Computerised systems used for GMP should be validated to a depth matching their diversity, complexity and criticality, with installation and operational qualification showing hardware and software fit for their tasks (qualified off-the-shelf software needs less testing; a system not validated when installed may be validated retrospectively if records allow). Controls should stop unauthorised access or data changes and prevent data omissions, and each data change should be recorded with the previous entry, who changed it and when. Written procedures should cover operation and maintenance. Critical data entered by hand should get a second check by another operator or by the system. Incidents that could affect quality or the reliability of records or results should be recorded and investigated. Changes should follow a change procedure, be formally authorised, documented and tested, with records showing the system stays validated. Where a breakdown could lose records permanently, a backup system and data protection should be in place; data may also be recorded by a second means.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.