GxP Assessment Template
Record whether and how a computerized-system use supports a regulated process, required record, calculation, control, or decision.
Resources / Working aids
Find a starting point for assessment, planning, testing, release, operations or retirement.
30 of 30 working aids
Record whether and how a computerized-system use supports a regulated process, required record, calculation, control, or decision.
Define what users rely on the system to do, the data and outputs involved, the operating boundary, and prohibited uses.
Link each important GxP function to a failure scenario, process effect, potential consequence, controls, and required evidence.
Evaluate whether the supplier, service controls, lifecycle practices, and available evidence are suitable for the intended use.
Select a proportionate mix of scripted, unscripted, exploratory, automated, supplier, qualification, and user testing.
Determine whether a supplier release affects approved GxP functions and what evidence or monitoring is required.
Determine whether current operational evidence continues to support the approved intended use and validated state.
Define and evaluate an AI-enabled GxP use, its decision authority, failure scenarios, human review, evidence, monitoring, and revalidation criteria.
Determine affected GxP functions, risk, regression scope, readiness, and release conditions for a software or configuration change.
Document which supplier evidence is accepted, what it supports, its limitations, and the local validation evidence still required.
Define and verify data meaning, mapping, error handling, retry, reconciliation, security, and monitoring across systems.
Plan and verify migration scope, mapping, transformation, reconciliation, exceptions, records, signatures, relationships, access, and retrieval.
Assess the GxP use, formulas, data, protection, independent verification, change control, and periodic review of a spreadsheet.
Separate platform assurance from locally configured GxP rules, workflows, permissions, interfaces, records, and releases.
Determine whether automated testing is suitable, controlled, traceable, and capable of detecting the relevant failure.
Evaluate current user and service-account access against approved GxP roles, responsibilities, least privilege, and segregation of duties.
Preserve required records and meaning, confirm retrieval, remove access and interfaces, terminate supplier services, and approve retirement.
Assess the AI provider, service boundary, data handling, changes, performance information, security, continuity, and responsibilities.
Determine whether an AI model, prompt, source, retrieval, parser, guardrail, workflow, or role change affects approved use or demonstrated performance.
Define the purpose, scope, risks, and evidence to capture during exploratory testing.
Record expected results, AI findings, missed issues, and performance measures for a defined task.
Summarise completed testing, unresolved deviations, residual risks, and the conclusion supporting release.
Define the proposed use precisely enough to select risks, controls and evidence.
Record actual use, influence and the requirements that need a local applicability decision.
Connect a specific failure to its consequences, controls, tests and residual-risk decision.
Decide which supplier evidence supports your use and which responsibilities or gaps remain local.
Record issue-level results and retain a traceable basis for metrics and the decision.
Test whether the complete review workflow delivers the risk reduction being claimed.
Reconcile the evidence, failures and operating restrictions into an assessable release decision.
Connect signals and changes to impact, containment, evidence and continued-use decisions.