How to Select the Right GAMP® 5 Software Category for your SharePoint Application

Computer System Validation has traditionally been considered a lengthy and costly process, with significant budgets being allocated to validating electronic systems in the life sciences – and in some cases for good reason. With a heavy price tag, computer system validation professionals are often pressured to reduce these budgets and deliver validated systems in a shorter time, with less resources while still maintaining quality and compliance.

Much like any process improvement, the secret to reducing timelines and ultimately cost is in the design of the process and the structure of the activity, as well as adopting forward thinking guidelines to reduce bottlenecks. Within the validation world, one of the most adopted guidelines is GAMP 5.

GAMP® 5 defines Software Categories that may be used along with risk assessments and supplier assessments to develop a suitable and streamlined validation strategy for your software application. So how do you go about selecting the right GAMP® 5 Software Category for your SharePoint application?  Here are some guidelines to help you decide.

GAMP® Software Category Definitions

First, let’s define the Software Categories within the GAMP 5 Guidelines.  These categories progress from simple, low-risk systems to complex software with increased risk of system failure. 

Selecting a Software Category for your SharePoint application

Next, you need to reflect on how you intend on using SharePoint to accomplish your business activities.  It is important to evaluate whether SharePoint can meet your business requirements “out of the box” or if any configuration or customizations are needed.  Then, you can use the following rules of thumb for choosing the appropriate software category.

Category 3

To consider SharePoint as Software Category 3, it must be used “out of the box”, without any configuration, as a collaborative environment and document repository. 

With the default settings, SharePoint offers limited functionality that is of interest to regulated users.  In its vanilla version, SharePoint would serve as a collaborative workspace only and would not be very useful for the management of electronic records that are subject to the regulatory restrictions of predicate rules because functionality for versioning, audit trails, and record restrictions are not enabled by default. 

In other words, it is improbable that SharePoint would fall under this category. Even if it did, the intended use of this SharePoint instance would probably not have any regulatory purpose that would necessitate validation.

Category 4

Certain SharePoint functionality can be configured (activated/deactivated, enabled/disabled) above and beyond what is offered in a vanilla deployment.  More importantly, certain functionality (such as information management policies, auditing, and versioning) must be configured if SharePoint is to be used in a 21 CFR 11 compliant manner for the management of regulated content (e-records).  In this case, SharePoint is configured to meet business process needs and, therefore, would be considered as a Software Category 4.

Category 5

If specific configuration of out-of-the-box functionality is insufficient to meet business process needs, it may be necessary to customize SharePoint for the management of regulated content (e-records).  For example, custom workflows and/or scripts may be designed and used.  Using bespoke workflows and features would elevate the SharePoint instance to Software Category 5.

Mix and Match

Suppose you are able to clearly delineate which functions will be used in their native state vs. the functions that will be configured for your business processes vs. any custom features.  Then a "mix and match" approach could be used.  GAMP encourages the use of a risk-based approach and the compartmentalization of functions into appropriate categories is a practical way of doing this.

A Word about SharePoint Online

The features offered in SharePoint Online may differ from those available in an on-premise instance of SharePoint.  Nonetheless, the criteria for selecting a GAMP® 5 Software Category remain the same.

The Takeaway

Validation effort should be commensurate with the complexity and risk of the system. Defining the system landscape may not be a simple task, but it will help by providing clarity on your system and its intended purpose.

It is important to map out which SharePoint functionality will be used and to determine whether these functions are realized through configuration or customization or neither. This will make it easier to assign the right GAMP® 5 Software Category and, consequently, make you better positioned to apply a risk-based approach to validation.