5 Category 4: Gamp

The key distinction lies between and customization . Configuration involves setting standard, pre-tested parameters—such as defining user roles, setting approval workflows, or creating data entry forms—without altering the underlying source code. Customization (Category 5), conversely, involves writing new code, which introduces novel risks. Category 4 systems leverage the vendor’s tested core, but the act of configuring creates a unique instance that must be validated in its user environment.

Category 4 refers to . These are software packages (often COTS - Commercial Off-The-Shelf) that are designed for a specific set of business processes by configuring predefined software features. gamp 5 category 4

Since you are relying on the vendor’s code, you need to ensure they have a robust Quality Management System (QMS). For Category 4, a postal audit or a review of their development practices is often sufficient. 5. Testing (IQ/OQ/PQ) The key distinction lies between and customization

By embracing a risk-based approach—focusing testing efforts on high-risk configurations, rigorously managing vendor relationships, and embedding data integrity into every setting—organizations transform Category 4 validation from a compliance checkbox into a strategic advantage. When properly executed, a validated Category 4 system does not just prove compliance; it ensures that the automation driving today’s life-saving medicines is fundamentally trustworthy and robust. In the end, the configuration is the control, and the control is the key to quality. Category 4 systems leverage the vendor’s tested core,

Perform a Functional Risk Assessment. Since the core code is "tried and tested" by the vendor, your focus should be on the . What happens if a user role is configured with too many permissions? What if a workflow step is bypassed? 3. Configuration Specification (CS)

This relationship necessitates a reliance on Supplier Assessment. For a Category 4 system, a pharmaceutical company rarely performs a line-by-line code review, as the code is proprietary and standard. Instead, the validation strategy shifts to assessing the supplier's Software Development Life Cycle (SDLC) quality management system. The user must verify that the supplier has adequately tested the standard functions. The user’s validation effort then focuses on the "configured" aspects: the specific workflows, the calculations defined by the configuration, and the integration with other systems.