Periodic Review: How to Prove a Computerised System Is Still Fit for Use

Go-live is a milestone, not a permanent verdict

EU GMP Annex 11 includes periodic evaluation of computerised systems. The reason is practical: the process, configuration, interfaces, users, supplier, infrastructure, and risks change over time. A periodic review should test whether the system remains fit for its intended use and whether the evidence and controls still match the current reality.

Build the review from current evidence

• Approved changes and their impact assessments since the last review.
• Incidents, deviations, problems, corrective actions, and recurring failure patterns.
• Access provisioning, role changes, privileged activity, and periodic access review.
• Audit-trail review results and data-integrity exceptions.
• Backup, restoration, continuity, and recovery evidence for critical records.
• Supplier performance, service changes, audit reports, subcontractors, and contract status.
• Open risks, overdue actions, training, procedures, and system inventory details.
• Current requirements, configuration, interfaces, reports, and actual use compared with intended use.

Ask whether the system is still the same system

A periodic review should compare the approved baseline with what people actually use. New reports, workarounds, integrations, roles, spreadsheets, and manual reconciliations may have become part of the process without entering the validation record. These are not automatically defects, but they are signals that the scope and risk assessment may need updating.

Set a decision, not just a date

The review should conclude with a documented decision: continue as is, continue with actions, perform targeted revalidation, restrict use, replace, or retire. Record the evidence, owner, due dates, and acceptance of residual risk. A calendar reminder without a decision record is not a periodic review.

The VLMS readiness framework can help organise the agenda. Tailor frequency and depth to the system’s risk, criticality, change history, and operating context. Review is how validation stays alive.