During a project, Zamann supported a German pharmaceutical company to strengthen CSV compliance with EMA and FDA expectations. However, the team identified a common and risky assumption. The company believed that a system remains valid because it was validated years ago.
This approach does not meet regulatory expectations. FDA, EMA, and GAMP5 clearly require continuous assessment, monitoring, and requalification of validated systems. Therefore, companies must actively maintain the validated state over time. In addition, validation cannot remain a one-time activity linked only to PQ execution.
As a result, the system must stay in a validated state every day. Not only at the moment of qualification, but throughout its entire lifecycle.
Our team supports the planning, execution, and maintenance of qualification and validation activities, including IQ, OQ, and PQ, to keep GMP-regulated systems compliant and under control.
In inspection terms, the system is not considered to have a confirmed continued validated state. Initial validation only demonstrates fitness at release, not sustained compliance over time. When periodic review is missing, there is no documented mechanism to verify that system performance, configuration stability, and operational behavior remain aligned with validated conditions throughout its lifecycle.
This is treated as an uncontrolled change to a validated system. Even if functionality appears unaffected, the absence of documented impact assessment breaks the link between change control and validation assurance. As a result, the system configuration cannot be considered controlled under lifecycle validation principles, because post-change equivalence to the validated state is not demonstrated.
Because absence of failures does not equal proof of stability. Without structured trending of system performance, there is no evidence that gradual drift, degradation, or hidden variability has been evaluated over time. Therefore, the validated state cannot be continuously justified, since lifecycle assurance depends on observable system behavior trends rather than isolated compliant outputs.
