QLean Blog

GMP Validation
for Engineers.

Practical guides on GAMP 5, IQ/OQ/PQ, 21 CFR Part 11, and everything else pharma QA expects from your automation project. Written by engineers who've had these documents reviewed by real QA teams.

Featured Article
📋 Validation Fundamentals
IQ OQ PQ Explained:
A Practical Guide for
Automation Engineers
MAY 2026 · 8 MIN READ
Start Here

You've just landed your first pharma project. The client's QA team starts talking about IQ, OQ, and PQ. Here's exactly what those three letters mean — the documents you need to produce, what each phase must contain, and how the whole lifecycle connects from URS to VSR.

Read the article →
All Articles
📐 GAMP 5
GAMP 5 Categories: What They Mean and How to Classify Your System
CAT 1 Infra CAT 3 COTS CAT 4 Config. CAT 5 Custom
The single decision that determines your entire validation document scope. Get it wrong and you're either massively over-documenting or leaving a gap that surfaces in QA review.
MAY 2026 · 7 MIN READ
→
🌡️ Temperature Monitoring
21 CFR Part 11 for Temperature Monitoring Systems and Data Loggers
SENSOR PT100 DATA LOGGER PART 11 ✓ MONITORING SOFTWARE AUDIT TRAIL ✓ ARCH LIMS
Cold chain, stability chambers, cleanroom monitoring — if your temperature data feeds a GMP record, Part 11 applies. Here's what that means for your audit trail, access control, and validation scope.
MAY 2026 · 8 MIN READ
→
⚖️ Regulatory
21 CFR Part 11: What You Actually Need to Implement in Your SCADA
TIMESTAMP USER ACTION VALUE 14:22:07 eng.smith SP CHANGE 80.0°C 09:22:07 op.jones ALARM ACK UNACK
Audit trails, access control, electronic signatures — a practical breakdown of what Part 11 actually requires from your SCADA system, and which OQ test cases you need to evidence it.
MAY 2026 · 7 MIN READ
→
🏭 Factory Acceptance
Your First Pharma FAT: What to Expect and How to Prepare
1 APPROVE 2 VERSION 3 EXECUTE 4 FORCE AUD. 5 SIGN-OFF
A pharma FAT is a formal quality event, not a functional demo. The QA witness is verifying your evidence, not watching your system work. Here's what that means for how you prepare.
MAY 2026 · 6 MIN READ
→
🔗 Traceability
The Traceability Matrix: How to Link Requirements to Test Cases
URS FDS FAT OQ PQ STATUS F-001 3.1 22 031 05 CLOSED P-011 7.3 ⚠ ⚠ ⚠ OPEN
Build it wrong and you'll spend two days before QA review scrambling to fill gaps. Build it right and every requirement is demonstrably tested — in both directions.
MAY 2026 · 6 MIN READ
→
📄 Design Documents
URS vs FDS: What's the Difference and Why It Matters
URS What the system must do Technology-neutral FDS How the system achieves it Technology-specific
The URS says what, the FDS says how. Mix them up and your traceability matrix will never close. Five real example pairs show the difference clearly.
MAY 2026 · 7 MIN READ
→
📐 GAMP 5 Theory
The V-Model in Pharma Validation: How GAMP 5 Uses It
URS FDS FAT PQ OQ IQ
The framework every GAMP 5 project is built on — left side is design, right side is testing. Understand it and the entire validation structure makes sense.
MAY 2026 · 7 MIN READ
→
⚠️ Risk Assessment
GAMP 5 Risk Assessment: How to Score Functions and Justify Scope
MED HIGH CRIT LOW MED HIGH HI MED CRITICAL → Multiple OQ MEDIUM → OQ or justify LOW → Review only
Risk scores justify your testing scope. How to write specific failure modes, score probability and impact correctly, and what QA reviewers look for when every function is marked "Medium."
MAY 2026 · 8 MIN READ
→
🔄 Change Control
Change Control for Validated PLC/SCADA Systems: The Complete Guide
INITIATE ASSESS APPROVE TEST ✓ Every change needs a CCR before work starts
Once validated, every change — logic mod, firmware patch, new I/O — needs a formal assessment. What triggers it, how to scope requalification, and how to handle emergency changes.
MAY 2026 · 8 MIN READ
→
📋 Validation Plan
The GAMP 5 Validation Plan: What It Must Contain and Why It Comes First
VALIDATION PLAN — SECTION INDEX §1 Scope §2 System §3 GAMP Category §4 Regulations §5 Documents §6 Roles §7 Deviations §8 Acceptance Must be approved before URS is written
Approved before any other document. Defines scope, category, required documents, roles, and acceptance criteria. Here's the complete 12-section structure and what QA checks in each.
MAY 2026 · 7 MIN READ
→
📊 CSV vs CSA
CSV vs CSA: What Changed and What It Means for Engineers
CSV Document everything Volume = thoroughness CSA Test what's critical Risk = depth →
The FDA's 2022 Computer Software Assurance guidance changed where validation effort should go. What stays the same, what changes, and why EU teams are slower to adopt it.
MAY 2026 · 7 MIN READ
→
🏗️ SAT
The Site Acceptance Test (SAT): What It Is and Why You Need One
FAT SAT Pre-IQ IQ OQ Fix problems here — not in IQ
The most commonly skipped step — and the one you'll regret skipping when a wiring error becomes an IQ deviation. Here's what it tests and how it protects your formal qualification record.
MAY 2026 · 6 MIN READ
→
✅ VSR
The Validation Summary Report (VSR): What It Contains and How to Write It
VALIDATION SUMMARY REPORT IQ: 24/24 PASS · OQ: 69/72 PASS · DEV: 3 CLOSED PQ: 18/18 PASS · TM: 100% COMPLETE SYSTEM VALIDATED ✓
The last document written and the first one an inspector reads. It closes the V-model and declares the system validated. Here's the 8-section structure and what the deviation summary must include.
MAY 2026 · 6 MIN READ
→
🔍 Supplier Assessment
Supplier Assessment in GAMP 5: What to Ask and How to Use It
Issue SAQ Review Issue SAR Leverage vendor testing
A mature supplier QMS reduces your OQ scope. Annex 11 requires the SAQ before contract award. Here's the 8 questions that matter and how a strong SAR changes your test strategy.
MAY 2026 · 7 MIN READ
→
📝 URS
How to Write a URS for a PLC/SCADA System: Step-by-Step Guide
[URS-FUN-001] Maintain temp within ±2°C of setpoint. [URS-SEC-003] Lock account after 3 failed logins. [URS-DI-002] Log all setpoint changes with user ID.
Document structure, requirement numbering format, good vs bad requirement examples, and the regulatory section every experienced engineer adds — but most first-timers skip.
MAY 2026 · 9 MIN READ
→
⚖️ Regulatory
EU GMP Annex 11 vs 21 CFR Part 11: The Complete Comparison
EU GMP ANNEX 11 Guidance · "should" All computerised systems 21 CFR PART 11 Regulation · "shall" Electronic records only
Two regulations, one system. The four differences that actually matter — scope, ALCOA+, business continuity, and supplier management — and how to map your OQ to satisfy both.
MAY 2026 · 8 MIN READ
→
📄 FDS
How to Write an FDS for a PLC/SCADA System: Structure, Content and Examples
FUNCTIONAL DESIGN SPECIFICATION [FDS-3.1.1] PID block TIC_101, Kp=2.4, scan 100ms [FDS-4.2.1] HH_TT_101: 90°C, Priority 1, 0s delay [FDS-6.2.3] WinCC: lockout after 3 failed logins
The design document the FAT is written against. Complete section structure, alarm table format, user role permissions matrix, and how to build in URS traceability from day one.
MAY 2026 · 8 MIN READ
→
📋 Audit Trail
21 CFR Part 11 Audit Trail: The Complete Implementation Checklist
TIMESTAMP USER ID ACTION OLD VAL NEW VAL 09:14:32 eng.smith SP CHANGE 75.0°C 80.0°C 09:22:07 op.jones ALARM ACK UNACK ACK
The 6 required fields per entry, all 9 event types your system must capture, the adversarial SQL tamper test, and a 10-point OQ pre-execution checklist.
MAY 2026 · 8 MIN READ
→
⚖️ 21 CFR Part 11
21 CFR Part 11 Open vs Closed Systems Explained for SCADA Engineers
CLOSED §11.10 OT network, site-controlled Most PLC/SCADA projects OPEN §11.30 Cloud, internet-accessible + Encryption required
One distinction changes your entire compliance obligation. What open and closed actually mean, where remote access and cloud sit, and how to document the classification decision.
MAY 2026 · 7 MIN READ
→
QLean Automation

Everything you've read
is already in the templates.

29 production-ready GAMP 5 documents — IQ, OQ, PQ, FAT, traceability matrix, risk assessment, and more. Built by engineers who've had them reviewed by pharma QA teams.

Get the Full Framework — €249 →
// INSTANT DOWNLOAD · COMPANY-WIDE LICENCE · NO SUBSCRIPTION