GAMP 5 - Good Automated Manufacturing Practice O6: Appendix O6 Operational Change and Configuration Management

What does O6 require?

Operational change management runs from handover to retirement and continues for GxP records still within their retention period after retirement; changes to configuration items such as business processes, software, configuration, data, infrastructure and services are defined, authorized, assessed for impact and risk, carried out, tested and approved ahead of release, with impacted documentation and records updated to maintain the configuration baseline, configuration records maintained to allow restoration after a disaster, risk assessments kept in line with changes, testing relative to risk demonstrating the change works and does not introduce regressions, and training and procedure needs assessed. The process owner ensures the process exists, the system owner coordinates changes and assesses technical impact, the quality unit ensures the process is followed, and task owners deliver to timelines; the transfer point from project change management is documented in the validation report, release or handover records. The process runs from change request and evaluation on business value with communicated decisions, through change specification of the impacted items, impact and risk assessment covering regression, data, processes and procedures, life cycle records, training and service agreements, a change plan with responsibilities including external providers, a back-out plan for complex or high-risk changes, authorization confirming the adequacy of the specification, assessments and plans, execution updating records, procedures and agreements, implementing in a test environment where possible, testing and training, and release to operations after review of completion, approval of the transition, documented installation and knowledge transfer. Change types are standard or routine low-risk changes defined in work instructions or service requests with records kept and internal audit checking for misuse, like-for-like and pre-approved like-for-kind replacements and repairs with data and configuration restoration verified, system administration changes under administration procedures, emergency changes with defined criteria and retrospective documentation, temporary changes with reversal monitored and formal review before becoming permanent, and global changes with additional governance. Business, IT, engineering and service provider processes interlock with responsibilities defined in quality or service agreements, cloud services are covered by supplier assessment and monitoring of provider change and release management, the company knows the provider's release schedule, evaluates impact, updates procedures, trains users and tests where appropriate leveraging supplier testing, infrastructure changes use templates and infrastructure as code with automated monitoring and reversion, and supplier software changes follow the supplier's development processes. Configuration management starts from the handover baseline and comprises identification of configuration items including those with GxP impact forming the baseline for the validated state, control by authorized personnel with version control, secure records and release management, status accounting traceable to item, version and system release, and evaluation keeping records as built under records management and retention with periodic review confirming configuration status.