Version 2.0 · Updated 2026-09-21 · Operations
Determine affected GxP functions, risk, regression scope, readiness, and release conditions for a software or configuration change.
Adapt this template to your intended use, applicable requirements, and approved procedures.
When to use it
For planned, supplier-managed, major, minor, and emergency software changes.
- Authoritative change request
- Approved use, configuration and dependency inventory
- Risk/evidence baseline and proposed release plan
Field instructions
- Change and reason: Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- Approved intended use: Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- Affected GxP functions: Identify the function or requirement and its controlled reference. Explain the regulated process or record that depends on it.
- Configuration impact: Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- Interface and data impact: Identify authoritative sources, receiving systems and record identifiers. Describe supported formats, units, timing, transformations and error handling.
- Electronic record and signature impact: Identify the required record context, history, identity and relationships. Explain how integrity, attribution and retrieval will be preserved and checked.
- Security and access impact: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- Failure scenarios and controls: Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
- Existing evidence: Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- Testing and regression scope: Identify the assessed configuration, representative data, selected activities and expected results. Include abnormal and recovery paths and explain remaining coverage gaps.
- Documentation and training: List the controlled procedures, instructions and role-based training affected, with owner and completion evidence.
- Release, monitoring, and approval: Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
Define the specific system, service, change, population, and intended use.
Complete each field from available records and accountable interviews; record unknowns rather than guessing.
Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.
Adapt the structure to the organization’s approved procedures and document-control process.
Completed fictional example
Fictional teaching example; this is not an executed or approved validation record.
Blank template
System / record ID: ____________________
Prepared by / date: ____________________
Required review / approval under local procedure: ____________________
Relevant regulations and guidance
These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.
Regulatory guidance / GMP guideline · United States · February 2026
Scope: Medical-device manufacturers assuring software used in production or their quality management system.
Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →Regulatory guidance / GMP guideline · European Union · January 2011 revision
Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.
Status: Final / published · Checked 2026-09-21
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Read source details and applicability →