The periodic review of every computerised system, gathered and drafted from a year of records — you decide and sign
Each validated system's periodic review gathered from a year of records and drafted with every statement cited, ready in hours.
See one case, screen by screen ↓A validated system’s year is spread over six tools: changes, incidents and problems in IT service management, deviations and CAPAs in the quality system, access certifications in identity governance, backup reports in a mailbox, audit-trail reviews in a register, and last year’s review in the validation archive. The periodic review has to bring all of it together and say whether the system is still in a validated state.
So most of a review is collection, not judgement: exporting change records one by one to see whether each GxP change was verified after implementation, comparing the leaver list with system accounts, checking last year’s actions were closed. Across a programme of 64 systems, reviews slip past their due date — and an action left open from the previous review is easy to miss.
Estimated split of one review’s hours, by hand (about 25 h) and with the agents (8.1 h).
A scheduler opens each review on time; specialist agents gather changes, incidents, deviations, access, backups and audit-trail reviews and draft the review; IT Quality decides the findings and signs.
ChromaVault CDS, the chromatography data system at Plant 3 — Leiden, is high risk and due its yearly review on Oct 15. Here is the review, screen by screen, in the working solution.
Omar opens the review year: 64 GxP systems, 5 reviews due in the next 30 days, 2 overdue, 3 drafts ready for him, and 78 % signed on time over the last 12 months. Every validated system’s next review sits on a calendar by risk tier.
Overnight, 06:00: “Review scheduler marked ChromaVault CDS (Leiden) ready to gather — its last period records were signed Oct 5.”
On Sep 24 the scheduler opened PR-2026-031 — period Oct 1, 2025 to Sep 30, 2026, due Oct 15 — and linked the previous review, PR-2025-027, with its two actions. On Oct 7 it saw the last records of the period signed: the Q3 access review on Oct 3 and the September audit-trail review on Oct 5.
“A year of ChromaVault CDS lives in six places.”
The change and incident reader reads 37 changes, 14 incidents and 2 problems. The quality record reader reads 3 deviations, 2 CAPAs and 2 prior actions. The access and backup checker reads 4 access reviews, 86 accounts, 363 backups and 2 restore tests; the audit-trail review checker reads 12 monthly reviews and finds 1 missed.
“Read-only connections · nothing is changed in the source tools.”
20 criteria checked, 4 findings, 3 observations; 10 sections and 35 citations from 26 records. The year sits on one timeline — changes, incidents, deviations, access reviews, backups and audit-trail reviews — with a red ring on every mark that became a finding.
31 standard, 4 normal and 2 emergency changes. The upgrade to release 2026.1 was validated and verified after go-live; the August emergency patch was verified the next day. The June emergency driver hotfix, CHG0048211, was closed without its post-implementation verification — finding F-1, Medium, proposed to Dr. Maya Chen, due Nov 6.
Omar clicks the citation and the change record opens beside the draft, the passage highlighted: the driver was deployed to all 46 instruments, and the close note says the verification is still to come. The record was read from IT service management on Oct 7 at 06:00 and kept unchanged.
“Post-implementation verification: to be attached.”
The Q2 access review was completed 23 days late and removed two analysts who left on Jun 20; their accounts stayed active for 41 days, with no logins after leaving. The root cause, from DEV-2026-0412: the HR leaver feed is not connected, so removal depends on a manual ticket. Finding F-2 is High — already covered by CAPA-2026-077, due Nov 30, with a check of leavers every two weeks until then.
The shared administrator account cv_admin was last year’s action A-2, still open — so it comes back as finding F-3.
The reviews work: February’s found a sample set reprocessed three times without a reason, and its CAPA was checked effective. August’s was not performed during the plant shutdown and was caught up on Sep 12 with no anomalies. SOP-QC-0311 §6.4 sets a monthly review but has no rule for shutdowns — finding F-4, Low, for Priya Raman.
For each finding Omar picks Not a finding, Accept with rationale or Raise action; he raises all four. The review writer proposes “Validated, with 4 actions” — none of the findings changed a reported result — and keeping the yearly frequency, because the High finding already has a CAPA. Next review due Oct 15, 2027.
The review writer proposes; the IT Quality reviewer and the system owner decide and sign.
Omar signs with his name, password and the meaning “Reviewed — I reviewed the evidence and agree the conclusion”, bound to this version of the record. The review goes to Dr. Maya Chen, the system owner, for her approval, and the four actions are raised in the quality system as CAPA tasks with owner and due date.
The same review, seen by the people who carry it — IT Quality, the system owner, data integrity, the action owner and the head of quality.
A scheduler opens each review on time; specialist agents gather changes, incidents, deviations, access, backups and audit-trail reviews and draft the review; IT Quality decides the findings and signs.
Reads the systems inventory, applies the risk-based frequency, opens each review 21 days before it is due, sets the period and links the previous review.
Pulls changes, incidents and problems for the period from IT service management, and checks each GxP change for impact assessment, approval, testing and verification.
Finds deviations and CAPAs that name the system, checks their timeliness and effectiveness, and carries forward actions from the previous review.
Reads quarterly access certifications and account lists from identity governance, and backup job reports and restore tests.
Checks that every audit-trail review the SOP requires was done, on time, and that what it found was followed up.
Drafts the ten sections in plain language with a citation for every statement, proposes findings with severity, owner and due date, and proposes the conclusion and next review date.
Decides findings and signs. The agents propose; a named person decides.
IT Quality can ask in plain words about a system’s year, a review that may slip, or a record — or tell it to add a check. Every answer cites the record behind it.
What stops ChromaVault from a clean conclusion?
Four findings, none that changed a reported result: an emergency change closed without verification (Medium), leavers active 41 days with the leaver feed not connected (High), a shared admin account still used (Medium), and an SOP with no shutdown rule (Low). The High finding is already covered by CAPA-2026-077, due Nov 30, so the agents recommend validated, with 4 actions, and keeping the yearly review.
Which reviews could go late this month?
Two are already late: QualityHub eQMS waits on two of Henrik Dahl’s decisions, and the Plant historian waits on a backup report from Dana Okafor.
What happened with the ChromaVault restore tests?
363 of 365 daily backups succeeded; the two failures were re-run the same day. The September restore test failed on a faulty tape and passed on retest from the disk copy, checksums matching. That is an observation, not a finding.
Add a check: emergency changes need verification evidence within 5 days
Done. New criterion: emergency changes need verification evidence attached within 5 working days. Run against the open reviews it finds one today — CHG0048211 on ChromaVault CDS, already finding F-1. It is live in Settings as version 5 and recorded in the audit trail.
13 screens from the working solution, on its sample data. Pick one to see it large.
How often each risk tier is reviewed, what every review checks and who signs are settings, each change saved as a new version.
| Setting | Default | Choose from |
|---|---|---|
| High risk — direct impact on product quality, patient safety or release data | Every 12 months | 6 · 12 · 18 · 24 months |
| Medium risk — indirect GxP impact | Every 24 months | 12 · 18 · 24 · 36 months |
| Low risk — standard software, spreadsheets, read-only archives | Every 36 months | 24 · 36 · 48 months |
| Start gathering | 21 days before due | 7 to 42 days, in weeks |
| Shorten the next review by one step | When a High finding has no CAPA behind it | On · Off |
| Approver after the IT Quality reviewer | The system owner | The system owner · Site quality head |
| Re-assessment conclusions also need | Henrik Dahl, head of quality | Henrik Dahl · Omar Haddad |
| What every review checks | 7 criteria | Add one in a sentence |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, including the by-hand hours · Context: EU GMP Annex 11 (draft periodic review section), GAMP 5 operation phase, 21 CFR Part 11. People, companies and products named on this page are fictional — characters and sample data in the working solution.
A scheduled evaluation that confirms a validated GxP system is still in a validated state and fit for its intended use. It looks back over the period at changes, incidents, deviations and CAPAs, access, backup and restore, audit-trail reviews and documents, and ends in a signed conclusion and the next review date.
Specialist agents read the period’s records from your tools, the criteria are checked one by one, and the review writer drafts the ten sections with a citation for every statement. It proposes findings with severity, owner and due date, and proposes one of three conclusions: remains validated, validated with actions, or re-assessment needed.
No. Every connection — IT service management, the quality system, identity governance, backup reports, audit-trail review records and the validation archive — is read-only. Once the review is signed, approved actions are sent to the quality system as CAPA tasks.
By risk tier: in the working solution high-risk systems every 12 months, medium every 24 and low every 36. The scheduler opens each review 21 days before it is due. If a High finding has no CAPA behind it, the next review can be shortened by one step.
Yes. The agents gather and draft; only the IT Quality reviewer decides each finding — not a finding, accept with rationale, or raise action — and chooses the conclusion. The reviewer signs first, then the system owner approves, and re-assessment conclusions also need the head of quality.
Yes. Describe the check in one sentence and it is turned into a criterion for your approval, saved as a new version and run against open reviews. The check that raises open actions from the previous review cannot be turned off.
A signed, locked review in which every statement opens on the record and passage it came from, with both signatures, their meaning and time, and the activity trail of every agent step and human decision.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your systems inventory, review template, SOPs and the tools that hold the evidence — and it goes live once every quality gate has passed. We will walk you through it on a year of one of your own systems first.
Every system's validation pack composed from its requirements and supplier evidence, with testing sized to the risk of each function.
1-min filmAudit Trail ReviewEvery audit-trail row screened on its risk schedule, each finding explained with its log rows cited.
1-min filmAI Use-Case IntakeEvery new AI idea classified against the rules in minutes, each conclusion tied to its clause.
1-min filmWe’ll run the Periodic Review Generator on a year of records from one of your own systems.