The Cat 1/3/4/5 doctrine, applied to your stack.
We translate GAMP 5 Second Edition — Agile, critical thinking, CSA alignment — into the actual document set, test strategy and roles for your systems. Practical, not academic.
GAMP 5 is ISPE's guide to validating computerised systems in regulated life sciences. Its central device is the software category — 1, 3, 4 or 5 — which determines how much of the lifecycle applies. The 2022 Second Edition adds critical thinking, alignment with FDA's Computer Software Assurance approach, and guidance for Agile delivery and cloud services.
Outcomes you can expect
- GAMP categorisation of estate
- Right-sized document set per category
- Playbooks for Cat 3 / Cat 4 / Cat 5
GAMP 5 Second Edition Consulting is delivered by our validation & compliance services practice. Where it saves time, the team uses our products: GxP Copilot for validation lifecycle work and TraceDraft for clinical documentation.
Explore related capabilities: Computer System Validation (CSV), Computer Software Assurance (CSA), AI Validation Services (Annex 22), FDA 21 CFR Part 11 Compliance.
GAMP 5 Second Edition: What Changed and Why It Matters
GAMP 5 Second Edition, published in 2022, represents the most significant revision to the pharmaceutical industry's primary computer validation guidance since the first edition in 2008. The headline changes are well known: alignment with FDA's CSA thinking, explicit incorporation of Agile development practices, a stronger emphasis on critical thinking over template compliance, and the replacement of the old Category 2 (standard instruments with no software) with a more nuanced risk classification framework. But the practical impact of these changes depends entirely on how they are implemented — and most organisations implementing GAMP 5 Second Edition underestimate the change management required to move from format-driven to reasoning-driven validation.
The Second Edition's core message is that validation effort should be proportionate to risk — not to system complexity, not to system importance, and not to regulatory visibility, but to the actual risk that a system failure poses to product quality, patient safety, or data integrity. A high-complexity system with robust supplier testing and low direct GMP impact may require less customer validation effort than a simple, highly configurable system directly managing in-process controls. This inversion of the traditional complexity-volume assumption is the change that most organisations find most difficult to implement in practice.
The Category Framework: Cat 1, Cat 3, Cat 4, Cat 5
GAMP 5's software category framework classifies systems by their software type, which drives the baseline validation approach. Category 1 covers infrastructure software — operating systems, database engines, network management tools — that supports GxP systems but does not itself execute GxP functions. Category 1 requires qualification of the infrastructure, not validation of the software functionality. Category 3 covers firmware and non-configured software — instruments with embedded software operating in a fixed, non-user-configurable manner. The validation scope focuses on installation and operational testing, not configuration verification.
Category 4 covers configured software — commercial off-the-shelf applications that can be configured without programming: LIMS, eQMS, MES, ERP systems. The validation effort focuses on the configuration choices and their impact on GxP functions, not on re-proving the underlying software functionality that the vendor has already tested. Category 5 covers custom and customised software — bespoke applications or configured applications with significant custom code. Category 5 requires the full software development lifecycle evidence: design documentation, code review, unit testing, integration testing, and formal qualification. Most systems organisations encounter fall into Category 4.
Critical Thinking: The New Default in GAMP 5 Second Edition
GAMP 5 Second Edition explicitly rejects the idea that validation is primarily a documentation exercise. It introduces 'critical thinking' as a foundational principle: the validation team should apply professional judgement to every decision — what to test, how to test it, what level of documentation is sufficient, and when supplier evidence is adequate. This is not a licence to do less; it is a requirement to do better. A validation that produces 500 pages of OQ test scripts without a documented rationale for test case selection provides less assurance than a 50-page validation with a clear, reasoned risk assessment driving every test decision.
Implementing critical thinking in practice requires validation engineers who understand the regulations well enough to reason from them, not just compliance professionals who can populate templates correctly. Our GAMP 5 Second Edition consulting practice provides this — working with your validation team to build the reasoning skills and the risk assessment methodology that transforms template-driven validation into defensible, inspection-ready assurance. The deliverable set changes: instead of a thick binder of scripted tests, you produce a lean package where every test exists for a documented reason.
Agile Compatibility: Validating in Sprints
One of the most practically significant aspects of GAMP 5 Second Edition is its explicit acknowledgement that Agile software development is compatible with GxP validation. Traditional validation assumed waterfall development: complete the design before testing, complete testing before release. Agile challenges both assumptions: design and implementation evolve together, and testing is continuous throughout development. GAMP 5 Second Edition provides the framework for integrating validation activities into Agile sprints without abandoning the lifecycle documentation that regulators require.
In practice, Agile-compatible GxP validation means: defining the quality attributes and risk assessment at the epic or feature level rather than requiring complete requirements before any sprint begins; integrating unit and integration testing into the CI/CD pipeline with test results automatically linked to user stories; and reserving formal OQ and PQ execution for the end of development sprints that contain GxP-critical functionality changes. Our Agile validation practice helps development teams design their sprint governance to produce compliant validation evidence as a natural output of development, not as a retrospective documentation exercise.
Right-Sizing the Document Set by Category
GAMP 5 Second Edition provides explicit guidance on which controlled deliverables are appropriate for each system category. Category 3 and 4 systems typically do not require a full Functional Specification and Design Specification — the vendor's existing product documentation can substitute, supplemented by the organisation's configuration specification. Category 5 custom systems require the full document set. Applying the Category 5 document set to a Category 4 system is not conservatism — it is an allocation of validation resource away from higher-risk activities and toward low-value documentation that adds no assurance.
Our GAMP 5 Second Edition consulting engagements begin with a categorisation workshop for your full system inventory, producing a right-sized document set for each system class. We then develop category-specific template packages — lean for Category 3 and 4, comprehensive for Category 5 — that your validation team can apply consistently across the estate. The result is not less documentation overall, but documentation that is proportionate to risk and therefore more credible to inspectors than a uniform approach applied regardless of system type.
Sources
Primary documents referred to on this page, from their official publishers.
See it on your own system.
Bring a URS or a system. We show you the validation package it produces.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan and scope