GAMP 5 - Good Automated Manufacturing Practice M12: Appendix M12 Critical Thinking

Critical thinking optimizes quality and compliance of computerized systems within the business processes they support, and it has to be allowed by the QMS and the validation policy, with templates used as prompts and essential elements defined rather than fixed forms. It is applied to planning through maps of the business process and diagrams of data flow that identify the primary record, consistent nomenclature, solutions that minimize customization, interface choices and behavior on failure; to quality risk management with severity linked to the patient, a hierarchy of major and subsidiary functions where a subsidiary cannot exceed its parent's risk, and control rigor such as timeouts and password complexity scaled by risk; to requirements so that regulatory requirements are tailored to intended use, audit trails are required where GxP records are created, modified or deleted and made contextual, searchable, filterable and reportable, and requirements tool artifacts count as documentation; to supplier assessment and selection including software bills of materials, the stability of as-a-service offerings, adjusting supplier risk assessments to the company's use, performance measures, non-optional SaaS changes, keeping supplier records in the supplier QMS, accepting supplier deliverables in their own format, treating tool artifacts as formal records, jointly agreeing rigor with integrators and maintaining ongoing supplier assessment; to testing through risk priorities and confidence in prior testing, combining tests, avoiding repetition, proving versus non-proving steps, skilled testers, proportionate review, automated tools, regression after incidents, no excessive evidence, investigation of unusual failure patterns and a documented rationale; to build and configuration through continuous verification with review by exception replacing static installation snapshots; to operation by embracing change, applying security patches promptly, not running obsolete platforms, using escape-rate metrics rather than test-all responses to defects, intuitive working practices, proportionate supervisory checks, hybrid record controls, codes of conduct and confidential reporting lines, and targeted training; to periodic review frequency adjusted by outcomes and metrics and checking for drift beyond intended use; to retirement decisions on what data to retain, migrate or hold in static form and how migration tools are assured; to inspection readiness with rationales for high-risk decisions, supplier assessment evidence available without duplicating supplier records, and contractual access arrangements tested; and to organizational capability, measured on five maturity levels from no critical thinking to a respected core competency.