Software selection, implementation, and ongoing maintenance are critical stages in the life cycle of biomedical software systems such as asset and calibration management platforms. Yet few industry resources provide detailed, practical guidance for managing these processes effectively.

One notable exception is ISPE’s GAMP 5: “A risk-based approach to compliant GxP computerized systems.” More than 400 pages, this guidance document is the most comprehensive resource available for regulated industries. Yet surprisingly, many system owners remain unaware of its depth and value.

Here, we explore GAMP 5’s background, structure, and major updates in the second edition; highlight its unique contributions; and reveal a “hidden gem” that can save regulated companies substantial validation effort.

Background: What is GAMP 5?

GAMP 5, published by the International Society for Pharmaceutical Engineering (ISPE), provides guidance for achieving computerized systems that are both fit for intended use and compliant with regulatory requirements. It builds on established good practices and can be applied to a wide range of systems, from IT infrastructure and process control to laboratory systems.

Importantly, GAMP 5 is guidance, not a standard. It’s designed for use by regulated companies, suppliers, and even regulators.

ISPE also publishes the GAMP Good Practice Guide: A Risk-Based Approach to GxP Compliant Laboratory Computerized Systems, which focuses specifically on software embedded in laboratory instrumentation. The GAMP documents specialize in the pharmaceutical industry. Although there are no equivalent guidance documents for the medical device industry, these GAMP guides are still highly applicable.

Alongside ISPE’s publications, the U.S. Food and Drug Administration (FDA) offers two important free documents supporting the biomedical industry in the areas of software:
• “General principles of software validation” (2002, final guidance)—An excellent 43-page guide for validating software systems
• “Computer software assurance for production and quality system software” (2022, draft guidance)—a 25-page document aimed at significantly reducing the regulatory burden of software validation through risk-based categorization. This guide will not supersede the first FDA document.

Inside GAMP 5: Structure and key concepts

The second edition of GAMP 5 is organized into nine main sections, supplemented by extensive appendixes:
• Introduction
• Key concepts
• Life cycle approach
• Life cycle phases
• Quality risk management
• Regulated company activities
• Supplier activities
• Efficiency improvements
• Appendixes: Management, development, operation, and special interest topics

Key concepts

There are five key concepts applied throughout the guide:
• Product and process understanding
• Life cycle approach within a QMS
• Scalable life cycle activities
• Science-based quality risk management
• Leveraging supplier involvement

The fifth principle, leveraging supplier involvement, aligns strongly with FDA expectations and emphasizes collaborative efficiency. A graphic representation shows the concepts between the user and the supplier.

GAMP 5: Five key concepts

Life cycle approach and phases

GAMP 5 follows a life cycle framework similar to ASTM E2500—“Standard guide for specification, design, and verification of pharmaceutical and biopharmaceutical manufacturing systems and equipment science and risk-based approach,” focusing on these life cycles:
• Specification
• Design
• Verification
• Acceptance and release

ASTM E2500—Four software life cycles

There are four major GAMP 5 software life cycle phases:
• Concept
• Project
• Operation
• Retirement

GAMP 5—Four software life cycle phases

These four life cycles map directly to typical project management stages for software validation. Think of the concept phase as selection, and the project phase as implementation. The other two phases remain the same.

Supplier and company activities

The guide describes both company and supplier activities in 12 steps. Additionally, both company and supplier activities include the four software life cycles of specification, design, verification, and acceptance and release. The clarity and depth of the supplier activities make the guide an invaluable reference for software suppliers supporting the biomedical industry.

GAMP 5 – 12 supplier activities

One of GAMP 5’s most practical contributions is its nine recommendations for improving validation efficiency:
• Establishing verifiable and appropriate user requirements
• Making risk-based decisions
• Leveraging supplier input
• Leveraging existing records and information
• Using efficient testing practices
• Employing a well-managed handover process
• Managing changes efficiently
• Anticipating data archiving and migration needs
• Using tools and automation

These suggestions align with the FDA’s push for leveraging supplier documentation to reduce redundant validation work. These efficiency improvements are seldom discussed in other software validation guides.

This section is a must-read for quality assurance personnel so they can support the concept of reduced software-validation paperwork and expectation to leverage supplier activities.

The appendixes: Where the real depth lies

Unlike many guidance documents, GAMP 5’s appendixes contain the bulk of its actionable content. They cover:
• Management
• Development
• Operation
• Special interest topics
• General

Each of these appendixes contain a vast list of activities.

Management: This appendix contains 12 elements focused on planning and reporting for validation.

Development: This appendix contains 11 elements focused on specifications and testing. One important element is data migration. Data migration is seldom discussed in other software validation guides.

Operation: This appendix contains 13 elements focused on maintaining the software once released. It provides essential guidance rarely found in similar documents. Most software validation guides stop at implementation and seldom go into describing expectation for maintaining validated status post-implementation.

Special interest topics: Focused discussions on unique challenges.

General: This is your typical appendix focusing on references and glossary.

Second edition updates

Here is a summary of the second edition updates since the first edition.

New guidance

• Appendix M11—IT infrastructure
• Appendix M12—Critical thinking
• Appendix D8—Agile
• Appendix D9—Software tools
• Appendix D10—Distributed ledger systems (blockchain)
• Appendix D11—Artificial intelligence and machine learning (AI/ML)

Significant updates

• Appendix D1—Specifying requirements
• Appendix S2—Electronic production records

Deleted appendixes

• Appendix D2—Functional specifications (merged with D1)
• Appendix O7—Repair activity
• Appendix S5—Managing quality within an outsourced IS/IT environment

If your work doesn’t require the new topics, the first edition may still serve your needs.

The hidden gem: Spreadsheet guidance

Buried in Appendix S3 is perhaps GAMP 5’s most overlooked and valuable section: managing end-user applications, especially spreadsheets.

This guidance is easy to overlook on a first read, yet it can significantly reduce validation effort. What GAMP 5 highlights is that spreadsheets can be classified into five categories, each with distinct control and validation requirements. For organizations drowning in spreadsheet-based qualifications, this classification system can save significant time and resources. This section alone makes GAMP 5 a valuable addition to your software qualification tool kit.

These are the five classifications for spreadsheets:

1. No calculations: The spreadsheet is solely used for tabulation and formatting with no calculations. Users have found that spreadsheets are a quick way to create columns of information without any additional steps. That’s efficient, but it can create regulatory issues if not classified and controlled correctly (first edition).

2. Disposable: The spreadsheet is used in the same way as a handheld calculator. The electronic record isn’t kept, but the values and results are recorded and approved elsewhere.

3. Retained as documents: Managed as word-processing files.

4. As databases: This is a growing issue for biomedical companies because spreadsheets are inadequate for controlling access, change control, audit trails, password and security profile management, and revisions. Convert to a true database application.

5. Used as templates: This is an ideal way to use spreadsheets. A template allows you to reuse the master version spreadsheet over and over again without having to revalidate the calculations and formulas. It’s an efficient way to maximize the power and useability of spreadsheets.

Summary

GAMP 5 remains the most comprehensive, practical, and regulatory-aligned guide for managing GxP computerized systems. Its deep appendixes, emphasis on supplier collaboration, and detailed life cycle guidance make it indispensable for both regulated companies and their software suppliers.

Perhaps most important, its pragmatic approach to everyday tools such as spreadsheets proves that compliance can be achieved without unnecessary complexity or wasted effort.

GAMP 5 provides a comprehensive cradle-to-grave framework for managing computer software life cycles. The software operation life cycle is of significant importance because the level of detail for maintaining software isn’t found in other guides. And if you think about it, we use software for a lot longer than it takes to implement or retire.

Additionally, GAMP 5 is both aligned to FDA expectations for compliant software, but also aligned to another valuable resource in ASTM E2500.

For any biomedical organization seeking to optimize its software validation process, GAMP 5 isn’t just recommended—it’s essential.