Untitled Note

Here is a suggested agenda, discussion points, evidence requirements, and draft questions for an IT self-inspection focused on infrastructure qualification and compliance based on GAMP guidance:

Proposed Agenda

1. Opening Meeting

・ Introductions ・ Inspection objectives and scope ・ Agenda review

2. IT Infrastructure Overview

・ Network and system architecture ・ Inventory of IT infrastructure components ・ Classification of components based on GAMP 5

3. Qualification Approach and Documentation Review

・ Procedures for IT infrastructure qualification ・ Specification and qualification protocol review ・ Traceability assessment ・ IQ/OQ/PQ documentation sampling

4. IT Infrastructure Change and Configuration Management

・ Change control process walkthrough ・ Configuration management system demo ・ Review of recent changes

5. Security and Access Controls Evaluation

・ Access control policy and procedures ・ User access rights review ・ Security hardening and patching practices

6. Closing Meeting

・ Summary of observations ・ Identification of potential findings ・ Next steps

Key Points of Discussion

1. Alignment of IT infrastructure qualification practices with GAMP guidance
2. Completeness and compliance of qualification documentation
3. Effectiveness of change control and configuration management processes
4. Appropriateness of security controls and access management practices

Evidence Requirements

1. Network diagrams and system inventories
2. Documented risk assessments and component classifications
3. Approved specifications and qualification protocols for selected components
4. Completed IQ/OQ/PQ reports for critical infrastructure
5. Change control records and configuration details for sampled changes
6. Access control policies, procedures, and user rights listings
7. Security hardening standards and patching records

Draft Questions

1. How are IT infrastructure components classified based on GAMP 5 principles?
2. Can you walk me through the qualification process for a critical infrastructure component?
3. How do you maintain traceability between requirements, specifications, testing, and release?
4. What are the steps in your change control process for IT infrastructure changes?
5. How are configuration details for IT infrastructure components captured and managed?
6. What are the policies and procedures around system access and user rights management?
7. How do you ensure infrastructure components are hardened and patched regularly?
8. Can you provide examples of recently qualified infrastructure and associated documentation?
9. How do you demonstrate compliance of IT infrastructure qualification records with ALCOA principles?
10. What training have IT team members received on GAMP and GMP compliance requirements?

I hope this agenda, discussion points, evidence requirements, and question set provides a helpful starting point for structuring your IT infrastructure self-inspection from a GAMP compliance perspective. Let me know if you need any clarification or have additional questions!