IQ/OQ/PQ Protocol Template — Thẩm Định Hệ Thống Máy Tính GMP - Phạm Đức Phương Nam

📋 Template này: Protocol framework cho IQ/OQ/PQ theo risk-based approach — adapt cho từng hệ thống cụ thể (SCADA, MES, LIMS, ERP). Copy section cần thiết vào document của anh/chị.

Mục lục

IQ/OQ/PQ Protocol Template — GMP Computerized Systems

Version: 1.0 | Updated: 2026-11-10 | Reference: GAMP 5 Ed.2, EU GMP Annex 11, FDA 21 CFR Part 11

SECTION 1: PROTOCOL HEADER

System Name
System Description
GAMP Category	□ Cat 1 □ Cat 3 □ Cat 4 □ Cat 5
GxP Impact	□ Direct GxP □ Indirect GxP □ Non-GxP
Protocol Number	VAL-[SYSTEM]-[IQ/OQ/PQ]-[001]
Version
Author
QA Reviewer
Approval Date

SECTION 2: SCOPE & OBJECTIVES

2.1 Scope

[Describe system boundaries — what is included and explicitly excluded from this qualification]

2.2 Objectives

IQ: Verify [system name] is installed correctly per design specifications
OQ: Verify [system name] operates correctly under expected operating conditions
PQ: Demonstrate [system name] performs consistently under actual production conditions

2.3 Risk Classification

Risk Level	Impact on Patient	Test Coverage Required
HIGH	Direct impact on product quality/safety	Highest assurance for GxP-critical functions — extent and depth defined and justified in a documented risk assessment
MEDIUM	Indirect impact	Reduced or sampled testing where justified by risk, complexity and supplier assessment
LOW	No GxP impact	Outside GxP validation scope — document the exclusion; normal IT/vendor controls apply

EU GMP Annex 11 §1 and §4.1: the extent of validation and the acceptance criteria are based on a justified and documented risk assessment — no fixed test-coverage percentage is mandated. Numbers in this template are examples to replace with your URS/Validation Plan.

SECTION 3: INSTALLATION QUALIFICATION (IQ)

3.1 Hardware Verification

#	Verification Item	Expected	Pass/Fail
IQ-H01	Server/Workstation model and serial number match purchase order	[Per PO]	□P □F
IQ-H02	Hardware specifications meet URS requirements (CPU, RAM, storage)	[Per URS]	□P □F
IQ-H03	Physical installation location per approved drawing	[Drawing #]	□P □F
IQ-H04	Power continuity (UPS/backup) per approved design, connected and functional	Yes	□P □F
IQ-H05	Environmental conditions (temperature, humidity) within spec	[Range]	□P □F

3.2 Software Verification

#	Verification Item	Expected	Pass/Fail
IQ-S01	Operating system version matches approved configuration	[Version]	□P □F
IQ-S02	Application software version matches approved version	[Version]	□P □F
IQ-S03	Software license is valid and not expired	Valid	□P □F
IQ-S04	Endpoint protection per approved design (antivirus where vendor-compatible), approved version	[Version]	□P □F
IQ-S05	Network configuration matches approved network diagram	[Diagram #]	□P □F

3.3 Documentation Verification

#	Document	Available?
IQ-D01	User Requirement Specification (URS)	□ Yes □ No
IQ-D02	Functional Specification (FS)	□ Yes □ No
IQ-D03	Design Specification (DS)	□ Yes □ No
IQ-D04	Vendor Installation Manual	□ Yes □ No
IQ-D05	Risk Assessment Report	□ Yes □ No

SECTION 4: OPERATIONAL QUALIFICATION (OQ)

4.1 Access Control Testing

#	Test Case	Test Steps	Expected Result	Pass/Fail
OQ-AC01	Login with valid credentials	Enter correct username + password	Login successful, role-appropriate menu shown	□P □F
OQ-AC02	Login with invalid credentials	Enter incorrect password ([N] attempts, per approved security policy/URS)	Account locked or access blocked as defined in URS (e.g. after 3 failures)	□P □F
OQ-AC03	Session timeout	Leave system idle for [X] minutes	Automatic logout, re-authentication required	□P □F
OQ-AC04	Role-based access	Attempt restricted function as Operator	Access denied, error message displayed	□P □F

4.2 Audit Trail Testing

#	Test Case	Test Steps	Expected Result	Pass/Fail
OQ-AT01	Audit trail created on data entry	Enter a value in GxP-critical field	Audit trail shows: user, timestamp, field, value	□P □F
OQ-AT02	Audit trail on modification	Modify an existing entry	Audit trail shows old value, new value, reason, user	□P □F
OQ-AT03	Audit trail cannot be deleted or altered	Attempt to delete/modify audit trail entries with each role — via the UI and via the admin, API or database paths that exist in the system design	Not possible for unauthorised users; any permitted administrative action is itself recorded. A hidden or disabled button alone is not sufficient evidence	□P □F
OQ-AT04	Audit trail review access	Access audit trail as QA user	Full audit trail readable in chronological order	□P □F

4.3 Alarm Management Testing

#	Test Case	Expected Result	Pass/Fail
OQ-AL01	Alarm triggered at defined limit	Visual + audible alarm at [limit value]	□P □F
OQ-AL02	Alarm acknowledgment recorded	Ack logged with user + timestamp	□P □F
OQ-AL03	Critical alarm cannot be silenced without acknowledgment	Alarm persists until explicitly acknowledged	□P □F

SECTION 5: PERFORMANCE QUALIFICATION (PQ)

5.1 PQ Criteria

PQ demonstrates the system performs consistently under actual production conditions. The number of runs, duration and conditions are defined in the Validation Plan based on risk and representativeness (e.g. 3 consecutive successful runs).

#	Performance Parameter	Acceptance Criteria	Pass/Fail
PQ-01	System availability during production shift	Availability ≥ [X]% per URS/SLA (e.g. 99.5%)	□P □F
PQ-02	Data capture completeness	100% of defined parameters captured	□P □F
PQ-03	Report generation time	[X] seconds	□P □F
PQ-04	Electronic signature workflow	All approvals completed within system	□P □F
PQ-05	Backup and restore test	Full restore in <[X] hours, data integrity confirmed	□P □F

SECTION 6: DEVIATION MANAGEMENT

Dev #	Description	Test Step Affected	Impact	Resolution	Closed By/Date
			□ Critical □ Major □ Minor

SECTION 7: SUMMARY & APPROVAL

IQ Result	□ Pass □ Fail □ Conditional Pass
OQ Result	□ Pass □ Fail □ Conditional Pass
PQ Result	□ Pass □ Fail □ Conditional Pass
Open Deviations	[Number] — every deviation assessed and dispositioned; release only when open items are justified as not affecting GxP use and approved by QA
System Release Decision	□ Released for GxP use □ Not released — pending [action]

Role	Name	Signature	Date
CSV Engineer / Author
QA Reviewer
System Owner
QA Manager (final approval)

Tác giả: Phạm Đức Phương Nam — GMP Automation Engineer | Xem hướng dẫn IQ/OQ/PQ chi tiết →