2

  If not: Add a documented supplier assessment to selection, and record a risk-based decision on whether an audit is needed.

• 9

  Has documentation for off-the-shelf products been reviewed to confirm it meets your user requirements?

  Cl. 3.3

  If not: Review the vendor documentation for each commercial product against your user requirements and record the gaps and how they are covered.

• 10

  Can supplier quality and audit information be shown to an inspector on request?

  Cl. 3.4

  If not: Keep supplier assessments, audit reports and quality agreements in one controlled place that can be retrieved during an inspection.

04 Validation

Annex 11 clause 4.1 to 4.8.

• 11

  Does validation cover the relevant lifecycle steps, with standards, protocols and acceptance criteria justified by risk?

  Cl. 4.1

  If not: State in the validation plan which lifecycle steps apply and justify the protocols and acceptance criteria by risk.

• 12

  Do validation records include change control records (if applicable) and reports on deviations found?

  Cl. 4.2

  If not: Link change control records and deviation reports into the validation package so the record is complete on its own.

• 13

  Is there an up-to-date inventory of systems and their GMP functions?

  Cl. 4.3

  If not: Build a system inventory with each system's GMP functions and keep it current through change control.

• 14

  Does each critical system have a current description of data flows, interfaces, prerequisites and security?

  Cl. 4.3

  If not: Write a system description for each critical system covering data flows, interfaces, prerequisites and security, and review it with each change.

• 15

  Are user requirements based on documented risk and GMP impact, and traceable through the lifecycle?

  Cl. 4.4

  If not: Tie each user requirement to its risk and GMP impact and keep a traceability matrix from requirement to test.

• 16

  Have you confirmed the system was developed under an appropriate quality system, with the supplier assessed?

  Cl. 4.5

  If not: Obtain evidence of the supplier's development quality system and record your assessment of it.

• 17

  For bespoke or customised systems, is quality and performance formally assessed at every lifecycle stage?

  Cl. 4.6

  If not: For custom or customised systems, add a documented quality and performance review at each lifecycle stage.

• 18

  Do tests cover parameter limits, data limits and error handling, with automated test tools assessed as adequate?

  Cl. 4.7

  If not: Add tests for parameter limits, data limits and error handling, and document that any automated test tool is fit for use.

• 19

  When data is migrated to another format or system, does validation check that values and meaning are unchanged?

  Cl. 4.8

  If not: Validate every data migration with checks that values and their meaning are unchanged, and keep the evidence.

05 Data, accuracy, storage and printouts

Annex 11 clause 5 to 8. Data integrity domain.

• 20

  Do systems that exchange data electronically have built-in checks for correct and secure entry and processing?

  Cl. 5

  If not: Add and test checks on each electronic interface for correct and secure transfer, for example counts, checksums or reconciliation.

• 21

  Is critical manually entered data checked a second time, by a second person or a validated electronic means?

  Cl. 6

  If not: Identify critical manual entries and add a second-person or validated electronic check for each.

• 22

  Is data protected physically and electronically, and checked for accessibility, readability and accuracy across retention?

  Cl. 7.1

  If not: Define physical and electronic protection for stored data and schedule checks that it stays accessible, readable and accurate for the retention period.

• 23

  Are regular back-ups taken, with integrity and restore tested at validation and monitored periodically?

  Cl. 7.2

  If not: Test a full restore during validation, then repeat restore tests on a defined schedule and record the results.

• 24

  Can clear printed copies of electronic data be produced?

  Cl. 8.1

  If not: Confirm and document how clear printed copies of each record type are produced.

• 25

  Do batch release printouts show whether any data has changed since it was first entered?

  Cl. 8.2

  If not: Configure batch release printouts to show whether any data was changed after first entry.

06 Audit trails

Annex 11 clause 9. Data integrity domain.

• 26

  Based on risk, does the system keep an audit trail of all GMP-relevant changes and deletions?

  Cl. 9

  If not: Switch on and verify an audit trail for all GMP-relevant changes and deletions, and confirm it cannot be disabled by users.

• 27

  Is a reason recorded for each change or deletion of GMP-relevant data?

  Cl. 9

  If not: Make a reason mandatory for each change or deletion of GMP-relevant data.

• 28

  Are audit trails available in a readable form and reviewed regularly?

  Cl. 9

  If not: Define a risk-based audit trail review: who reviews, how often, what they look for, and how findings are recorded.

07 Change control and periodic evaluation

Annex 11 clause 10, 11.

• 29

  Are changes to systems, including configuration, made only under a defined, controlled procedure?

  Cl. 10

  If not: Bring configuration changes, not only code and upgrades, under the change control procedure.

• 30

  Are systems periodically evaluated to confirm they remain validated and GMP compliant?

  Cl. 11

  If not: Set a periodic review cadence per system based on risk and record each review's conclusion on the validated state.

• 31

  Does that review cover functionality, deviations, incidents, upgrades, performance, reliability and security?

  Cl. 11

  If not: Add functionality, deviations, incidents, upgrades, performance, reliability and security to the periodic review template.

08 Security and access

Annex 11 clause 12.1 to 12.4. Data integrity domain.

• 32

  Do physical and/or logical controls limit system access to authorised people?

  Cl. 12.1

  If not: Restrict access with unique accounts and physical or logical controls, and remove shared logins.

• 33

  Is the level of security matched to how critical the system is?

  Cl. 12.2

  If not: Document a security level per system based on its criticality and close any controls that fall short.

• 34

  Are creation, change and removal of user access recorded?

  Cl. 12.3

  If not: Record every creation, change and removal of user access, and review the record periodically.

• 35

  Does the system record who entered, changed, confirmed or deleted data, with date and time?

  Cl. 12.4

  If not: Confirm the system records the user identity, date and time for every entry, change, confirmation and deletion.

09 Incidents, e-signatures and batch release

Annex 11 clause 13 to 15. Data integrity domain.

• 36

  Are all incidents, not only failures and data errors, reported and assessed?

  Cl. 13

  If not: Widen the incident procedure to cover all system incidents, not only failures and data errors, and assess each one.

• 37

  Is the root cause of critical incidents found and used for corrective and preventive action?

  Cl. 13

  If not: Require a root cause investigation for critical incidents and link it to CAPA.

• 38

  Do electronic signatures carry the same weight as handwritten signatures within the company?

  Cl. 14a

  If not: State in a company policy that electronic signatures carry the same weight as handwritten signatures.

• 39

  Is each electronic signature permanently linked to its record?

  Cl. 14b

  If not: Verify that each electronic signature is permanently linked to its record and cannot be copied or moved to another.

• 40

  Does each electronic signature include the date and time it was applied?

  Cl. 14c

  If not: Confirm every electronic signature shows the date and time it was applied, on screen and in printouts.

• 41

  Can only Qualified Persons certify batch release in the system, identified by electronic signature?

  Cl. 15

  If not: Restrict batch certification in the system to Qualified Persons and require their electronic signature.

10 Business continuity and archiving

Annex 11 clause 16, 17.

• 42

  Are fallback arrangements (manual or alternative system) for critical processes documented and tested?

  Cl. 16

  If not: Document the fallback for each critical process and test it, then record the test.

• 43

  Is the time allowed to switch to the fallback based on risk?

  Cl. 16

  If not: Set the maximum time to switch to each fallback from a risk assessment and write it into the continuity plan.

• 44

  Is archived data checked for accessibility, readability and integrity?

  Cl. 17

  If not: Schedule checks that archived data is still accessible, readable and intact, and record them.

• 45

  When a system changes, is the ability to retrieve archived data ensured and tested?

  Cl. 17

  If not: Add a test that archived data can still be retrieved to the change control checklist for system changes.

Moving instruments or systems to a new site

Requalification is the easy part. The risk is losing data history, audit trails or the ability to retrieve old records once the system runs somewhere new. Start with checks 13, 14, 19, 23, 29, 42 and 45.

Selecting a CDMO or service partner

Their computerised systems hold your GMP data, so check how they control and evidence it before you sign, not after the first batch. Start with checks 7, 8, 10, 26, 28, 35 and 39.