Annex 11 — computerised systems

Annex 11 is structured around a lifecycle: a project phase covering risk management, personnel, suppliers and validation, then an operational phase covering data, accuracy checks, storage, printouts, audit trails, change and configuration management, periodic evaluation, security, incident management, electronic signatures, batch release, business continuity and archiving. Reading it as a checklist of that shape is the quickest way to find your gaps.

Risk management runs through the whole annex, which means the depth of everything else is a decision you must justify. A system whose failure could affect patient safety, product quality or data integrity warrants more validation, tighter access control and closer audit trail review than a system whose failure is merely inconvenient. Applying uniform rigour to everything is both expensive and, paradoxically, a way of under-controlling what matters.

Supplier and service provider management is explicit. Where third parties supply, install, configure, integrate, validate, maintain or host a system, formal agreements should exist, and supplier competence should be assessed — with audits based on risk. Cloud and hosted arrangements bring this sharply into focus, because the controls you rely on are largely someone else's.

Two operational requirements account for a disproportionate share of findings: audit trails that are enabled but never reviewed, and access control that has drifted so that leavers retain accounts and privileges exceed roles. Both are visible to an inspector within minutes and both suggest the system is not actually being managed.