Six months post-deployment, an operator discovered that by changing a single dropdown setting from "Mandatory data entry" to "Optional," they could skip a critical weigh-check step. This parameter was not included in the original OQ because it was considered "non-configurable" by the validation team.
The International Society for Pharmaceutical Engineering (ISPE)’s GAMP (Good Automated Manufacturing Practice) guide provides a risk-based approach to validating computerized systems in the pharmaceutical and biotech industries. Central to this framework is the categorization of software based on its complexity, standardization, and intended use. gamp 4 category
They revalidated by implementing a risk-based parameter classification (Critical, Major, Minor) and added automated configuration drift detection. Six months post-deployment, an operator discovered that by
To address these risks, modern Category 4 validation must incorporate: Central to this framework is the categorization of
| Feature | GAMP Category 4 (Configured) | GAMP Category 5 (Custom/Bespoke) | | :--- | :--- | :--- | | | None (no source code changes) | Yes (new code written) | | Configuration | Parameter setting, tables, workflows | Not applicable or minimal | | Supplier role | Provide standard product + config tools | Provide development services | | Validation risk | Medium (focused on correct config) | High (requires unit/integration testing) | | Reusability of evidence | High (supplier documentation) | Low (project-specific) |
Understanding the distinction between configuration and customization is critical.
A pharmaceutical manufacturer implemented a GAMP Category 4 Manufacturing Execution System to enforce electronic batch record workflows. During validation, they tested all "happy path" configurations.