GAMP Category 4 software represents the most common and arguably most misunderstood category in computerized system validation. The original GAMP 4 paper-based model provided a foundation, but it is insufficient for today’s complex, connected, and frequently updated systems.
A pharmaceutical manufacturer implemented a GAMP Category 4 Manufacturing Execution System to enforce electronic batch record workflows. During validation, they tested all "happy path" configurations.
They revalidated by implementing a risk-based parameter classification (Critical, Major, Minor) and added automated configuration drift detection.
The International Society for Pharmaceutical Engineering (ISPE)’s GAMP (Good Automated Manufacturing Practice) guide provides a risk-based approach to validating computerized systems in the pharmaceutical and biotech industries. Central to this framework is the categorization of software based on its complexity, standardization, and intended use.
| Feature | GAMP Category 4 (Configured) | GAMP Category 5 (Custom/Bespoke) | | :--- | :--- | :--- | | | None (no source code changes) | Yes (new code written) | | Configuration | Parameter setting, tables, workflows | Not applicable or minimal | | Supplier role | Provide standard product + config tools | Provide development services | | Validation risk | Medium (focused on correct config) | High (requires unit/integration testing) | | Reusability of evidence | High (supplier documentation) | Low (project-specific) |
Six months post-deployment, an operator discovered that by changing a single dropdown setting from "Mandatory data entry" to "Optional," they could skip a critical weigh-check step. This parameter was not included in the original OQ because it was considered "non-configurable" by the validation team.
