# Periodic Review Template

Version 2.0 · Updated 2026-09-21 · Operations

Determine whether current operational evidence continues to support the approved intended use and validated state.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

At the approved review frequency and after significant accumulated change, incident trends, or supplier changes.

## Information needed before starting

- Review period and current approved system baseline
- Change, incident, access and service records
- Backup/recovery evidence and previous review actions

## Field instructions

- **System, scope, and review period:** Identify the system/configuration, included uses and start/end dates of the review. Explain any excluded function or evidence period.
- **Current intended use and configuration:** Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- **Changes and releases:** Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- **Incidents, deviations, and CAPA:** Record the issue, affected functions/records, impact, containment, action owner and resolution or expiry. Link correction and retest evidence; retain unfavorable results.
- **Access and audit-trail review:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Backup, restore, and continuity:** Identify the controlled transition or recovery plan, decision owner and evidence of restoration/retrieval. State how incomplete work is detected and reconciled.
- **Supplier and service performance:** Summarise relevant service metrics, incidents, support, change notices and contract performance during the review period, including trends and actions.
- **Open actions and evidence gaps:** List the unanswered questions or missing evidence, the action owner and due date. Explain what cannot be concluded until they are resolved.
- **Validated-state conclusion:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
- **Next review or event trigger:** Define changes or events that reopen this assessment, the responsible role and the required response or review date.

Confirm the current intended use, owner, version, and configuration.

Review changes, deviations, incidents, access, audit trails, backup/restore, supplier status, and performance.

Identify stale evidence or changed assumptions.

Record actions, residual risk, and the validated-state conclusion.

## Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

| Field | Completed example |
| --- | --- |
| System, scope, and review period | Fictional LIMS interface; October 2025 through September 2026 |
| Current intended use and configuration | Approved-result transfer to ERP; interface version 4.2 |
| Changes and releases | Two mapping additions with approved targeted regression |
| Incidents, deviations, and CAPA | One delayed message; no incorrect material disposition |
| Access and audit-trail review | Service accounts and support roles remain approved |
| Backup, restore, and continuity | Queue recovery and record retrieval tested in May 2026 |
| Supplier and service performance | No material SLA or platform control change |
| Open actions and evidence gaps | Improve aged-message alert ownership |
| Validated-state conclusion | Continued use is supported with the open action tracked |
| Next review or event trigger | September 2027 or earlier schema, mapping, or reconciliation change |

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| System, scope, and review period | ____________________ |
| Current intended use and configuration | ____________________ |
| Changes and releases | ____________________ |
| Incidents, deviations, and CAPA | ____________________ |
| Access and audit-trail review | ____________________ |
| Backup, restore, and continuity | ____________________ |
| Supplier and service performance | ____________________ |
| Open actions and evidence gaps | ____________________ |
| Validated-state conclusion | ____________________ |
| Next review or event trigger | ____________________ |

## Related guidance

- [Perform a periodic review](https://csvtocsa.com/learn/guidance/periodic-review)

- [Review user access](https://csvtocsa.com/learn/guidance/user-access-review)

Canonical page: https://csvtocsa.com/templates/periodic-review