Qualification of IT infrastructure according
to EU GMP Guide Annex 11 and GAMP

Qualification of IT infrastructure

The risk-based qualification of buildings, premises, systems, equipment and IT infrastructure forms an integral part of quality assurance in a regulated environment, and is also required by law (EU guidance on good manufacturing practice).

A planned and documented process must be used to demonstrate that the equipment and premises are suitable for their intended purpose, and actually function reliably under the real-world conditions applicable on site.

The execution of this process must be set down in written standard operating procedures (SOPs) and work instructions (WIs). The SOPs must describe all operations in a clear and structured manner, and be informed by risk-based principles.

An appropriately integrated qualification strategy can be used to avoid the duplication of work in departments that access shared IT services, so as to ensure the availability of consistent and qualified IT platforms. Another important aspect here is the integration of these measures into a company-wide Quality Assurance system.

DHC utilises the V-Model as its validation and qualification strategy. To this end, both the chronological sequence as well as the phases and documents relevant for risk-based publication are depicted:

  • Design Qualification: Specification of the requirements for the equipment or the system. These include user requirements, as well as functional and design specifications.
  • Installation Qualification: Documents the installation and commissioning of the system or machine, and demonstrates compliance with applicable regulations and required performance data as well as specifications.
  • Operational Qualification: Equipment test or inspection process that assesses whether a system or piece of equipment is operating correctly.
  • Performance Qualification: Field test that documents the deployment of the equipment in routine operations.



In a large number of projects, we have become acquainted with and optimised various methods for qualifying IT infrastructure. Based on this experience, we have developed the DHC Best Practice Method.

Our consultants will gladly and competently support you in the following topics:

  • Fit-Gap Inspection Readiness Analysis of your qualification framework as well as your documentation (Friendly Audits / Compliance Checks)
  • 21 CFR Part 11 & EU GMP Annex 11 Assessments
  • Risk-based infrastructure analysis
  • Development of remediation plans, e.g. adapting your risk-based qualification strategy to new regulatory requirements
  • Conceptualisation of qualification strategy and framework (work instructions, templates and training material)
  • Qualification / compliance workshops
  • Development of test strategies and specifications (IQ/OQ)
  • Support with test execution and documentation
  • Incident and problem management according to ITIL
  • Conception of processes and creation of corresponding process descriptions (SOPs)
  • Coaching of QA / validation managers

The core of our implementation service is the risk-based and economic implementation of the qualification of your IT infrastructure. We validate either according to your work instructions or, if desired, according to the DHC Best Practice Method. We offer the following implementation services:

  • Prospective IT infrastructure qualification: IT infrastructure qualification is the foundation for software validation. We ensure that your IT infrastructure components are qualified in line with the audit.
  • Retrospective IT infrastructure qualification: Systems in productive use are qualified during ongoing operations.
  • Turnkey implementation of qualification-remediation projects for the purpose of audit readiness.
  • Method: Framework with work instructions for qualification of IT infrastructure are created, implemented and trained.

By services we mean various services that complement our consulting and implementation services.

    • Supplier management incl. supplier or service provider audits
    • Audit management
    • Change management and maintenance of the validated state of the IT infrastructure
    • Test management
    • Training management
    • Project management
    • Technical Writer: Taking over documentation tasks, e.g. creating SOPs or test plans

As a qualification all-round carefree package, we offer Managed Services for our customers. Our specialists qualify and validate your IT systems when they are introduced and look after the operating phase until they are decommissioned. With this model, you receive the complete software validation and qualification of the IT infrastructure from a single source.


Use our experience and industry expertise as a qualification specialist.

  • More than 25 years of expertise in qualification
  • Many successfully completed prospective and retrospective validation and qualification projects
  • High audit assurance
  • Strong team of validation managers with in-depth knowledge of regulatory requirements
  • Long-term and trustful cooperation with our customers
  • Uniform, methodical, process-oriented and risk-based approach to qualification
  • Tailored to customer needs, scalable method set (DHC Best Practices)
  • Ensuring the transfer of knowledge to you as a client
Matthias Bothe

Managing Director & Industry Unit Manager
Life Sciences, Chemie and Medical Engineering
phone: +49 681 93 666 0
email: matthias.bothe@dhc-gmbh.com

Matthias Bothe
Carsten Buri

CEO and Director Sales & Marketing, DHC Switzerland

phone: +41 44 500 888 7
email: carsten.buri@dhc-ag.ch

Carsten Buri
Request information!

Learn more about our consulting services for GxP Compliance!



Our web sessions are provided as a free service for DHC customers and potential customers.