GAMP 5 - Good Automated Manufacturing Practice O2: Appendix O2 Establishing and Managing Support Services

Use of an external service provider rests on a formal agreement clearly stating the services and the responsibilities of the provider and the regulated company, and the same applies to internal support functions. Service level agreements describe the services, service level targets and responsibilities, may cover individual systems or groups, are usually created by the provider possibly as standard or tiered offerings, are checked by process and system owners against business needs, are agreed, understood and approved by both parties, and are backed by assessment and monitoring of provider capability; operating level agreements between parts of the same organization, underpinning contracts with third parties and quality agreements defining quality expectations may also apply. The system owner establishes the agreement and ensures risk-based assessment and monitoring, the provider follows and reports against it, periodic meetings review performance against criteria, and provider processes deliver the service under its own quality system. Agreements address the scope of systems and services, service descriptions including releases and patches, platform and infrastructure services, IT security, backup and restore, continuity and disaster recovery, controls for information security and privacy, archiving and retention, disposal, maintenance and administration, environments and routine testing and calibration, support tools, roles, reporting, prioritization and processing times, contacts and escalation; measurement defines key metrics such as availability, downtime, outages, response times and incidents, reporting frequency and review meetings; and contract exit is set in advance covering knowledge, documentation and record, software code and data transfer.