3rd Edition
Pharmaceutical Computer Systems Validation Volume 1 - Quality Assurance, Risk Management and Regulatory Compliance
Foreword
Preface
About The Editor
Abbreviations
Chapter 1 Introduction
Chapter 2 Organization and Management
Chapter 3 Lifecycle Methodologies & Supporting Processes
Chapter 4 Prospective Verification and Validation
Chapter 5 Project Initiation and Compliance Determination
Chapter 6 Requirements Capture and Supplier (Vendor) Selection
Chapter 7 Design and Development
Chapter 8 Coding, Configuration, and Build
Chapter 9 Development Testing
Chapter 10 User Qualification and Authorization to Use
Chapter 11 Operation and Maintenance
Chapter 12 Phaseout and Withdrawal
Chapter 13 Data Integrity
Chapter 14 Regulated Electronic Records and Electronic Signatures
Chapter 15 Artificial Intelligence & Machine Learning
Chapter 16 Regulatory Inspections
Chapter 17 Compliance Strategies
Chapter 18 Capabilities, Measures, and Performance
Chapter 19 Practical Troubleshooting
Chapter 20 Concluding Remarks
Glossary
Index
Biography
Guy Wingate, PhD, was Vice President & Compliance Officer and before that Director Global Computer Validation at GlaxoSmithKline until his recent retirement. A well‑known speaker on computer validation, he has over 30 years of experience in the pharmaceutical industry. He has been a visiting lecturer at the University of Manchester’s M.Sc. in Pharmaceutical Engineering Advanced Training program and the Dublin Institute of Technology’s accredited M.Sc. in Validation Science program. He is an active member of the ISPE and served as Chair of the GAMP Council for 10 years, which is responsible for the internationally recognized suite of GAMP® Guides on computer compliance. Guy led the teams who produced the original GAMP®5 Guide: A Risk Based Approach to Compliant GxP Computerized Systems and the GAMP® Good Practice Guide: A Risk-Based Approach to Compliant Electronic Records and Signatures. His extensive list of published work also includes the books Validating Automated Manufacturing and Laboratory Applications, Validating Corporate Computer Systems and previous editions of this book Pharmaceutical Computer Systems Validation.
This book’s strong emphasis on governance, management oversight, and maintaining control throughout the operational life cycle [of computer systems used in the pharmaceutical industry] is both timely and necessary.
A key challenge for today’s organizations today is the shift from validating systems at a point in time to assuring them continuously throughout their life. Modern development and delivery approaches, such as Agile and DevOps, can support this goal, but only when the supporting controls are designed deliberately and applied consistently. Clear intent of requirements, risk‐based decision‐making, appropriate testing strategies for high‐risk functions, robust release and configuration management, and effective supplier oversight remain essential. Several chapters in the book address these realities directly, focusing on the areas where compliance most often degrades: operation, maintenance, and change.
At the same time, the regulatory and compliance landscape continues to evolve. There is sustained global focus on data governance and data integrity, including expectations for effective investigation, remediation, and prevention of recurrence. Cybersecurity, data availability, and business continuity are receiving increased attention, reflecting their direct impact on product quality and patient safety. Regulators also increasingly expect organizations to understand, control, and justify the use of emerging technologies, particularly where these technologies influence GxP decisions, regulated records, or regulatory submissions.
What is particularly welcome about this book is its practical orientation. While regulations and guidance are widely available, many organizations struggle to translate high‐level principles into consistent execution across diverse system types and life cycle stages. This work helps to bridge that gap. Through its structured approach and breadth of examples, from laboratory and manufacturing systems to enterprise platforms, infrastructure, cloud services, and data‐intensive digital architectures, it provides practitioners with a coherent framework grounded in real operational experience.
I would encourage readers to approach this book not simply as a compliance manual, but as a guide to building organizational capability. Capability means being able to explain, with confidence, how and why controls are proportionate to risk; demonstrating that systems are fit for their intended use; evidencing that data remain complete, consistent, and trustworthy throughout the data life cycle; and showing that the organization learns through effective management review, meaningful metrics, and a culture that treats issues as opportunities for improvement rather than occasions for blame.
In an era of increasing digital dependence, this capability is not optional. It is fundamental to protecting patients, safeguarding product quality, and maintaining trust in the organizations responsible for both. I commend this book to practitioners, managers, and auditors alike, and I hope it serves as a practical companion in building the right environment, technical, procedural, and cultural, for robust computer compliance and data integrity.
Tracy Moore
Former Expert GMP Inspector, UK Medicines & Healthcare products Regulatory Agency (MHRA)
