Software Classification Categories

As I mentioned earlier, the software categories in GAMP 5 have

been revised (1). To appreciate the scope of these changes fully we
need to look at the classification of software from GAMP 4 (2) and
compare this with GAMP 5, as shown in Table I.
In the beginning, or at least in GAMP 4, there were five categories
of software:
Table I: Comparison of software
 Category 1: Operating systems categories in GAMP 4 and
 Category 2: Firmware GAMP 5
 Category 3: Standard software
 Category 4: Configured software
 Category 5: Custom software

The constituents of each category are outlined in Table I; however, there was always a debate about
some commercial software packages — were they category 3 or 4? Many spectroscopists would
argue that an application should be classified as category 3 and not 4, as it should be less work to
validate and evade the real classification. To help resolve this debate, in GAMP 5 the software
categories have been revised and refined — most for the better and one for the worse. This is a
natural evolution of this approach to software classification. So we now have the following four
categories:

 Category 1: Infrastructure Software

 Category 3: Nonconfigured products
 Category 4: Configured products
 Category 5: Custom applications
As discussed in ISPE GAMP 5 the GAMP Categories for hardware and software have been
retained in GAMP 5, all be it in a modified format from GAMP4.

The software categories identified in GAMP 5 do not fit with determining the risk to
product quality, efficacy or data integrity and no longer plays an integral part to
determining that a computer system is fit for purpose.

The complexity and the maturity of the software can be used to support and mitigate
identified risk but should not be used to determine the validation / verification
deliverables.

GAMP Categories
The GAMP categories were originally introduced to provide an initial assessment as to
the validation requirements / deliverables.

In GAMP 4 there were five software categories. These have been revised in GAMP5 to
four categories as detailed below:

Category 1 – Infrastructure software including operating systems, Database Managers,

etc.

Category 3 – Non configurable software including, commercial off the shelf software
(COTS), Laboratory Instruments / Software.

Category 4 – Configured software including, LIMS, SCADA, DCS, CDS, etc.

Category 5 – Bespoke software

Category 2 from GAMP 4 has been removed. This related to firmware. At the time that
GAMP4 was issued firmware was considered to be used for simple instruments. However
as technology has advanced the it has been recognised that complex software can be
embedded (firmware) within systems.

Why Categorise
In GAMP 3 and GAMP 4 the purpose of the GAMP categories had clear purpose,
identifying which validation deliverables were not required. Categories 1-3 were
considered to standard systems and the System Life Cycle Design (SLCD) documentation
were not required, this included
  Supplier Audits
 Functional Specifications
 Source Code Reviews

GAMP 5 still includes these categories however the benefits are not integrated within a
Science and Risk Based Approach to validation and the ASTM approach.

In the ASTM E2500-07 standard that:

Vendor documentation, including test documents may be used as part of the

verification documentation, providing the regulated company has assessed the
vendor

This implies a level of governance to be applied over suppliers independent of the

maturity or complexity of the software.

While GAMP5 provides guidance to the approach based on the categories there are
better rationales that can be put in place rather than the complexity of the software. For
example a Laboratory Instrument (Category 3 – COTS) which is pre-use and post-use
calibrated or runs standards along with the test need less verification than a system
where only the results are relied on. This can be documented within the validation plan
or the risk assessments.