// services
Six areas, one criterion
We stay with IT systems across their whole life: from selection to decommissioning, day-to-day operation included. The criterion never changes — data stays reliable, and decisions stay demonstrable.
01
IT consulting for GMP
This is the entry point. Before touching any system you need to know what is there, how much it matters and where the risk is concentrated.
We work alongside IT management on technology decisions with regulatory impact: which system to adopt, how to integrate it, what to require from a vendor before signing. That is when changing your mind is cheapest.
// deliverables
- Inventory and classification of computerised systems
- Gap analysis against Annex 11 and ALCOA+
- Prioritised roadmap with effort estimates
- Technical and regulatory requirements for tenders
- Supplier assessment of candidate vendors
- Support on architectural decisions
// when it applies
- Before selecting a new system or vendor
- After an inspection finding, to size the real exposure
- When IT has grown without an overall design
- When preparing for a client audit
// references
EU GMP Annex 11 · ALCOA+ · GAMP 5
02
Calibration & instrument qualification
This work is different from the rest, in skill set and in setting: it isn't about the software that manages data, but the physical instrument that generates it — scanning electron microscopes (SEM), particle size analysers, spectrophotometers and other high-tech analytical instruments used in pharmaceutical quality control.
Data cannot be attributable, accurate or original if it comes from an instrument that is unqualified or out of calibration. We cover the instrument's whole life cycle: installation and commissioning, IQ/OQ/PQ qualification, periodic calibration with metrological traceability, and preventive maintenance.
// deliverables
- Installation and commissioning of the instrument
- IQ/OQ/PQ qualification with a risk-based approach
- Periodic calibration and calibration certificate with metrological traceability
- Preventive maintenance plan and due-date calendar
- Management of instrument non-conformities and corrective actions
- For microNIR instruments: verification of chemometric models
// when it's needed
- Commissioning a new instrument (SEM, particle size analyser, spectrophotometer…)
- Calibration plan or periodic qualification due
- After a fault, a technical intervention or a relocation
- Inspection finding on an unqualified instrument
// references
USP <1058> · ISO/IEC 17025 · GAMP 5
For microNIR instruments, also Ph. Eur. 2.2.40 and USP <1119>.
03
Data integrity and ALCOA+
Data must stay attributable, legible, contemporaneous, original and accurate — and stay that way for the whole retention period. It is the first thing an inspector checks, and where most findings accumulate.
How we handle data// deliverables
- Gap assessment against the nine ALCOA+ attributes
- Audit trail review and review of its review process
- Analysis of accounts, roles and segregation of duties
- Assessment of electronic signatures
- Risk-prioritised remediation plan
- Retention and restore procedures
// the nine attributes
Attributable
Complete
Legible
Consistent
Contemporaneous
Enduring
Original
Available
Accurate
// references
ALCOA+ · PIC/S PI 041 · 21 CFR Part 11 · Annex 11
04
Infrastructure and data security
A flawless application on fragile infrastructure still produces fragile data. We design and commission infrastructure together with its qualification package.
Here security and integrity coincide: the access control that protects data is the same one that makes it attributable. Having a backup is not enough — it has to be proven by restoring, with measured and recorded times.
// deliverables
- Infrastructure design specification
- Qualification package (IQ/OQ) for servers and environments
- Backup and disaster recovery plan, with restore testing
- Identity management, roles and segregation of duties
- Network segregation and environment separation
- Documented technical and organisational measures for GDPR
// scope
Virtualisation, storage, network, operating systems, databases, development, test and production environments.
// references
EU GMP Annex 11 · GAMP 5 · GDPR (EU Reg. 2016/679)
05
Application & service management
Ongoing support for systems in production. Compliance is lost gradually, one untracked change at a time: that is exactly what change control is for.
SLAs are agreed and measured, with periodic reporting that says how things actually went, not how they were supposed to go.
// deliverables
- Ongoing support for ERP, LIMS, MES, QMS
- Incident, change and problem management
- Impact assessment of changes on data and validated state
- Periodic system review
- Reporting against agreed SLAs
- Training for key users
// engagement
Retainer contracts with an agreed volume of hours, or on-demand support for specific work.
// references
ITIL 4 · EU GMP Annex 11 · GAMP 5
06
Computer system validation
Demonstrating in a documented way that a system does what it is supposed to do. A necessary step, but one that comes later: if the architecture is wrong, validation certifies a fragile system.
We apply a risk-proportionate approach and, where the context allows, CSA logic: effort concentrated on critical testing, less documentation that adds no control.
// deliverables
- Validation plan and validation summary report
- User requirement specification (URS)
- Functional and design specifications (FS/DS)
- IQ, OQ and PQ protocols and their execution
- Requirements-to-test traceability matrix
- Formal deviation management
// when it applies
- Introducing a new system with GxP impact
- Major upgrade or platform migration
- Inspection finding on validation documentation
- Legacy systems without adequate documentation
// references
GAMP 5 (2nd ed.) · EU GMP Annex 11 · 21 CFR Part 11
Not sure which service you need?
It nearly always starts with an assessment: it captures the current picture and says what to tackle first. Tell us the context and we will tell you what is actually needed.