Computerized system periodic review, explained.

A periodic review asks whether a validated system is still the system you validated

One system's year, from go-live to the next review's date

1. The system is validatedTests pass, a validation summary is signed and the system goes live with a risk tier that sets how often it will be reviewed.
2. A year of ordinary changePatches, incidents, new users, departures, backups and monthly audit-trail reviews pile up in separate tools.
3. The evidence is gatheredSomeone exports the period's records from each tool and pulls last year's review and its open actions.
4. The year is read against the proceduresEach record is compared with what the procedures expected, gaps are found, findings are written and a conclusion is proposed. This is the step this guide is about.
5. People decide and signA reviewer decides each finding, a system owner or quality head approves, actions go to the quality system and the next date is set.

Step 4 is the subject of this guide. The people, company and figures in the example are fictional.

Green tools, no fixed interval and three more surprises about periodic review

Validated state, access review, audit-trail review, CAPA: the words this work runs on

Fourteen terms are defined in the one-page summary.

One review, three possible conclusions, and five other checks that get confused with it

In shortA computerized system periodic review ends in a decision about one system over one period: the system stays validated, stays validated with actions, or needs re-assessment. It sits in the operating years of a system's life, and it reads the results of smaller routine checks without replacing them.

How a system periodic review differs from revalidation, an annual product review and an audit

You will also see this work called CSV periodic review, periodic review of computerised systems, GxP system periodic review, validated state review or Annex 11 periodic evaluation. They mean the same job.

Annex 11 clause 11, PIC/S, OECD No. 17, ICH E6(R3) and 21 CFR 211.68: who asks for a review, in what words

In shortEU GMP has asked for periodic evaluation since 2011, and that text is still the one in force as of November 3, 2026. PIC/S, OECD and EMA's clinical guideline ask for much the same. ICH, the International Council for Harmonisation, says a review "may be appropriate". FDA's drug rule asks for a written program of checks and for access and backup controls, and leaves the rest to you. GAMP 5 is industry guidance, and many companies build their procedures on it.

Annex 11 revision status: what the 2025 draft would change about periodic reviews

In shortAs of November 3, 2026, the draft has not replaced the 2011 text. If it is adopted as written, a 44-word clause becomes a section of about 300 words with a named scope, a justified frequency and a final review at retirement. A company can add most of what it lists to a review template now.

Treat the draft as a sign of where the rule is heading. Its list can be added to a review template today, because nothing in the 2011 text stops you reading more. Wait for the final text before you rewrite your procedure's mandatory wording, since comments may have changed the draft's words.

Twelve topics across six texts: what a periodic review template should cover

In shortLine the texts up and a common core appears: changes, incidents, deviations and security. Access, audit trails and backup are asked for everywhere, often in a separate clause. Past actions, the combined effect of changes and new regulation are the newer asks, and a template built only on the 2011 clause can miss them.

FDA's standard request in recent warning letters asks a firm with data integrity problems to assess each system's "configurations, administrative rights, password controls, audit trails capabilities and state of implementation", its "qualification/validation status, deviation history, backup capabilities, network requirements, completeness of data records, suitability of current hardware/software for its intended use(s), change management, and management oversight".19 It is the same list a thorough reviewer reads, written after the fact and under pressure. A company can answer those questions in its own time, every year.

The grid is our reading of each published text. A cell marked "Not named" means the text does not name the topic, and a company's own procedure may still rightly cover it.

Six tools, six owners: where the evidence for one system's periodic review sits

In shortOne system's year usually sits in six places, owned by six groups. Each export answers a small question well. The review's real questions need two of them at once, which is why a reviewer who reads tool by tool can pass everything and miss the finding.

Spreadsheets and paper make this harder. A hybrid system prints results that a reviewer has to link back to electronic records by hand, and R.D. McDowall, in a 2011 practitioner article series in the journal Spectroscopy, calls that correlation "the biggest challenge" in a review of a hybrid system.20 Exports also go stale: a reviewer who pulls access data on Monday and writes on Friday should say which day the data was true.

Risk-based periodic review frequency, worked through on a 64-system inventory

In shortRules ask you to justify the interval by risk, and companies turn that into tiers. One consultancy's published advice is annual for high-impact systems and two to three years for lower-risk ones. That is a convention, and no rule sets it. The arithmetic is simple, and it tells you how many reviews you are signing up for.

A consultancy's 2025 article says high-impact systems such as electronic batch records, manufacturing control and LIMS are reviewed "typically annually", and lower-risk systems such as training platforms and document repositories "every two to three years".21 Take the fictional inventory in this guide's example: 64 GxP systems, split into 22 high, 26 medium and 16 low.

What pushes a chromatography data system up a tier and a read-only archive down

The sums behind a finding: days late, days exposed and what 99.5% backup success hides

In shortMost periodic review findings come down to subtraction: a due date from a completion date, a departure from an account removal. Done by hand across six tools it is slow and easy to skip. Here are the ones that matter, worked on the fictional year in this guide's example.

21 CFR 211.68(b) in FDA's data and warning letters: shared logins, administrator rights and missing backups

In shortFDA cited the computer control line of 21 CFR 211.68(b) 87 times in fiscal 2025 on drug Form 483s, the lists of observations given at the close of an inspection. That was the sixth most cited of 316 lines, by our tally. Recent warning letters describe the same small set of failures, and each is something a periodic review should have raised before an investigator did.

Six recent FDA warning letters, and what a periodic review would have read

FDA's own data integrity guidance explains why a shared login matters: "a unique individual cannot be identified through the login", and only shared accounts that are read-only are acceptable for viewing.28 A warning letter tells you what went badly wrong at one firm. It does not tell you how common a problem is, so read these as examples.

FDA's full-text warning letter search, tried on November 3, 2026, found no letter using "access review", and none pairing "periodic review" with "computerized". The 13 letters it returned for "periodic review" alone concern other things, such as ethics board review, suppliers and quality unit oversight. A search index proves little, so treat this as what we found. In these letters FDA writes about the control and leaves the name of the check to you.

Why a periodic review misses the finding: six habits and what UK inspectors have recorded

In shortThe common failure is a review that turns into a form: counts copied from reports, no check against the procedure, last year's actions assumed closed and an owner approving a review of their own year. UK inspection data put computerized systems among the ten most cited GMP deficiency groups in 2016, and Annex 11 ninth of the EU GMP chapters and annexes in 2019, the newest year listed by the UK regulator, the MHRA.

The same MHRA slides give examples a reviewer can use as a checklist. Data was lost from an autoclave control system after a software update because the backup ran only every three months. Users "had more authorisation on the chromatography data system than was permitted according to the SOP". A lock screen used a shared password, and one user could act under another's login.30

MHRA's newest data on its statistics page, last updated October 15, 2020, is a 2019 spreadsheet with no group totals. By our count of it, Annex 11 drew 240 of the 5,292 references cited across 258 inspections: 8 critical, 79 major and 153 other, ninth of the chapters and annexes. Clause 11, periodic evaluation itself, drew 12.31

What a late or thin system review puts at risk: results, batches, inspections and deals

In shortA missed review is a finding in its own right. The larger exposure is what it failed to catch: results nobody can attribute to a person, records that cannot be restored, and an inspection that turns one account into a question about every result. In one court case data integrity problems changed the outcome of a merger.

What each kind of gap can cost when it surfaces in an inspection

We found no public figure for what a single periodic review finding, or a late review, costs. Part C shows how to measure your own version.

Windows 10's end of support, cloud releases and supplier visits: changes your change log may never show

In shortThe system a validated application runs on keeps moving, and some of that movement never reaches your change tickets. Windows 10 reached end of support on October 14, 2025. Any review period that crosses that date should say what happened to the laboratory PCs on it.

Can AI draft a periodic review? What FDA, EMA and draft Annex 22 say as of November 2026

In shortNo regulator has written a rule about AI drafting a system review. FDA has told one firm it must review AI-generated documents. FDA's draft guidance on AI sets aside internal workflows that do not affect quality or study reliability. Draft EU Annex 22 says generative AI should stay out of critical GMP applications, and asks that qualified people answer for outputs elsewhere. So AI can help with reading and drafting if a person decides and signs, and your quality unit should classify the use in writing.

How IT Quality and CSV teams run a periodic review today, from the first export to the owner's signature

In shortAn IT Quality or CSV lead chases exports from several groups, writes the review section by section and takes it to the system owner. One published account puts a review at one to three days. Validation software helps schedule and store reviews, and we found no published evidence of how far it cuts the collecting.

Who touches a system's periodic review, and what each one cares about

McDowall describes the classic form: read the validation plan and summary, hold an opening meeting, combine document review with laboratory observation and interviews, then close with findings classed on a four-point scale and a corrective action plan.20 He puts a review at "between 1–3 days", depending on size.29 That is from 2011, and we found nothing newer that publishes a figure.

In-house templates, outside consultants, lifecycle software and automated drafting: four ways to run the reviews

Validation teams are moving to digital tools. A vendor's 2025 survey of more than 300 professionals reported 58% using a digital validation system, up from 30% the year before.44 Its 2026 edition, with 614 respondents, reported 39% using or evaluating AI for validation.45 Both come from a vendor with an interest in the answer, so read them as direction. We found no public figure for how many reviews run late, or how many GxP systems a typical company holds. Section 18 shows how to count yours.

One chromatography system's periodic review, from opening on September 24 to signature on October 7

In shortOmar Haddad, the IT Quality lead at Cobbleford Pharma, has a high-risk laboratory system due on October 15. One click reads six tools into a year calendar: 31 events placed, 4 gaps and 4 findings. He opens a drafted ten-section review, checks a citation against its record, decides each finding, chooses the conclusion and signs. Dr. Maya Chen, the system owner, approves next.

1

The system's year, before anything is read

ChromaVault CDS at Plant 3 acquires and processes liquid and gas chromatography (HPLC and GC) data for release and stability testing. It is high risk and reviewed every 12 months, and this review's number is PR-2026-031. Its period runs from October 1, 2025 to September 30, 2026.

The screen is a calendar: twelve month columns and seven rows of evidence. Dashed rings already mark what the procedures expect, four quarterly access reviews and two restore tests. On the right are the six sources, each marked read-only.

2

"Load the year" reads six tools, one at a time

Each row fills as its tool is read: 37 changes, 14 incidents and 2 problems, 3 deviations and 2 CAPAs, 4 certifications covering 86 accounts, 363 of 365 backups and 2 restore tests, 11 of 12 monthly audit-trail reviews, and the last review's 2 actions.

Then the year is checked against the procedures. Hatched bands draw over the gaps, and a finding drafts beside each one. Green marks are as expected, amber an observation and red a finding. Clicking any mark opens its record.

3

The worst gap: 16 weeks without an access review

After the certification on April 9, the next was due July 8 and done July 31, 23 days late. Inside that gap, two analysts who left on June 20 kept active accounts for 41 days, with no logins after they left. Removal depends on a manual ticket because the HR departures feed is not connected.

Clicking the band highlights its finding. It already names the fix: CAPA-2026-077, due November 30, with an interim check of departures against accounts every two weeks until it closes.

4

Three more gaps, each with its finding

Emergency change CHG0048211, a driver hotfix on all 46 instruments, was closed June 19 with "post-implementation verification: to be attached", and nothing was attached. The August emergency patch, verified the next day, shows how it should look.

Last year's action A-2, to retire the shared administrator account cv_admin, was due March 31 and is still open. Three people used it this year, last on September 29. And August's audit-trail review was missed in a plant shutdown, caught up September 12, and the procedure has no rule for shutdowns.

5

The drafted review opens on the year and section 1

The review has ten sections: system and intended use, previous review actions, changes, incidents and problems, deviations and CAPAs, access, backup and restore, audit-trail review, documents, training and supplier, and the conclusion.

Each section carries its numbers, a cited draft and its criteria results. Across the review that is 35 citations to 26 records. The right side lists every source, grouped by where it was read from.

6

A citation opens the record it came from

Omar clicks the citation behind "23 days late". The Q2 access certification opens beside the draft with the passage marked: due July 8, completed July 31, 86 accounts certified, 2 revoked as departed users, 9 privileged accounts reviewed and kept, and cv_admin kept as "pending retirement".

A note under the record gives the read date and says the original is unchanged. Nothing is written back to the source tools.

7

Omar decides every finding

Each finding offers three choices: raise an action, accept with a rationale that goes into the review and the audit trail, or mark it as not a finding. Omar raises the access finding, F-2, to Sam Patel with the interim check. He then raises the emergency change finding, F-1, to Dr. Chen by November 6. The shared account finding, F-3, goes to Sam Patel by October 31 with escalation to the site quality head. The audit-trail procedure finding, F-4, a revision of SOP-QC-0311 section 6.4, goes to Priya Ranvelle by December 15.

8

The conclusion is proposed, and Omar chooses it

The proposal reads: the system remains in a validated state and fit for its intended use, with four actions. None changed a reported result, since no data was lost in the disconnects, the reprocessing deviation's CAPA was checked effective and release 2026.1 was validated. Keep the yearly frequency, because the high finding already has a CAPA and an interim check.

The screen offers three options and marks one as recommended. Omar chooses. The next review date, October 15, 2027, follows from the frequency.

9

Two signatures, each with its meaning

Omar signs as IT Quality reviewer with the meaning "Reviewed: I reviewed the evidence and agree the conclusion". 21 CFR 11.50 asks a signed electronic record to show the signer's name, the date and time, and the meaning, and 11.70 asks that the signature be linked to its record.43 The review then goes to Dr. Chen to sign "Approved", and the four actions go to the quality system as CAPA tasks.

The change, audit-trail and backup sections, the report, and the schedule across 64 systems

In shortBehind the case sit the other sections of the review with their own records, the report and action list, and the screens a program lead uses: the cycle's reviews, the schedule by risk tier, the system inventory, the dashboard and the rules.

How the review reads an emergency change and an audit-trail register

The report, the action list and the activity record from ChromaVault's review

Reviews, schedule and inventory across Cobbleford Pharma's 64 GxP systems

The dashboard and rules a head of quality approves

Six agents read and draft; an IT Quality reviewer and the system owner decide and sign

In shortA scheduler opens each review on time. Four read-only readers check one kind of evidence each. A writer drafts with a citation for every statement. The agents propose and people decide: a reviewer rules on each finding and signs, the system owner approves, and a re-assessment also needs the head of quality.

The sign-offs on a periodic review, and the rules that cannot be turned off

Four-eyes applies throughout: the reviewer and the approver are two different people. A signed review is locked, and a correction makes a new version. Roles, an audit trail on every step, and export of the signed record support an inspection. These are controls that support your compliance. Your validation for your intended use is still yours to perform, and the tool goes on your inventory.

From six read-only sources to a signed, cited review and its actions

The design targets for a review program, and what they rest on

These are the solution's design targets, to be measured in the live solution on your own systems. None is a result from a customer. Section 22 shows how to test them.

What collecting a system's year by hand costs your IT Quality team

In shortTwo costs sit apart. Senior hours spent collecting are certain, and you can time them this week. A finding that a review should have caught is rare and heavy, and you cannot predict it. We found no published cost for a periodic review, so the numbers that matter are the ones you measure.

Timing one review and counting your inventory: your own baseline in a week

The rushed review, the expert's hour and other periodic review costs a calculator misses

What automating the gathering returns on your yearly review count

In shortMost of the return is senior hours moved from collecting to judging. A smaller part comes from reviews signed on time. Findings caught earlier are worth more, and you should not count them until you have measured them. Every default below is an assumption for you to replace.

Five places a review program gets time or risk back, each with its formula

Your hours back across a year of system reviews

Is your periodic review program ready to automate? Eight questions on inventory, SOPs and signatures

In shortSoftware can only check what your procedures make checkable. Score each question from 0 to 2. Nothing you choose leaves this page.

What to ask any periodic review software vendor, on access, citations, signatures and AI (ask us too)

In shortAsk to see it on one of your own systems' years. A vendor who shows a template and a calendar is selling scheduling. A strong one finds a gap in your records and opens the record behind it.

A 12-week parallel test on three validated systems, one already reviewed by hand

In shortTake three systems, one per risk tier. Include a system whose signed review you already have, so you can compare what each method found. Measure hours, gaps and citation accuracy, and decide against numbers you set beforehand.

The six measures that decide a periodic review pilot

Computerized system periodic review: the questions people search for

In shortEach answer stands alone. Status statements are as of November 3, 2026.