Periodic reviews throughout the operational life confirm that the system is still validated, meets today's regulatory requirements, remains fit for its intended use and meets company policy, and that the operational controls exist and work; a documented risk assessment weighing what is at stake for patients, product quality and the integrity of data, complexity and stability sets the frequency, which is increased after significant incidents and may be decreased for mature stable systems, and is recorded in validation reports, inventories or the configuration management database. Deficiencies are recorded with a prioritized action plan reviewed by the process, data and system owners together with the quality unit, and action execution is monitored. The review may be dedicated or leverage routine reviews such as user access and problem management reviews, uses metrics where possible, is ensured by the process owner and scheduled, performed and documented under quality unit oversight, and is conducted by a multi-disciplinary team; for SaaS the provider demonstrates its own periodic reviews and the company's review confirms that agreements and supplier assessment and monitoring are in place with actions addressed. Preparation covers the period since the last review or the last validation report, samples records selected by experts applying critical thinking with regard to risk, size, novelty, incidents and changes, and collates policies and procedures, risk records, the last review report, the current plan and report, audit observations, life cycle records and traceability, change and configuration records, incident, problem and service records, user access records and reviews, backup records and deviation and CAPA records. The review assesses closure of previous actions, presence of operational procedures, currency of the inventory and configuration management database, change management including the validated state of changes, maintenance of documentation, re-evaluation of risks, appropriate use of change types, trends and authorization, incident trends, user access with role assignments, segregation of duties, administrator and service accounts and training before access, information security controls for data integrity, malware protection and vulnerability monitoring, backup scheduling, failure investigation and testing, archive readability through the retention period, approved and rehearsed continuity and tested disaster recovery plans, support agreements and routine tasks, audit trails remaining enabled for GxP records, and training records; the output is a documented review, prioritized action plans with accountability, a statement on whether the system may stay in use and the timing of the next review.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.