CSV Validation Checklist — the 26-deliverable master list

States scope, the systems in it, the lifecycle model, roles and responsibilities, and the acceptance criteria for declaring the system validated.

Narrows the VMP to one system: its GAMP category, the deliverables that apply, the test strategy chosen and the written rationale for anything excluded.

Describes what the system does, its GxP impact, interfaces, data flows and where regulated records are created or changed.

Records the decision on whether the system is GxP-regulated at all, and why. A documented 'not GxP' is as valuable as a 'yes'.

Assigns Category 1, 3, 4 or 5 with justification, because the category drives how much of this list applies.

Numbered, testable requirements expressed as what the business needs, not how the software does it. Each one must be verifiable.

How the system satisfies each URS requirement. Required where the system is configured or custom.

The technical design: architecture, data model, interfaces, security model. Required for custom development.

The exact configured values, workflows, roles and parameters applied to a commercial product.

Evidence that servers, network, OS and database layers beneath the application are qualified and controlled.

Scores each requirement for severity, probability and detectability, and maps each score to a test approach. The mapping must be stated, not implied.

Evaluates the vendor's quality system and development practice, and states what supplier evidence you will rely on instead of re-testing.

Maps each electronic-records and electronic-signature requirement to the specific configuration that satisfies it.

Identifies where regulated data is created, changed and deleted, and confirms ALCOA+ controls at each point.

States which requirements get scripted testing, which get unscripted or exploratory testing with a session record, and which rely on vendor evidence.

Verifies the system was installed as designed: correct version, approved configuration, qualified infrastructure.

Tests each functional requirement against defined acceptance criteria under controlled conditions.

Demonstrates the system performs in the real operational context, with real users, representative data volumes and actual business processes.

Each step has an expected result defined in advance. 'Works as expected' is not an acceptance criterion.

Signed and dated by the executor, with evidence attached. Executed in the validated environment, not in development.

Legible, timestamped, attributable to the person who captured it, and traceable to the test step it supports.

Every deviation recorded, investigated, assigned an impact, and closed with a documented resolution. An accepted deviation needs a justification, not a note.

Links every URS requirement to its specification, its test case and its result, and shows coverage gaps explicitly rather than hiding them.

Confirms all requirements were tested, all deviations closed, and the system is approved for GxP use. Signed by QA.

Assesses the regulatory impact of every change before it reaches production, and defines what triggers revalidation.

A structured review of change history, incidents, performance and current regulatory expectations, at a defined cadence. An Annex 11 obligation, and the most commonly skipped item on this list.