GAMP 5 SUPPLIER ASSESSMENT + OPERATIONAL PHASE + CHANGE CONTROL + PERIODIC REVIEW. SUPPLIER ASSESSMENT: pre-engagement qualification + risk-based depth (lighter for Cat 1/3 + deeper for Cat 4/5); supplier audit (on-site or remote) + supplier capability assessment + documentation review + ongoing performance monitoring; supplier service-level agreements + supplier QMS evidence; multi-supplier supply chain visibility. OPERATIONAL PHASE: post-go-live activities ensuring system remains validated + compliant + fit for purpose; INCIDENT MANAGEMENT (with root-cause analysis + corrective + preventive actions); PROBLEM MANAGEMENT (recurring incident trends); CHANGE MANAGEMENT (controlled changes with risk assessment + impact analysis + regression testing + change-impact-on-validation determination); CONFIGURATION MANAGEMENT (baseline + version control); BACKUP/RESTORE + ARCHIVE; BUSINESS CONTINUITY for GxP systems including disaster recovery. PERIODIC REVIEW: at least annually + after major changes + based on risk; reviews: system status + compliance + validation currency + incidents + changes + supplier performance + data integrity + access controls + audit trails; documented decision: continue + remediate + update validation + decommission. DECOMMISSIONING + RETIREMENT: documented retirement plan + data migration + record retention per regulatory + final disposition.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.