The frequency of performing periodic reviews should be dependent on the Complexity, Criticality, Novelty and Operating History of the computerized system.
Category 4 & 5
For example, an automated control system (Category 4 / 5) the computer system periodic review should be performed more frequently than an off the shelf item.
Once the operating history has been established and the system is stable (minimal incidents and changes) then the frequency can be reduced.
Four Years
The frequency interval is generally not greater than four years.
The frequency of review should be defined with a minimum and maximum time between reviews, for example a scale of one to four years can be set for the review period.
Only new GAMP category 4 and 5 computer systems would have an annual review period.
These review periods can be extended, as discussed above, once the operating history demonstrated that the system operation is stable.
Non Configurable Systems
Non configurable systems can start with a frequency of two years when first installed, and then be adjusted to a maximum of four years once a stable operating history is established.
Note that that the information provided within this section is general guidance on the frequency of periodic reviews.
However, it is the responsibility of the regulated company to set the periodic review schedule and document the rationale and approach within a Standard Operating Procedure (SOP).
Next, let’s cover the difference between periodic reviews and internal audits/gap analysis.