GAMP 5 - Good Automated Manufacturing Practice S6: Appendix S6 Organizational Change

Organizational change from internal reorganization, acquisition, divestment including offshoring and outsourcing, or the collapse of a supplier or service provider can affect any part of the system supply chain at any life cycle stage, and its impact on GxP regulated computerized systems is assessed to ensure continued compliance and availability. Aspects considered include changes to the supported business processes and to how systems are used, relocation of systems, new regulatory requirements, effects on regulated records and signatures, changes in physical and logical security, clarification of where primary data resides and which people own the process and the system, the timing of audits of a reorganized supplier, supplier relationships, service level agreements, preferred solution strategies, interim measures, retention of expertise, validity of support contracts, postponement or acceleration of projects and changes in personnel and responsibilities; organizational factors include running parallel systems and interfaces, migrating data, maintaining data sets for third parties and whether formats change or records move to paper, retirements, where life cycle records are kept and continuing inspection support, parallel compliance practices and their harmonization with documented rationale and training, changed regulatory expectations, change and configuration management across the organizations, transition of operation and maintenance activities and heightened incident monitoring during transition. Outsourcing raises equipment ownership, whose QMS applies and initial and periodic compliance and financial audits; loss of a supplier calls for accurate continuity plans, invoking escrow for source code, migration options and retrieval of owned hardware, software, records and documentation. A risk assessment ranks risks and develops a plan covering projects and operational systems, with projects held, continued or cancelled according to scenario, all affected stakeholders including process owners, compliance, quality and regulatory, legal, IT and engineering, purchasing and finance agree and approve the decisions, affected documentation such as process documents, procedures, training materials, manuals, batch records, archived records, contracts, interfaces, validation and retention schedules is reviewed and updated, and training requirements are evaluated at organizational and system level.