GAMP Good Practice Guide: A Risk-Based Approach to Compliant Electronic Records and Signatures PDF

The appropriate management of electronic records and signatures is of current concern to both the regulated life science industry and its regulators.

A new GAMP Good Practice Guide: A Risk-Based Approach to Compliant Electronic Records and Signatures has been developed by GAMP Forum, a technical subcommittee of ISPE, to provide timely and much needed guidance in this area. It supplements the existing GAMP 4 Guide for Validation of Automated Systems.

This Guide provides new comprehensive guidance on meeting current regulatory expectations for compliant electronic records and signatures, which includes the need for record integrity, security, and availability throughout the required retention period. This is achieved by well-documented, validated systems, and the application of appropriate operational controls. The Guide covers:

– new automated systems
– existing automated systems
– those systems that have already been subject to electronic record and signature assessments

The Guide applies a risk based approach to the identification, management, and control of electronic records and signatures in a regulated GxP context aimed at the implementation of technical and procedural controls appropriate to the impact of records, and to the risks to those records.

The approach allows measures aimed at a high degree of integrity, availability, and confidentiality (where required) to be established for records that have a high potential impact on product quality or patient safety, while permitting a less rigorous approach for records of lower impact, or those with lower levels of associated risk.

As a result, and for the first time, a simple and pragmatic approach is described that can be applied to any automated system required to meet international regulations.

The main section of the Guide provides a process by which a regulated company can identify the hazards associated with the use of electronic records and signatures, analyze and evaluate the risks, control these risks, and subsequently monitor the effectiveness of the controls by means of periodic review.

This is supplemented by appendices covering a range of common issues of concern, as well as reference and supporting materials. These include:

– Validation
– Audit trail and data security
– Record retention and archiving
– Copies of records
– 21 CFR Part 11 legacy systems
– Examples of records required by predicate rules
– Examples of signatures required by predicate rules
– Case studies
– Template forms to support the processes described
– Current regulatory situation