A computerized system validation plan is produced for each GxP regulated system, centred on patients, product quality and the integrity of data, summarizing the system and project, identifying measures of success and defining criteria for final acceptance and release; it defines what activities are required, how and by whom they will be performed, the outputs, the acceptance requirements and how the system will be kept compliant throughout its life, at a level of detail reflecting risk, complexity and novelty, with a generic plan permitted for similar systems and no separate plan for simple systems. Responsibility rests with the process owner, approval of the plan comes from the quality unit and the process owner with the meaning of each approval defined, and for cloud services it describes how supplier specification and verification under the supplier QMS are leveraged and what configuration verification and user acceptance the regulated company performs, with regulatory accountability retained. Contents cover introduction and scope, system overview, organizational structure with the project manager, quality unit, process and system owner and subject matter expert roles, the quality risk management approach including the initial assessment and GxP scoping of large systems, the validation strategy with the life cycle model and the approach to specification and verification (Agile included), inputs and outputs, acceptance criteria, traceability, design review and leveraging of the supplier, deliverables including tool records, acceptance criteria including minimum viable product and definition of done for Agile and the reporting approach per release, change control, standard operating procedures, supporting and operational processes, and a glossary. Corporate or site validation policies define roles, expectations, standards, high-level processes including GxP determination and record management, and a validation master plan, where used, summarizes the facilities and systems in scope with their status, change control, planning and scheduling, approved by management with the quality unit approving the validation policies and procedures.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.