Form: GxP System Type Profile

This is a ready-to-use profile sheet for a system type, not a deployed instance. Fill one profile per category your organization uses or is evaluating (a LIMS, a CDS, a BMS/EMS, and so on), so the next time an instance of that category shows up, whoever onboards it starts from a known baseline instead of negotiating scope from a blank page. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.

Control header

Field definitions

Instructions

1. Create one profile per system type your organization actually uses or is evaluating, not per deployed instance. An instance-level record belongs in your system inventory, not here; see the GxP computerized system inventory and data criticality assessment for that.
2. Apply the five-questions framework field by field: what GxP decision does the output typically drive, where does the original record typically live, who can change data and is every change captured, how are signatures applied, and what happens on failure or retirement. The framework and the category tour behind it are in GxP computerized systems, a complete map.
3. Set the typical GAMP category and criticality as a starting default for this category, not a fixed rule. Every deployed instance still gets its own instance-level determination, because the same product can land in a different category depending on how heavily it is configured.
4. List integration points by system type (for example, “typically interfaces to the CDS and the ERP”), so a new instance’s interface risk is visible before anyone builds it.
5. Feed real inspection findings and internal deviations back into the “common inspection findings” field over time, so the profile gets sharper with use instead of going stale on a shelf.
6. Review the profile on the defined frequency, or whenever the regulations that govern this category or the organization’s typical product set for it change materially.

The profile template

Acceptance criteria

• Every field is completed by working through the five-questions framework, not by restating the category name in different words.
• The GAMP category and criticality carry a stated rationale, so a reviewer can see why, not just a number with no reasoning behind it.
• Integration points name specific other system types, never “various systems” or “several downstream systems.”
• The profile is reviewed on schedule and updated whenever a real inspection finding or internal deviation adds a genuine lesson for the category.
• New instances of this system type are onboarded against this profile rather than built up from scratch each time.

References

ISPE GAMP 5 (Second Edition) for the software-category concept referenced in the GAMP category field. 21 CFR Part 11; EU GMP Annex 11, for the electronic-record and electronic-signature expectations behind questions 3 and 4. Related reading: GxP computerized systems, a complete map, the GxP system inventory and classification.

Confirm the current version and clause numbers of each reference before issue.

Revision history

Filled specimen

The following shows a completed profile for the Building Management System (BMS) and Environmental Monitoring System (EMS) category, so you can see the level of detail expected. The values are illustrative.

Common inspection findings this form prevents

• A new system instance validated from a blank scope document because nobody had captured what “typical” looks like for its category, so obvious focus areas get missed.
• Integration risk discovered only after go-live, because nobody named the category’s typical integration points before the interface was built.
• The same inspection finding recurring instance after instance within a category, because lessons from one deployment never reached the next.
• A GAMP category assigned by habit or by what a similar-sounding system got last time, with no stated rationale a reviewer can check.

How to adapt this form

1. Start with the system types you already operate; you likely have five to fifteen distinct categories even if you run dozens of instances.
2. Assign a profile owner per category, usually the validation lead or SME who onboards new instances of it most often.
3. Populate the five-questions fields honestly from real experience with the category, not from vendor marketing material.
4. Revisit the “common inspection findings” field after every internal or external inspection; that field is what keeps the profile useful instead of decorative.
5. Confirm every regulation against the current published version before issue.