A narrow Part 11-style review can miss several operational controls emphasized by Annex 11. Companies should evaluate supplier assessment and audit expectations, periodic review of validated systems, business-continuity arrangements, and control over data storage and ownership. These topics should be reflected in validation documentation, quality agreements, supplier oversight, system inventories, backup and recovery arrangements, and periodic-review evidence. The goal is to demonstrate that the computerized system remains controlled throughout its lifecycle, including when responsibilities are shared with vendors or service providers.
FAQ