If your temperature and humidity monitoring system records GxP data, the software that records it needs to be validated. Auditors rarely ask whether you validated it. They ask how you decided how much to do, and whether the paperwork shows it.
This guide covers what regulators say about software validation for environmental monitoring, then walks through a practical plan: requirements, supplier assessment, IQ/OQ/PQ for a wireless sensor and cloud platform, and ongoing control. The aim is a package that is complete where risk is high and short everywhere else.
Here, “environmental monitoring” means continuous temperature and humidity monitoring of GxP storage and process areas, not microbiological cleanroom monitoring.
Why monitoring software is in scope
Monitoring software creates and keeps the records that show product was stored within limits. Three sources put it in scope:
- 21 CFR Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under agency record requirements (21 CFR 11.1(b)).
- EU GMP Annex 11 applies to “all forms of computerised systems used as part of a GMP regulated activities” (EudraLex Volume 4, Annex 11, Principle).
- FDA’s 2003 guidance on Part 11 scope and application says Part 11 applies to records that predicate rules require and that you keep electronically in place of paper. It recommends documenting that determination.
Continuous readings, alarm acknowledgments, alarm limit changes and signed reviews are the records most teams treat as in scope. Write that decision down. It is the first page of the validation file, and it is short.
What 21 CFR Part 11 requires of the system
The core controls sit in 21 CFR 11.10, “Controls for closed systems.” The first is validation: “Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records” (21 CFR 11.10(a)).
The regulation does not name IQ, OQ or PQ and does not say how much testing is enough. It sets the outcome. You choose the method and justify it. The other 11.10 items that matter most for monitoring software:
- Copies of records (11.10(b)): accurate and complete copies in human-readable and electronic form, suitable for agency inspection, review and copying.
- Record protection (11.10(c)): records protected so they can be retrieved accurately and promptly throughout the retention period.
- Access limits (11.10(d)): system access limited to authorized individuals.
- Audit trails (11.10(e)): secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete records. Changes must not obscure previously recorded information.
- Authority checks (11.10(g)): checks that only authorized individuals can use the system, sign a record, alter a record or perform the operation at hand.
- Trained users (11.10(i)): people who develop, maintain or use the system have the education, training and experience for their tasks.
If the platform supports electronic signatures, Subpart C applies too: signed records show the signer’s printed name, the date and time, and the meaning of the signature (21 CFR 11.50(a)), and signatures are linked to their records so they cannot be excised, copied or transferred by ordinary means (21 CFR 11.70).
For deeper audit trail detail, see our guide to 21 CFR Part 11 audit trails for temperature monitoring. On how much to validate, FDA’s 2003 scope and application guidance says the decision and its extent should rest on a justified and documented risk assessment. That thread runs through every framework below.
What EU Annex 11 adds
Annex 11 is more explicit about lifecycle, suppliers and review. The points that shape a monitoring validation:
- Risk-based extent (clause 1): the extent of validation and data integrity controls should rest on a justified and documented risk assessment.
- Suppliers (clauses 3.1 to 3.4): formal agreements stating third-party responsibilities; the need for an audit based on risk assessment; review of commercial off-the-shelf documentation against user requirements.
- Validation (clauses 4.1 and 4.4): be able to justify your protocols, acceptance criteria and records based on risk. User requirements should be traceable throughout the lifecycle.
- Back-ups (clause 7.2): restore capability checked during validation and monitored periodically.
- Audit trails (clause 9): consider, based on risk assessment, a system-generated record of GMP-relevant changes and deletions. Audit trails should be available, convertible to an intelligible form and regularly reviewed.
- Change and configuration management (clause 10): changes, including configuration changes, made only in a controlled manner under a defined procedure.
- Periodic evaluation (clause 11): confirm the system remains in a valid state and GMP compliant.
Annex 11 asks for audit trail review, not just their existence. Plan for that in your SOPs.
GAMP 5 second edition: scale the effort
ISPE’s GAMP 5 guide, second edition (2022), is the industry reference for risk-based computerized system validation. It keeps the first edition’s framework and lifecycle approach and puts more weight on critical thinking by subject matter experts (ISPE, Pharmaceutical Engineering, January-February 2023). Two ideas help:
- Software categories are a starting point. ISPE says categories 3 to 5 should be viewed as a continuum, and most systems combine components from different categories. A monitoring platform mixes standard functions with configured ones such as alarm rules, user roles and report templates.
- Lifecycle activities scale with GxP impact, complexity and novelty. The category is one input, not the answer.
GAMP 5 is guidance, not regulation. Cite it as the method you followed, not as a requirement.
FDA’s Computer Software Assurance guidance
FDA’s final guidance, “Computer Software Assurance for Production and Quality System Software,” was announced in the Federal Register on September 24, 2025. It takes a risk-based approach: identify the intended use, assess the risk, and match the assurance effort to that risk.
Be precise about scope. It addresses computers and automated data processing systems used in medical device production or the quality system. A pharma or biotech site working under FDA drug GMP or EU GMP is not directly bound by it. GAMP 5 second edition explores and applies CSA concepts where relevant, and many pharma teams use the same risk-first thinking to cut low-value testing. Treat it as support for your rationale, not a replacement for Part 11 or Annex 11.
How to validate without over-documenting
Over-documentation usually means producing the same evidence three times, or testing low-risk functions with the same rigor as alarm delivery. Three habits keep the file short:
- Let risk set the depth. Test alarm thresholds, notifications, audit trails, access control and retention in full. Give low-risk functions, such as dashboard layout, a lighter check or none, and record why.
- Use supplier evidence on purpose. Annex 11 clause 3.3 expects you to review supplier documentation against your requirements. Where supplier testing covers a standard function, reference it. Test what you configured and what you depend on.
- Record the decisions. Clause 4.1 asks you to justify your protocols and acceptance criteria. A short rationale per section does this better than extra scripts.
A practical validation approach
1. Validation plan
Keep it to a few pages: the system and its intended use, in-scope records, risk assessment approach, deliverables, roles, acceptance criteria and deviation handling. Reference your validation master plan instead of repeating it.
2. User requirements
Write a user requirements specification (URS) from your documented risk assessment and GMP impact (Annex 11, clause 4.4). For monitoring, typical groups are:
- Measurement range, accuracy and sampling interval for each monitored area
- Alarm thresholds, delays, notification routes and escalation
- User roles, access control and electronic signatures, if used
- Audit trail content and review
- Reports and exports that meet 21 CFR 11.10(b)
- Data retention, backup and restore
- Behavior when the network or power fails
3. Supplier assessment
Assess the supplier in proportion to risk (Annex 11, clauses 3.2 and 4.5). For a platform that holds product-quality records, ask for:
- Quality management system documentation and certifications
- Development, testing, release and change notification practices
- Validation or qualification documentation for the product
- Sensor calibration certificates and the calibration approach
- A written agreement covering responsibilities (clause 3.1)
For a cloud (SaaS) platform, add hosting, backup and restore, update release and notice, audit trail and data export access, and what happens to your data if the contract ends. The supplier controls the release calendar, so your change control has to cope with updates you did not schedule. See change control and revalidation triggers.
4. IQ, OQ and PQ for a wireless sensor and cloud platform
The table shows what each stage typically covers. Scale it to your risk assessment. Our IQ/OQ/PQ validation playbook has protocol examples.
| Stage | Question | What to test or verify |
|---|---|---|
| IQ | Is it installed as specified? | Sensor and gateway models and serial numbers match the design. Calibration certificates are on file and in date. Sensor placement matches approved locations, ideally from a mapping study. Network connectivity works. Platform version, configuration, users and roles are recorded. |
| OQ | Does each function work? | Alarm thresholds trigger at configured values, with delays applied. Notifications reach the right people by each route and escalate if unacknowledged. The audit trail records date, time and user for entries, changes and deletions without obscuring earlier values. User roles allow and block the defined functions. Sensor data arrives complete and accurate. Reports and exports are complete. Backup and restore work. |
| PQ | Does it perform in real use? | Run in the live environment for a defined period. Check readings are continuous, with no unexplained gaps. Compare readings with a calibrated reference at the monitored location. Confirm alarms are received and acted on under your SOPs. Confirm data is retained and retrievable. |
Two items are easy to miss. First, test connectivity loss: confirm what the sensor does when the network drops, and that buffered data arrives unaltered when the link returns (Annex 11, clause 4.8, on checks that data is not altered when it moves between systems). Second, test the people: confirm the person who should receive an alarm gets it at 2 a.m.
Qualified Controls offers validation services, including IQ/OQ/PQ and mapping, through our validation services page. Qualified Controls wireless sensors and the Qualified Controls monitoring platform support Part 11 requirements, including audit trails, user roles, electronic signatures and record retention. Your validated implementation and procedures are what make the system compliant in your facility.
5. Ongoing control
- Change control (Annex 11, clause 10): route software updates, configuration changes, sensor replacements and alarm limit changes through a defined procedure. Assess each against risk and decide what verification it needs.
- Periodic review (clause 11): set the interval by risk. Review functionality, deviations, incidents, upgrade history, performance, security and validation status.
- Revalidation triggers: define them in advance. Common ones are a release that touches alarming, audit trails or data handling, a hosting change, sensors moved to new locations, a change in intended use, and repeated incidents.
Validation checklist
- Part 11 / Annex 11 scope decision documented
- Risk assessment complete, with GMP impact and data integrity risks
- Validation plan approved; URS testable and traceable
- Supplier assessed in proportion to risk; written agreement in place
- Sensors calibrated, certificates on file, placement justified
- IQ, OQ and PQ executed, deviations closed, report approved
- OQ covers alarms, notifications, audit trail, roles, data integrity, backup and restore
- SOPs in place for alarm response, audit trail review, user management and change control
- Users trained and training recorded
- Periodic review interval and revalidation triggers defined
Frequently asked questions
Does environmental monitoring software need to be validated?
Yes, if it creates or keeps records used in GxP decisions. 21 CFR 11.10(a) requires validation to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records. EU GMP Annex 11 says the application should be validated. The extent depends on a documented risk assessment.
What does 21 CFR Part 11 require for monitoring software?
For closed systems, 21 CFR 11.10 requires validation (a), accurate and complete record copies (b), record protection and retrieval (c), limited access (d), secure time-stamped audit trails (e), authority checks (g) and trained users (i). If the system uses electronic signatures, Subpart C also applies.
Is IQ/OQ/PQ required by regulation?
No regulation names IQ, OQ or PQ. 21 CFR 11.10(a) and Annex 11 require validation but leave the method to you. IQ/OQ/PQ is a common structure. Whatever you choose, justify the scope and acceptance criteria with a risk assessment.
How much documentation does software validation need?
Enough to show the system is fit for its intended use and to justify your approach. Annex 11 clause 4.1 expects you to justify protocols, acceptance criteria and records based on risk. Low-risk functions can have lighter verification, and assessed supplier evidence can replace repeat testing.
Does FDA’s Computer Software Assurance guidance apply to pharma monitoring systems?
FDA’s final Computer Software Assurance guidance addresses software used in medical device production or the quality system, so it does not directly apply to most pharma GxP monitoring. Its risk-based approach is consistent with GAMP 5 second edition and can support a lean validation rationale. Part 11 and Annex 11 remain your requirements.
When should a monitoring system be revalidated?
When a change could affect alarms, audit trails, data handling, access control or intended use. Annex 11 clause 10 requires controlled changes, and clause 11 requires periodic evaluation. Define revalidation triggers in the validation plan so each change gets a documented, risk-based decision.
