Werum PAS-X GxP Validation & 21 CFR Part 11 Compliance
Empowering pharmaceutical and life science organizations with cutting-edge AI solutions.
PAS-X Validation Services We Deliver
Validation Plan & URS
Validation Plan, User Requirements Specification, and Functional/Configuration Specifications. Defines the validation strategy, scope, deliverables, and acceptance criteria up front.
Risk Assessment (ICH Q9)
ICH Q9(R1) risk assessment scoping validation effort by patient impact and probability. Drives test depth, regression scope, and change control categorization.
IQ/OQ/PQ Execution
Full Installation, Operational, and Performance Qualification scripts and execution. Includes interface validation, MBR validation, and end-to-end batch trial runs.
Part 11 & Annex 11 Mapping
Unified 21 CFR Part 11 and EU GMP Annex 11 control mapping document. Single piece of evidence answering both FDA and EMA inspector questions.
Data Integrity (ALCOA+)
Data integrity assessment aligned to MHRA, FDA, and PIC/S PI 041 guidance. Designed-in attribution, contemporaneity, and original electronic record retention.
Periodic Review SOPs
Periodic review SOP and operational governance: audit trail review cadence, change control SOPs, training records management, and validation maintenance.
GAMP 5 Second Edition as Operating Framework
We use ISPE GAMP 5 Second Edition as the primary validation framework on every PAS-X program. The 2022 update adds modern emphasis on critical thinking, iterative delivery, and crediting supplier validation evidence — all of which let us right-size effort instead of doing every test from scratch. PAS-X core is GAMP Category 4 (configured), custom MBRs are Category 5 (custom), and Körber's supplier package is credited where applicable.
CSA Principles Applied Pragmatically
The FDA Computer Software Assurance (CSA) draft guidance signals a shift from documentation-heavy CSV to risk-based assurance with critical thinking and unscripted testing where appropriate. We adopt CSA on PAS-X by right-sizing test scripts to risk: scripted testing on batch-impacting paths, exploratory on low-risk configuration. CSA maps cleanly onto GAMP 5 Second Edition.
Inspection-Ready by Design
FDA, EMA, MHRA, and PMDA inspections of PAS-X focus on a predictable set of topics — data integrity, audit trail review, change control, training, and the validation summary. We design the operational governance so each topic has a clean answer ready before inspection. This is much cheaper than fixing gaps under inspection pressure. See the PAS-X services hub.
Validation Deliverables Across PAS-X Programs
Validation Plan
Defines validation strategy, scope, deliverables, roles, and acceptance criteria for the PAS-X program. Anchors all subsequent validation work and serves as the inspector's entry point.
Learn moreURS / FS / CS
User Requirements, Functional Specification, and Configuration Specification. Trace from business needs through to PAS-X configuration choices, MBR design, and interface specifications.
Learn moreRisk Assessment
ICH Q9(R1) risk assessment scoping testing depth, regression scope, change categorization, and supplier credit. Right-sizes effort to patient impact and probability.
Learn moreIQ/OQ/PQ
Installation, Operational, and Performance Qualification protocols. Cover infrastructure, configuration, MBRs, interfaces, and end-to-end batch trial runs against acceptance criteria.
Learn morePart 11 / Annex 11 Mapping
Unified control mapping demonstrating compliance with FDA 21 CFR Part 11 and EU GMP Annex 11. One document satisfying both regulators with consistent evidence.
Learn moreValidation Summary Report
Validation Summary Report mapping every URS line to test evidence and identifying any open issues with mitigation. Sign-off artifact closing the validation effort and authorizing release.
Learn moreSpecialized Validation Topics for PAS-X
Custom MBR Validation
Each custom master batch record validated as a GAMP 5 Category 5 object with its own configuration spec, test cases, and traceability into URS.
Interface Validation
SAP, LIMS, historian, and DCS interfaces validated as discrete objects with happy-path, boundary, error-injection, and rollback test cases.
PAS-X SaaS Validation
Tenant-scoped validation crediting Körber's supplier package. Bounded revalidation strategy for the Körber upgrade cadence.
AI Agent Validation
GAMP 5 Category 5 validation for MCP-based agents. Adversarial OQ for prompt injection per OWASP LLM Top 10. Hallucination testing.
Annex 1 for Sterile
Sterile MBRs designed for revised Annex 1 traceability — line clearance, EM excursions, intervention logs, aseptic process simulation linkage.
CGT Chain of Identity
Cell and gene therapy chain-of-identity validation from apheresis to infusion, aligned to FDA CBER and EMA ATMP expectations.
Our Validation Approach for PAS-X
Validation succeeds when it is embedded from kickoff, not bolted on at the end. We define the validation plan during discovery, run risk assessment alongside design, build test cases as MBRs are authored, and execute IQ/OQ/PQ as integrations come online. The validation summary is the natural output of disciplined design and testing — not a separate downstream project. We follow GAMP 5 Second Edition with CSA right-sizing.
Embed from Kickoff
Validation plan, risk assessment, and acceptance criteria defined during discovery. Validation lead embedded into the program team, not a downstream gate.
Right-Size by Risk
Test depth scaled to patient impact and probability per ICH Q9. Scripted testing on critical paths, exploratory on low-risk items. CSA principles applied.
Automate Regression
Interface tests, configuration smoke tests, and integration regressions automated and version-controlled. Cuts revalidation cost on subsequent upgrades dramatically.
Today's business insights
Profitable growth in the AI solutions industry
Our CEO discusses how AI is transforming the pharmaceutical industry and shares key strategies for leveraging AI in drug discovery and development.
More insights on unlock profitable growth in ai solutions
Industry References We Use on PAS-X Validation
GAMP 5 Second Edition
ISPE GAMP 5 Second Edition (2022) — the global CSV operating framework. Primary reference for every PAS-X validation package we deliver.
FDA Part 11
FDA 21 CFR Part 11 — electronic records and electronic signatures rule. The bedrock control mapping in every validation deliverable.
EU GMP Annex 11
EU GMP Annex 11 — European equivalent of Part 11. Unified mapping with Part 11 in our PAS-X validation packages.
FDA CSA Draft Guidance
FDA Computer Software Assurance draft guidance (2022). Right-sizes validation effort by risk. Maps cleanly onto GAMP 5 Second Edition.
ICH Q9(R1)
ICH Q9(R1) Quality Risk Management updated 2023. Drives validation testing depth and change control categorization for PAS-X.
MHRA Data Integrity
MHRA GxP Data Integrity Guidance. ALCOA+ principles built into PAS-X configuration and audit trail review SOPs.
PIC/S PI 041
PIC/S PI 041-1 Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. Globally referenced data integrity standard.
Annex 1 (Sterile)
Revised EU GMP Annex 1 in force August 2023. Sterile PAS-X MBRs embed Annex 1 traceability natively for sterile fill-finish lines.
ICH Q10 PQS
ICH Q10 pharmaceutical quality system framework. PAS-X-driven deviation, CAPA, and change control workflows align directly to ICH Q10.
PAS-X Validation — Frequently Asked Questions
21 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures. For a Werum PAS-X deployment, Part 11 covers the master batch record, executed batch record, electronic logbook, equipment qualification records, and any other GxP record produced or stored by the system. Compliance requires technical controls (audit trails, access controls, e-signature manifest) plus procedural controls (training, periodic review, change control). PAS-X provides the technical foundation, but compliance is achieved by your validated configuration plus your operational SOPs — never by the platform alone.
ISPE GAMP 5 Second Edition (released July 2022) is the global standard framework for computerized system validation. For PAS-X, the core platform is typically GAMP Category 4 (configured product) and custom MBRs and bespoke interface code are Category 5 (custom). The Second Edition update brought modern emphasis on critical thinking, iterative delivery, and the ability to leverage supplier validation evidence — all of which we use to right-size validation effort on PAS-X programs. Specifically we credit Körber's supplier validation package where appropriate rather than redoing work in-house.
EU GMP Annex 11 is the European equivalent of Part 11 and applies to any PAS-X deployment supporting EU manufacturing or QC. Annex 11 emphasizes risk management, a clean responsibility split between IT supplier and regulated user, and operational controls around data integrity, business continuity, and periodic evaluation. The Annex 11 control set overlaps heavily with Part 11, and we deliver a unified Part 11 / Annex 11 control mapping in every PAS-X validation package so a single deployment can answer to both regulators with one piece of evidence.
A complete validation package contains: a Validation Plan, User Requirements Specification (URS), Functional Specification (FS), Configuration Specification (CS), Risk Assessment per ICH Q9(R1), Installation Qualification (IQ), Operational Qualification (OQ), Performance Qualification (PQ), Traceability Matrix, and Validation Summary Report. Add a Part 11 / Annex 11 control mapping document, a data integrity assessment per ALCOA+, an electronic signature meaning matrix, and a periodic review SOP. We deliver these as Word and Excel templates ready to load into your validation document system — typically Veeva Vault Validation Management or MasterControl Validation Excellence Tool.
Data integrity is the central concern for any GxP MES. We design PAS-X configuration explicitly around the MHRA GxP Data Integrity Guidance, the FDA Data Integrity guidance, and the PIC/S PI 041 Good Practices for Data Management and Integrity. Concretely this means: every record attributable to a unique authenticated user, contemporaneous capture (no after-the-fact entries), original electronic record retained, accuracy verified against source instrument data, and the full ALCOA+ extension (complete, consistent, enduring, available). The PAS-X audit trail design and review process is the central control.
Validation effort scales with custom MBR scope, integration count, and number of equipment master records. A first-site PAS-X program with 10-20 MBRs, three integrations (SAP, LIMS, historian), and a dozen pieces of qualified equipment typically runs 3-5 thousand validation hours over the program lifetime — not all at the end. We embed validation from kickoff so the validation summary is the natural output of disciplined design and testing, not a separate post-build effort. The shift-left approach typically reduces total validation effort by 30-40 percent compared to traditional waterfall validation, while improving defect detection rates earlier in the program.
PAS-X SaaS changes the validation model: Körber operates the underlying infrastructure on Microsoft Azure under a validated multi-tenant operating model, and customers validate their tenant configuration, MBRs, and integrations. We use Körber's supplier validation package as a credited input under GAMP 5 Second Edition supplier assessment principles, scope our validation to tenant-specific items, and adopt a release adoption strategy that handles Körber's upgrade cadence with bounded revalidation. This is meaningfully less work than self-hosted PAS-X validation while preserving inspection readiness.
The revised EU GMP Annex 1 entered into force in August 2023 and substantially raised expectations for sterile manufacturing — contamination control strategy, aseptic process simulation traceability, environmental monitoring linkage. PAS-X eBRs for sterile fill-finish lines must embed Annex 1 traceability natively. We design sterile MBRs to capture line clearance, environmental monitoring excursions, intervention logs, and APS data inline so the eBR is itself the evidence record an inspector reviews. This is meaningfully different from how older paper-based or first-generation MES sterile records were structured.
Change control is where many PAS-X deployments accumulate technical debt. Every MBR change, every interface change, every Körber release potentially triggers revalidation effort. We design the change control SOP up front to map change types to validation impact: a typo fix in operator text might be a Category 1 change with peer review only, while a recipe parameter change is a full revalidation. Aligned to ICH Q10 change management principles and ICH Q12 for post-approval change. The discipline pays off years later when the system continues to evolve without unwieldy revalidation costs.
Each interface — SAP, LIMS, historian, DCS — is treated as a discrete validated object with its own URS, interface specification, and IQ/OQ test cases. Test cases cover happy path, boundary conditions, error injection (network drop, schema mismatch, malformed payload), and rollback behavior. Automated regression tests are version-controlled alongside the interface code so subsequent SAP or LIMS upgrades have a documented regression suite that cuts revalidation effort dramatically. This automation discipline is consistent with GAMP 5 Second Edition guidance on test automation.
The FDA Computer Software Assurance (CSA) draft guidance (September 2022) signals a shift from documentation-heavy CSV to risk-based assurance with critical thinking and unscripted testing where appropriate. We adopt CSA principles on PAS-X programs by right-sizing test scripts based on patient impact and likelihood, using exploratory testing for low-risk configuration items, and reserving fully scripted testing for high-risk batch-impacting paths. The end result is faster delivery and better defect detection, with documentation effort proportionate to risk. CSA principles map cleanly onto GAMP 5 Second Edition.
FDA inspectors examining PAS-X focus on a predictable set of areas: data integrity, audit trail review, change control, training records, and the validation summary. We design the operational governance so each of these has a clean answer ready: audit trails reviewed periodically with documented evidence, change records linked to validation impact assessments, training records tied to MBR versions, and a validation summary that maps every URS line to test evidence. The same approach satisfies EMA, MHRA, PMDA, and TGA inspections — we have not encountered a major regulator that asks a fundamentally different question of an MES.
Ready for an Inspection-Ready PAS-X?
From validation plan to validation summary report — full GAMP 5 Second Edition packages with unified Part 11 and Annex 11 control mappings. Explore the PAS-X services hub or AI integration page.
Book a Meeting