System Validation — §11.10(a)

System Validation Requirements. All computerized systems that create, modify, maintain, archive, retrieve, or transmit electronic records subject to 21 CFR Part 11 shall be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records, in accordance with §11.10(a). The validation program shall follow a risk-based lifecycle approach and shall include: (a) a Validation Master Plan (VMP) that defines the scope, strategy, responsibilities, and schedule for all system validation activities; (b) a User Requirements Specification (URS) documenting the intended use, functional requirements, and regulatory requirements of the system; (c) a Functional Specification (FS) and Design Specification (DS) documenting how the system will meet the requirements; (d) Installation Qualification (IQ) verifying that the system hardware, software, and infrastructure are installed correctly and in accordance with specifications; (e) Operational Qualification (OQ) verifying that the system operates correctly throughout all anticipated operating ranges; (f) Performance Qualification (PQ) verifying that the system consistently performs as intended under actual or simulated conditions of use; (g) traceability matrices linking each requirement to its corresponding test case and test result; and (h) a Validation Summary Report documenting all testing results, deviations, and the overall validation conclusion. Validation shall be maintained throughout the system lifecycle, and the impact of any system changes on the validated state shall be assessed through the change control process. Periodic reviews shall be conducted to confirm the system remains in a validated state.