Professionals in the health and life sciences industry have been using the GAMP® 5 Guide as a trusted framework for compliant GxP computerized systems since 2008. Geared toward an industry that thrives on innovation and the use of emerging technologies, the ISPE recognized that its GAMP® 5 Guide (First Edition) was in need of a touch-up to clarify and add guidance for new and trending topics – and with that, the GAMP® 5 Guide Second Edition was published in July 2022.
In a nutshell, GAMP® 5 is a guide that provides direction for achieving compliant GxP computerized systems that are fit for intended use. The framework defined in GAMP® 5 deliberately sets out to safeguard patient safety, product quality, and data integrity in the use of GxP computerized systems, all while delivering business benefit.
GAMP® 5 explains how compliance with regulatory requirements and fitness for intended use may be achieved by adopting a lifecycle approach. The extent of lifecycle activities should be patient-centric, risk-proportionate, and scalable according to (1) system impact on patient safety, product quality, and data integrity, (2) system complexity and novelty, and (3) the outcome of supplier assessments. Informed decision-making, risk management, and good judgment contribute to determining where and how to scale lifecycle activities.
The new edition of GAMP® 5 continues to honour the main concepts and principles that were made sacred in the original version, with some notable improvements. Below, you'll find just some of the interesting perspectives and changes brought forward in the new edition:
- The lifecycle approach is not inherently linear
- Use critical thinking to select an appropriate approach
- Use appropriate tools and systems for documentation and information management
- Enable innovation
- First impressions
The lifecycle approach is not inherently linear
While a defined lifecycle approach remains important, GAMP® 5 now emphasizes and states very clearly that the approach is not inherently linear. Iterative and incremental approaches are fully supported and even encouraged when it makes sense. A linear approach (such as V-model or waterfall) remains appropriate for projects where requirements are fully known and defined upfront (e.g. acquisition of off-the-shelf equipment), but for projects that involve complex configurations or custom development of software, non-linear approaches (such as Agile) may be more effective. A new appendix is introduced in the GAMP® 5 Guide Second Edition to specifically address Agile software development (Appendix D8).
Use critical thinking to select an appropriate approach
By definition, critical thinking is the objective analysis and evaluation of circumstances in order to make a sound judgment. Solid understanding of the product at hand and knowledge of the business process in which it is used are key.
Relevant lifecycle activities should be determined based on risk, novelty, and complexity. Not all lifecycle activities will (or should) be applied to every system in the same manner. Not all lifecycle activities will (or should) be applied in different organizations in the same manner. Context matters. The knowledge and experience held by subject matter experts (SMEs) and suppliers alike should be solicited and leveraged to proactively identify and assess risks, implement controls, and to adjust the lifecycle approach accordingly.
The selected lifecycle approach can be optimized by applying critical thinking. For example:
- Critical thinking can be applied during supplier assessment and selection. Knowledge of the processes followed by the supplier and outputs of supplier activities can be leveraged by the regulated user to reduce their own validation activities. Detailed specifications may not need to be recreated and system testing may not need to be reproduced in its entirety when that information is available from the supplier and is deemed suitable.
- Critical thinking can be applied to identify effective testing approaches and to streamline the testing process. For example, you may decide that explicit installation and configuration verification is not required for standard systems because this is implicitly verified during requirements testing. The system would not exhibit the desired behaviour if it were not installed and configured correctly.
Flexibility should be built into lifecycle processes to accommodate and promote critical thinking. A new appendix is introduced in the GAMP® 5 Guide Second Edition to specifically address this topic (Appendix M12).
Use appropriate tools and systems for documentation and information management
Regulatory authorities like to see scaled and targeted activities, with rationales supported by critical thinking. Information and records should be well-organized and have an appropriate level of detail. Maintaining information and records in appropriate software tools and systems is encouraged. These tools and systems could include electronic trial master file solutions, such as Montrium's eTMF Connect.
Tools like these provide numerous benefits (such as: searchability, safeguards against unauthorized access to data) over traditional paper documents. There is no need to create traditional documents simply for the sake of having a document, provided the required information exists and is accessible when needed. A new appendix is introduced in the GAMP® 5 Guide Second Edition to specifically address software tools (Appendix D9).
Enable innovation
Regulatory requirements shall not hinder innovation. Technologies evolve at a rapid pace and their benefits should be embraced. With the evolution in technologies, GAMP® 5 has been updated to reflect modern terminology. Throughout the guide, vocabulary has been upgraded to better align with ITIL and to reflect language that is commonly used in newer areas such as cloud, distributed ledger systems (blockchain), and artificial intelligence and machine learning (AI/ML). New appendices are introduced in the GAMP® 5 Guide Second Edition to specifically address blockchain (Appendix D10) and AI/ML (Appendix D11).
First impressions
At Montrium, we operate as an Agile organisation overseen by a structured quality system. Our cloud-based infrastructure (Microsoft Azure IaaS) is managed by automated tools. Our software development lifecycle follows an iterative approach that includes feature definition, code review, and testing. In place of paper documents, Azure DevOps is used to document and manage risk assessments, requirements, and release pipelines. The Connect products developed by Montrium are subject to unscripted (informal), automated and scripted testing prior to release. Additionally, requirements testing is performed and documented. We encourage Connect subscribers to review and leverage our documented test results in place of traditional user acceptance testing. We believe these activities generate high quality and high value while being cost effective for our subscribers.
Our first impression and initial reaction to the GAMP® 5 Guide Second Edition was “Thank goodness!” and “Finally”. It is reassuring that this Guide, recognized and accepted as a gold-standard across the industry, echoes what we have been thinking and doing all along. 
