EU Annex 11 Computerized Systems Compliance Checklist

Risk Management and Suppliers

General Annex 11 principles.

• Is risk management applied throughout the system lifecycle proportionate to patient safety, data integrity, and product quality? *
• Is an up-to-date inventory of GMP computerized systems maintained? *
• Are suppliers and service providers assessed, with quality agreements in place where relevant? *

Validation and Data

• Is the system validated with documented requirements traceable throughout the lifecycle? *
• Are data-entry accuracy checks in place for manually entered critical data? *
• Are data protected against damage and checked for accessibility, readability, and integrity through the retention period? *

Security and Audit Trails

• Is physical and logical access restricted to authorized persons with recorded identities? *
• Is an audit trail generated for GMP-relevant changes and deletions, and is it reviewed? *
• Are electronic signatures controlled, permanently linked to records, and clearly attributable? *

Operations and Continuity

• Are periodic reviews performed to confirm systems remain in a validated and compliant state? *
• Are incident and change management procedures applied to computerized systems? *
• Are business continuity arrangements defined to ensure operation during system breakdown? *