Operation of Computerised Systems – An Overview

Excerpt from the GMP Compliance Adviser, Chapter 9.F, Operation of computerised systems

5 min. reading time | by Dennis Sandkühler, PhD 
Published in LOGFILE 23/2025 

The rapid development of information technology has made computerized systems central to the pharmaceutical industry. They are essential for managing sensitive data, controlling production processes, and ensuring regulatory compliance. This article provides an overview of key considerations for operating computerized systems.

What regulatory requirements must be upheld, and IT security measures must be enforced when operating computerized systems in the pharmaceutical industry?

Computerized systems are crucial for modern pharmaceutical and biotechnological production processes. They manage sensitive data, control processes and ensure compliance with regulations, making them a challenge in terms of compliance and IT security. The EU GMP Guideline Annex 11 sets clear requirements for computerized systems used in regulated areas. These range from validating the systems and ensuring data integrity to detailed specifications for user administration, audit trails and change management. In addition, the ISPE GAMP® 5, 2nd Edition Guide provides a practical framework for implementing these requirements. With increasing digitalization, the requirements for IT security are also increasing. International standards such as ISO 27001 and the NIST guidelines set benchmarks for protection against cyber-attacks, controlled access to systems and the secure handling of critical data. Continuous risk assessment is essential in order to identify potential threats at an early stage and take appropriate protective measures. 

What measures are required to successfully go live with computerised systems into productive operation status and ensure a stable operational phase? 

The introduction of a new system or an update is not completed with the final validation test. Only the planned execution of go-live and handover to operations determines its long-term stability. To ensure that this transition runs smoothly, measures must be taken during the implementation phase to prepare for operation. This includes detailed documentation of the system configuration, which creates a traceable basis for maintenance and future changes. In addition, a hypercare phase should be planned in which the project team provides extensive support to the operational organization. Early training of key users, administrators and support teams ensures the necessary expertise for subsequent operation. A clear assignment of responsibilities in service level agreements (SLAs) and quality assurance agreements (QAAs) ensures that support processes are defined and potential problems can be escalated quickly. 

What special requirements and processes apply to the operation and maintenance of validated computerized systems compared to general IT systems? And how can data integrity, user management and access controls be ensured to meet regulatory and security requirements? 

The operation of validated systems follows far stricter guidelines than conventional IT systems. While agile fixes and short-term updates are common in the general IT realm, GMP-relevant systems are subject to strict change management. Every modification must be planned, documented, validated and approved before it can be implemented. In addition to technical maintenance, the operation of these systems also includes regulatory requirements such as the regular review of user access rights, monitoring audit trails and ensuring that the system continues to comply with the original specifications. In particular, systems that have a direct impact on product quality and patient safety require close monitoring. Data integrity is the basis for the compliant operation of computerized systems. Changes to data and configurations must be fully documented and traceable. Audit trails record these changes and allow comprehensive tracking. Sophisticated user and access management minimizes security risks. Access rights should be assigned on a role basis so that each user only has access to the functions relevant to them. Regular checks of user access rights prevent unauthorized persons from gaining access to critical systems. In addition, companies must ensure that their backup and recovery mechanisms are designed in such a way that no data loss occurs and a system failure can be rectified quickly. 

How do incident, problem and change management work together to ensure system stability and compliance in a regulated environment? And what strategies are necessary to ensure system availability, data recovery and emergency planning? 

The reliable operation of computerized systems requires closely interlinked incident, problem and change management. Incident management ensures a rapid response to unexpected system malfunctions so that operations can be restored as quickly as possible. If an incident occurs repeatedly or is more serious, problem management comes into play: it is used to identify the root cause and to develop a long-term solution. Planned system changes fall under the change control system. Change proposals are evaluated, checked for risks and only implemented after approval and validation. CAPA processes (Corrective and Preventive Actions) complement these mechanisms by analysing deviations in a structured manner and implementing preventive measures. System availability and contingency planning are critical success factors for the stable operation of computerized systems. A robust backup strategy is essential in order to be able to restore data at any time. In addition, companies need to develop disaster recovery plans (DRP) that describe how to recover in the event of a major system failure. In conjunction with a business continuity plan (BCP), measures are defined to maintain critical business processes even during a disruption. An important factor is the definition of Recovery Time Objective (RTO) and Recovery Point Objective (RPO), which determine how quickly a system must be restored and how much data loss is tolerable. 

What are the different priorities of the Quality Assurance and IT departments when operating computerized systems, and how can they cooperate effectively? 

The Quality Assurance and IT departments pursue different but complementary goals. While QA focuses on regulatory compliance, data integrity and audit compliance, IT focuses on technical availability, maintenance and security. Effective collaboration requires clear communication. Regular meetings, joint training and close coordination in change and problem management help to ensure system integrity and stability.