A computerized system periodic review drafted from the system's own year, with the gaps already found
A year of system records gathered and the review drafted in hours
See one case, screen by screen ↓A scheduled evaluation that confirms a validated GxP system is still in a validated state, as EU GMP Annex 11 §11 asks, at a frequency set by its risk as GAMP 5 describes. It looks at the period's changes, incidents, deviations and CAPAs, access, backup and restore, audit-trail reviews and last review's actions. Computerized System Periodic Review gathers all of these, finds the gaps and drafts the review for IT Quality to decide and sign.
How to choose AI solutions for life sciences →
Updated
Annex 11 and GAMP 5 expect every validated system to be reviewed periodically, at a frequency set by its risk. The evidence for one review sits in six places: changes, incidents and problems in IT service management, deviations and CAPAs in the quality system, access certifications in identity governance, backup job reports and restore tests, the audit-trail review register, and last year's review with its actions in the validation archive. The IT Quality lead pulls a year out of each, one export at a time, then writes the review section by section.
Each tool looks fine on its own. The risk sits between them: a quarterly access review that came 23 days late while two leavers kept active accounts, an emergency change closed with “verification: to be attached”, last year's action to retire a shared administrator account still open, a monthly audit-trail review missed during a plant shutdown. They only show when the system's year is laid out in one place against what the SOPs expect — which is how an inspector will read it.
Estimated split for one system's periodic review, by hand and with the solution. The by-hand total (about 25 hours) is an estimate; the 8.1-hour total is the solution's target median.
A scheduler opens each review on time; specialist agents lay the system's year out against the SOPs and draft the review from it; IT Quality decides the findings and signs.
ChromaVault CDS at Plant 3 — Leiden acquires and processes HPLC and GC data for release and stability testing. It is high risk, reviewed every 12 months, and its periodic review PR-2026-031 covers Oct 1, 2025 – Sep 30, 2026, due Oct 15, 2026. Here is what happens, screen by screen, in the working solution.
The scheduler reads the GxP inventory — 64 systems, 40 reviews in the next 12 months — and applies the risk-based frequency: High every 12 months, Medium every 24, Low every 36. It opens PR-2026-031 for ChromaVault CDS, sets the period and links last year's review, PR-2025-027, with its two actions.
Activity: “Review scheduler opened PR-2026-031 — due Oct 15, period Oct 1, 2025 – Sep 30, 2026.”
Omar opens ChromaVault · Leiden from the next reviews due. The calendar has twelve month columns and seven rows: changes, incidents and problems, deviations and CAPAs, access reviews, backup and restore, audit-trail reviews and last review's actions. Dashed rings already mark what the SOPs expect — four quarterly access reviews and two restore tests.
“Read-only connections · nothing changes in the source tools”
Each row fills as its tool is read: 37 changes, 14 incidents and 2 problems; 3 deviations and 2 CAPAs; 4 certifications covering 86 accounts; 363 of 365 backups and 2 restore tests; 11 of 12 monthly audit-trail reviews; last review's 2 actions. Then the year is checked against the SOPs: 31 events placed, 4 gaps, 4 findings drafted and 10 sections ready for review.
Green as expected, amber an observation, red a finding; hatched bands are the gaps.
After the Q1 certification on Apr 9, the next one was due Jul 8 and done Jul 31 — 23 days late. Inside that gap, two analysts who left on Jun 20 kept active accounts for 41 days, with no logins after leaving. Removal depends on a manual ticket because the HR leaver feed is not connected; CAPA-2026-077 to connect it is due Nov 30, owned by Sam Patel.
High: “Leavers stay active until a manual access review”
Emergency change CHG0048211, a driver hotfix on all 46 instruments, was closed on Jun 19 with “post-implementation verification: to be attached” — nothing was attached, while the August emergency patch was verified the next day. Last year's action A-2, to retire the shared administrator account cv_admin, was due Mar 31 and is still open; three people used it this year, last on Sep 29. The August audit-trail review was missed during the shutdown and caught up on Sep 12, and SOP-QC-0311 has no rule for shutdowns.
An open action from the previous review is always raised as a finding.
The review opens on the year in one view and section 1, System and intended use: intended use unchanged, release 2026.1 since Apr 12, 86 users, 46 instruments against 40 at the last review. Sections 2 to 9 — previous review actions, changes, incidents, deviations, access, backup and restore, audit-trail review, and documents, training and supplier — each carry their criteria results; section 10 holds the conclusion. 26 records cited, 35 citations.
“Drafted by the Review writer · every statement cited”
Omar clicks the citation behind “23 days late”. The Q2 2026 access certification opens beside the draft with the passage highlighted: due Jul 8, completed Jul 31, 86 accounts certified, 2 revoked as leavers, 9 privileged accounts reviewed and kept, and cv_admin kept as “pending retirement”.
“Read from identity governance on Oct 7 at 06:00 · original kept unchanged”
Each finding comes with a proposed action, owner and due date; Omar decides every one. He raises F-2 to Sam Patel with an interim check of leavers against CDS accounts every two weeks until the CAPA closes, then F-1 to Dr. Maya Chen by Nov 6, F-3 to Sam Patel by Oct 31 with escalation to the site quality head, and F-4 — a revision of SOP-QC-0311 §6.4 — to Priya Raman by Dec 15.
“Action raised by Omar Haddad”
The writer proposes the conclusion and Omar chooses it: ChromaVault CDS remains in a validated state and fit for its intended use, with four actions. None changed a reported result — no injection was lost in the disconnects, the reprocessing deviation's CAPA was checked effective, and release 2026.1 was validated. Keep the yearly frequency: the High finding already has a CAPA and an interim check.
The agents propose; only people decide findings and sign.
Omar signs as IT Quality reviewer with the meaning “Reviewed — I reviewed the evidence and agree the conclusion”. His name, the meaning and the time are bound to this version of the record, and the review goes to Dr. Maya Chen, the system owner, to sign “Approved”. The four actions go to the quality system as CAPA tasks with owner and due date.
“Signed · sent to Dr. Maya Chen for approval · 4 actions raised”
The same review, seen by the five people who carry it — what their review cycle looked like, and what it looks like now.
A scheduler opens each review on time; specialist agents lay the system's year out against the SOPs and draft the review from it; IT Quality decides the findings and signs.
Reads the systems inventory, applies the risk-based frequency, opens each review 21 days before it is due, sets the period and links the previous review with its open actions. Escalates an overdue review to the system owner and the IT Quality lead.
Pulls changes, incidents and problems for the period from IT service management, and checks each GxP change for impact assessment, approval, testing and post-implementation verification — emergency changes within 5 days. Links incidents to problems and problems to the change that fixed them.
Finds deviations and CAPAs that name the system, checks their timeliness and effectiveness, and reports each action from the previous review as closed on time, closed late or open.
Reads quarterly access certifications and account lists from identity governance and compares the HR leaver list with system accounts; reads daily backup job reports and restore tests.
Checks from the review register and signed review forms that every audit-trail review the SOP requires was done, on time, and that what it found was followed up. A missing or late review is a finding.
Drafts the ten sections in plain language with a citation for every statement, proposes findings with severity, owner and due date, and proposes the conclusion and the next review date from the risk tier.
Decides findings and signs. The agents propose; a named person decides.
Ask in plain words about a system's year, a finding or the programme — or describe a new check. Every answer cites the record behind it.
What stops ChromaVault from a clean conclusion?
Four findings, none that changed a reported result: F-1, an emergency change closed without verification (Medium); F-2, leavers active 41 days with the leaver feed not connected (High); F-3, the shared admin account still used (Medium); F-4, the SOP has no shutdown rule (Low). F-2 is already covered by CAPA-2026-077, due Nov 30, so the agents recommend validated, with 4 actions, and keeping the yearly review.
Why is the access review late?
The Q2 access review for ChromaVault was due Jul 8 and completed Jul 31 — 23 days late. It removed two analysts who left on Jun 20; their accounts were active for 41 days, with no logins after leaving. Root cause: the HR leaver feed is not connected. CAPA-2026-077 (Sam Patel) is 60% done.
Which reviews could go late this month?
Two are already late: QualityHub eQMS waits on two of Henrik Dahl's decisions, and the Plant historian waits on a backup report from Dana Okafor.
Add a check: emergency changes need verification evidence within 5 days
New criterion: emergency changes need verification evidence attached within 5 working days. Run against the open reviews it finds one case today — CHG0048211 on ChromaVault CDS, closed with “verification: to be attached” — already finding F-1. It is in Settings as version 5 and recorded in the audit trail.
13 screens from the working solution, on its sample data. Pick one to see it large.
How often each risk tier is reviewed, when gathering starts, what every review checks and who signs are settings — versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| High risk — direct impact on product quality, patient safety or release data | Every 12 months | 6 · 12 · 18 · 24 months |
| Medium risk — indirect GxP impact | Every 24 months | 12 · 18 · 24 · 36 months |
| Low risk — standard software, spreadsheets and read-only archives | Every 36 months | 24 · 36 · 48 months |
| Shorten the next review by one step | On — when a High finding has no CAPA behind it | On · Off |
| Start gathering | 21 days before the due date | 7 to 42 days, in steps of 7 |
| What every review checks | GxP changes verified · access reviews within 14 days of due · leavers removed within 5 working days · no shared privileged accounts · restore tested twice a year · audit trail reviewed as the SOP requires | Each criterion on or off · add a criterion in one sentence, for approval |
| Open actions from the previous review raised as findings | Always on | Cannot be turned off |
| Approver after the IT Quality reviewer | The system owner | The system owner · Site quality head |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate (about 25 hours to gather and write one review by hand). Context: EU GMP Annex 11 §11 periodic evaluation (and its 2025 draft revision) · GAMP 5 (2nd ed.) operation phase · 21 CFR Part 11 §11.50, §11.70 on signature meaning and linking. People, companies and systems named on this page are fictional — characters and sample data in the working solution.
A scheduled evaluation that confirms a validated GxP system is still in a validated state, as EU GMP Annex 11 §11 asks, at a frequency set by its risk as GAMP 5 describes. It looks at the period's changes, incidents, deviations and CAPAs, access, backup and restore, audit-trail reviews and last review's actions. Computerized System Periodic Review gathers all of these, finds the gaps and drafts the review for IT Quality to decide and sign.
It places every record of the period on one calendar for the system, next to what the SOPs expect — quarterly access reviews, restore tests twice a year, monthly audit-trail reviews. A late, missing or unverified event shows as a gap band, and its finding is drafted beside it with citations. On the sample system that is how a 23-day-late access review and two leavers active for 41 days surface together.
Yes. The Review writer writes no statement without a citation to the record and passage. On the sample review that is 35 citations to 26 records, and each one opens the original record beside the draft with the passage highlighted.
No. Every connection is read-only — IT service management, the quality system, identity governance, backup reports, the audit-trail review register and the validation archive. The access checker never sees passwords or personal data beyond name and role, and the audit-trail checker checks that reviews were done; it does not perform them.
Yes. The agents gather and propose. The IT Quality reviewer decides every finding — raise action, accept with rationale, or not a finding — chooses the conclusion and the frequency, and signs “Reviewed”; the system owner then signs “Approved”. Re-assessment conclusions also need the head of quality, and a signed review is locked.
Yes. Frequency for High, Medium and Low risk, the days before the due date when gathering starts, shortening after an uncovered High finding, each review criterion and the approvers are settings, saved as new versions and on the audit trail. A new criterion can be described in one sentence and is added once approved.
Approved actions go to the quality system as CAPA tasks with owner and due date. At the next review, the Quality record reader reports each one as closed on time, closed late or open — and an open action is always raised as a finding.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your periodic review SOP and template, your system inventory and a past review — and it goes live once every quality gate has passed. We will walk you through it on one of your own systems first.
Testing sized to each function's risk, every line linked to its source.
1-min demoAudit Trail ReviewEvery audit-trail period reviewed on schedule and signed, rows cited
1-min demoAI Use Case Risk ClassificationEvery new AI idea classified in minutes, each conclusion tied to its clause.
1-min demoWe'll run Computerized System Periodic Review on one of your own validated systems and a year of its records.