This is a ready-to-use assessment document. Replace every <<FILL: ...>> placeholder with your system’s specifics, complete a row for every applicable requirement, and route through your normal validation and QA review. A filled specimen for one system follows the blank template.
1. Header
| Field | Entry |
|---|---|
| System name and version | <<FILL>> |
| Business / technical owner | <<FILL>> |
| GxP scope statement | <<FILL: what GxP records this system creates, modifies, stores, or transmits>> |
| Predicate rule(s) in play | <<FILL: e.g. 21 CFR Part 211, Part 600 series, Part 1271>> |
| EU GMP scope (if applicable) | <<FILL: Yes/No, site(s)>> |
| GAMP software category | <<FILL: 1, 3, 4, or 5>> |
| Assessment date and author | <<FILL>> |
| Approval | See section 4 |
2. Scope determination
| Question | Answer |
|---|---|
| Does the system generate, modify, maintain, archive, retrieve, or transmit a GxP record? | <<FILL: Y/N>> |
| Is that record kept to satisfy a predicate rule (US) or is it a GxP record in an EU GMP context? | <<FILL: Y/N>> |
| Conclusion | <<FILL: In scope, proceed / Out of scope, document rationale and stop here>> |
3. Combined requirements matrix
Complete one row per applicable requirement. Mark not-applicable rows with a stated reason rather than leaving them blank.
| Requirement (Part 11 / Annex 11) | Applicable? | Current control | Evidence | Gap? | Severity | Remediation and owner |
|---|---|---|---|---|---|---|
| §11.10(a) / cl.4, Validated system | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(b)(c) / cl.7, cl.17, Retrieval and retention | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(d)(g) / cl.12, Access control | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(e) / cl.9, Audit trail (on by default, reviewed) | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(f), Sequence/workflow enforcement | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(h), Device checks | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(i) / cl.2, Training | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.10(k) / cl.4, cl.10, Documentation control | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.50 / cl.14, Signature manifestation | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.70 / cl.14, Signature linking | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.100, Uniqueness + FDA certification | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.200 / cl.14, Two-component signing | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| §11.300 / cl.12, Password/ID controls | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| cl.3, Supplier oversight | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| cl.11, Periodic review | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| cl.13, Incident management | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| cl.15, Batch release (if applicable) | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| cl.16, Business continuity | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Severity scale: Critical, record trustworthiness or patient safety directly compromised, generally a stop item before go-live. Major, control weak or partial, data integrity exposure plausible, closed before go-live or formally risk-accepted with an interim control. Minor, documentation or procedural gap, low data risk, closed on a defined post-go-live timeline.
4. Conclusion and approval
| Field | Entry |
|---|---|
| Total gaps identified (Critical / Major / Minor) | <<FILL>> |
| Overall disposition | <<FILL: fit for release / release with risk-accepted gaps / not fit for release pending remediation>> |
| System owner acceptance of residual risk | <<FILL: name, date>> |
| Validation lead | <<FILL: name, date>> |
| QA approval | <<FILL: name, date>> |
Filled specimen (excerpt, three rows)
Header. System: Environmental Monitoring LIMS module, v4.2. Owner: Microbiology QA lead. GxP scope: EM sample results and trend data supporting batch release. Predicate rules: 21 CFR Part 211. EU GMP scope: Yes, one EU site. GAMP category: 4. Assessed 5 August 2026 by CSV specialist T. Wren.
Scope determination. Generates and retains EM results used to support batch disposition: Yes. Kept under 21 CFR 211 and EU GMP: Yes. Conclusion: in scope, proceed.
| Requirement | Applicable? | Current control | Evidence | Gap? | Severity | Remediation and owner |
|---|---|---|---|---|---|---|
| §11.10(e) / cl.9, Audit trail | Yes | On by default, locked from non-admin roles | Config export, negative test TC-12 | No | - | - |
| §11.10(e) / cl.9, Audit trail review | Yes | Weekly review defined in SOP, not yet performed on live system | Draft SOP QA-204, no review records yet | Major | Major | Perform first review before go-live; owner: Micro QA lead, due 2 weeks |
| cl.3, Supplier oversight | Yes | Vendor assessed 2024, no current service agreement on file | Old assessment record, agreement expired | Major | Major | Renew supplier quality agreement; owner: Procurement, due before go-live |
Conclusion. Two Major gaps identified, zero Critical, zero Minor at this stage of review. Overall disposition: release with risk-accepted gaps only if both Majors close within the stated timeline; otherwise hold go-live. System owner accepted the interim risk with both remediation dates documented, 12 August 2026.
Common inspection findings this template prevents
- No written Part 11 / Annex 11 assessment exists at all for a system in active GxP use.
- An assessment exists but is mapped to a system version the site no longer runs.
- Gaps are identified but never ranked by severity, so a Critical and a Minor get the same remediation urgency.
- The assessment was written and approved by the same person who configured the system, with no independent QA review.
How to adapt this template
- Add or remove matrix rows to match what is actually applicable to your system; do not leave inapplicable rows blank without a documented reason.
- Confirm every Part 11 section and Annex 11 clause citation against the currently in-force text; the 2025-2026 Annex 11 revision is a draft, not yet in force, so continue citing the 2011 clauses until the final text publishes.
- Reference this assessment by document number in your validation plan and validation summary report so it is traceable as part of the release package.