GAMP 5 Second Edition does not overturn the first edition — it corrects how the first edition was applied. Two decades of practice turned a risk-based framework into a documentation template exercise. The second edition pushes back, hard, in favour of critical thinking.
What critical thinking means operationally
It means the validation effort applied to a system is proportional to its risk to patient safety, product quality and data integrity — and that the rationale for that proportion is written down and defensible.
| Traditional practice | Second edition practice |
|---|---|
| Test every requirement identically | Test in proportion to assessed risk |
| Rewrite supplier test evidence | Assess and leverage supplier evidence |
| Waterfall documentation sequence | Iterative delivery with defined controls |
| Manual scripted testing only | Automated testing with qualified tooling |
| Volume of documents as assurance | Quality of reasoning as assurance |
Leveraging supplier evidence
- 1Assess the supplier's development lifecycle and quality system before the project starts.
- 2Obtain and review actual test evidence from a recent release, not a summary letter.
- 3Document which supplier activities you rely on and why that reliance is justified.
- 4Focus your own testing on configuration, integration and your business process.
- 5Refresh the assessment periodically and after significant supplier change.
Agile delivery within a validated framework
Iterative delivery is compatible with validation when the controls are defined up front: a managed backlog with traceability, definition of done that includes quality criteria, controlled environments, and a release gate where quality signs the increment rather than the project.
Validated agile increment
Backlog with traceability
Requirements linked to risk assessment and test coverage.
Sprint delivery
Configuration and automated tests produced together.
Evidence capture
Test results retained automatically as controlled records.
Quality gate
Risk-proportional review and approval of the increment.
Periodic review
Cumulative assessment maintains the validated state.
Automated testing as acceptable evidence
- Qualify the test tooling once, then reuse it across systems and releases.
- Retain results as controlled records with unambiguous pass and fail criteria.
- Use automation for regression breadth; reserve human testing for judgement.
- Document the rationale for what is automated and what deliberately is not.
The goal was never documentation. It was confidence that the system does what it is relied upon to do.
Getting started
Choose one upcoming project. Write the risk rationale before the test plan, agree with quality which supplier evidence will be leveraged, and measure the validation effort against your last comparable project. The comparison usually makes the organisational case on its own.