Who this is for: quality leaders who need a validated eQMS and a realistic picture of the work involved — before a vendor tells them "it’s all included" or a consultant quotes six months.
What IQ, OQ, and PQ each prove
Installation qualification proves the system is deployed as specified — versions, environment, configuration baseline. Operational qualification proves the functions work as intended against documented test cases: signatures re-authenticate, audit trails capture, workflows route. Performance qualification proves the system performs in your process, with your procedures, your data, and your people.
GAMP 5: the line that sets your burden
GAMP 5 categorizes software by how much of it is yours. A configured product (category 4) rides on the vendor’s platform validation; your obligation is risk-based verification of your configuration. Custom code (category 5) carries full lifecycle validation, forever — including every change. This is why "can your team configure it without code?" is a validation question, not just a usability one.
Who owes what
The vendor owes platform validation, maintained across releases, plus documentation of intended use and system boundaries. You owe the qualification of your configuration and your procedures around it. The practical test of a vendor: ask to see the IQ/OQ/PQ package they deliver, and ask who executes it. "We provide templates" means the work is yours.
Keeping it valid through change
The package is only as good as its currency. Every workflow revision, every new module, every upgrade needs an impact assessment: does this change touch a validated function? Risk-based verification of the delta — not revalidation of the whole — is what GAMP 5 expects, and what change control should generate as a byproduct.
The failure mode inspectors find: a validation binder from go-live, three years of changes, and no assessment connecting them.
The realistic timeline
For a configured eQMS with a vendor-delivered package, validation runs alongside implementation — weeks, not quarters, with your team’s effort concentrated in reviewing and signing rather than authoring. If the quote in front of you says otherwise, the architecture is category 5 wearing a category 4 badge.