GAMP 5 - Good Automated Manufacturing Practice D5: Appendix D5 Testing of Computerized Systems

Testing is non-prescriptive and risk-based, aimed at finding defects, reducing risk, demonstrating requirements are met, evidencing fitness for intended use, supporting acceptance, meeting regulatory expectations and confirming risk controls, under a test strategy whose critical-thinking rationale is documented. Roles are the process owner who approves the strategy and coverage, the system owner for prerequisites, subject matter experts, test manager, test analyst, testers independent of the author, reviewers who did not execute, quality oversight where needed and the supplier, with test case creators being experts in their field; coverage is influenced by process criticality, requirements, the supplier's life cycle and QMS, company policy, risk culture, other controls and automation. Coverage combines supplier testing confirmed at assessment, unscripted testing including exploratory, ad-hoc, day-in-the-life and error guessing, scripted testing for higher-risk controls and user acceptance testing, or in Agile automated test cases plus workflow and intended-use tests, with DevOps output usable directly when in-house developers factor in intended use or the software is entirely standard; a test management process defines prerequisites, the mix of approaches, personnel, evidence expectations, environment identification, monitoring and review. Unscripted testing is recorded with the scope tested, the tester, the date, issues and conclusions, scripted testing with limited or robust step-by-step cases, expected results, independent review and reviewer records; a scripted case carries a unique reference, specification cross-reference, title, objective, steps with expected results, acceptance criteria, pretest steps, data to record including equipment and calibration, and post-test actions. Execution uses skilled, trained testers with identity recorded, no witnessing or step initialing, automated tools assessed before use, calibrated traceable test equipment, good documentation practice, exception reporting of pass with fail described, screenshots only where they add value and tool artifacts as evidence; review confirms function and coverage rather than hunting minor errors, investigates unusual failure patterns and reports through summaries or tool dashboards. Test types include white and black box, normal, negative, repeatability, performance, volume, structural, smoke and regression testing, automation first, and contractual factory and site acceptance tests leveraged without replacing process qualification; environments are functionally equivalent with differences assessed and mitigated and the environment and build recorded per test, and testing from any adequately controlled environment is leveraged rather than repeated. Supplier testing is leveraged after expert review of its extent, coverage and quality, arrangements for access to records including tool-held records, and traceability to company requirements, with new releases requiring the supplier to explain changes and the company to verify continued fitness through configuration and workflow regression. Installation testing verifies components are installed per specifications as a configuration baseline, replaced for cloud-native systems by automated installers with review by exception, and confirms technical information is available; all systems consider power failure, access and security, audit trails, data entry validation, electronic signatures, alarms, critical calculations and transactions, data transfers, interfaces, backup and restore, archival and load; standard products focus on installation and requirements testing with calibration substituting for simple instruments, configured functionality adds configuration and risk-based functional testing, and custom applications add code review, module and integration testing.