Validation master plan template

A free validation master plan template for a small lab or device maker: list your systems with their GxP impact and risk call, and the plan writes the scope, roles, approach, the documents each system needs, change control, periodic review and a signed approval block. It starts as a sample VMP for a four-system QC lab. Device makers get the wording of FDA's computer software assurance guidance.

Pre-filled with a worked example: a small QC lab with four systems. Edit any step and the plan below rewrites itself, or clear it to start from a blank template.

Validation documents this plan commits to

20 deliverables

4 of 4 systems in scope (2 high, 1 medium, 1 low), five documents each.

Every field the plan needs before signature is filled in.

Systems inventory

One block per computerised system. GxP impact None takes a system out of scope; say why in its intended use.

SystemIntended useAcquire, process and report assay and impurity results for batch release and stabilityGxP records it creates or holdsGxP impactRisk callSoftware type (GAMP 5 names)Validated by (target date)System owner (a role)Holds Part 11 records or signatures
SystemIntended useSample login, specification checks, second-person result review and certificate of analysis approvalGxP records it creates or holdsGxP impactRisk callSoftware type (GAMP 5 names)Validated by (target date)System owner (a role)Holds Part 11 records or signatures
SystemIntended useLog temperature and humidity every 5 minutes and alarm on an excursionGxP records it creates or holdsGxP impactRisk callSoftware type (GAMP 5 names)Validated by (target date)System owner (a role)Holds Part 11 records or signatures
SystemIntended useHold exported reports and back up the CDS and monitoring databasesGxP records it creates or holdsGxP impactRisk callSoftware type (GAMP 5 names)Validated by (target date)System owner (a role)Holds Part 11 records or signatures

Step 3 of 6

Validation master plan

Validation Master Plan, QC Laboratory

Document control header
Document number	QA-VMP-001
Version	v1.0
Effective date	2026-11-16
Site	QC laboratory, release and stability testing of oral solid dose products
Organisation	Drug or biologics QC lab (21 CFR 211)

1.Purpose

Set out how the QC laboratory brings its computerised systems into a validated state and keeps them there: which systems are in scope, who does what, how the work is sized by risk, which documents each system needs, and how changes and periodic reviews are handled.

2.Scope

In scope

2.1Computerised systems that create, change or hold records required by 21 CFR 211 for QC testing
2.2Systems whose electronic records or electronic signatures are relied on in place of paper
2.3The infrastructure those systems depend on for storage and backup

Out of scope, and where it is covered

Qualification of the analytical instruments themselves (covered by the equipment qualification SOP)
Office software used only to draft documents that are printed and signed in ink
Manufacturing and warehouse systems (covered by the site's production VMP)

3.Regulatory basis

21 CFR 211.68(b): Computer controls: changes instituted only by authorized personnel, input and output checked for accuracy, and a backup file of data.
21 CFR 11.10(a): Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
21 CFR 11.10(i): People who develop, maintain or use the systems have the education, training and experience for their tasks.
21 CFR 11.10(k)(2): Revision and change control, with an audit trail, for systems documentation.

Guidance followed: FDA, Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003); ISPE GAMP 5, Second Edition (2022), industry guidance used for the software-type names.

4.Systems inventory

System	Intended use and GxP records	Part 11	GxP impact	Risk call	Software type	Owner, validated by
SYS-01Chromatography data system (6 HPLC)	Acquire, process and report assay and impurity results for batch release and stabilityRaw data, processing methods, results, audit trail, signed result approvals	Yes	Direct	High	Configured component	QC Laboratory Manager2027-02-26
SYS-02LIMS (vendor-hosted)	Sample login, specification checks, second-person result review and certificate of analysis approvalSample records, results against specification, CoA approvals	Yes	Direct	High	Configured component	QA Manager2027-04-30
SYS-03Temperature monitoring (stability chambers, sample fridges)	Log temperature and humidity every 5 minutes and alarm on an excursionChamber logs, alarm acknowledgements with reason	Yes	Direct	Medium	Standard system component	Equipment and Facilities Lead2027-01-29
SYS-04File server and nightly backup	Hold exported reports and back up the CDS and monitoring databasesBackup copies of GxP data; no records created here	No	Indirect	Low	Infrastructure software	IT Lead2026-12-18

Software type uses the GAMP 5 category names. GxP impact: Direct = creates or changes a GxP record or decision; Indirect = supports a direct system; None = out of scope, rationale recorded here.

5.Roles and responsibilities

5.1Head of Quality: approves this plan, every validation report and any deviation that changes a risk call
5.2System owner: writes the URS, keeps the system in its validated state, runs its periodic review
5.3Validation lead: writes the risk assessments, protocols and traceability matrix; reviews executed tests
5.4Analysts (trained testers): execute protocols and record actual results and deviations
5.5IT Lead: qualifies the server and backup, runs restore checks, administers user accounts
5.6Supplier: supplies its own test evidence and release notes under the quality agreement

6.Validation approach

Validation is risk-based. Each system gets a documented risk assessment of its potential to affect product quality and safety, and record integrity, the basis FDA's 2003 Part 11 guidance names. The risk call in the inventory sets the depth of requirements, testing and documentation in the deliverables table.

Supplier documentation and testing are used where the supplier assessment supports it, so the lab tests its own configuration and intended use rather than repeating the supplier's work.

FDA wrote its computer software assurance guidance for device makers; this plan borrows its idea of matching test rigor to risk, without claiming that guidance applies to the lab.

7.Deliverables per system

Each system in scope gets these documents, sized by its risk call. Each is signed before the next starts.

System	URS	Risk assessment	Test protocol	Traceability	Report
SYS-01High	Full URS	Per function	IQ, OQ, PQ scripted	Full matrix	Summary report
SYS-02High	Full URS	Per function	IQ, OQ, PQ scripted	Full matrix	Summary report
SYS-03Medium	Full URS	Per function	IQ, OQ on high functions	Full matrix	Summary report
SYS-04Low	Short URS	System level	IQ + supplier evidence	Summary trace	Short report

Sizing by risk call is this plan's practice, not a regulatory table. Deviations found in any protocol are recorded, assessed and closed in the report before the system is released for use.

8.Change control and periodic review

Every change to a validated system, including configuration, vendor releases, patches and infrastructure moves, is raised under the change control SOP (QA-SOP-006). The change record names the requirements the change touches; only those are retested, and the trace and report are updated.

Validation documents for each system are version-controlled with an audit trail of revisions (21 CFR 11.10(k)(2)).

Each system is reviewed under the periodic review SOP (QA-SOP-021) at the interval its risk call sets below: open deviations and incidents, changes since the last review, user access against the staff list, backup and restore results, and whether the validated state still holds. The intervals are this plan's choice; Part 11 sets none.

System	Review interval	First review by
SYS-01	12 months (High)	2028-02-26
SYS-02	12 months (High)	2028-04-30
SYS-03	24 months (Medium)	2029-01-29
SYS-04	36 months (Low)	2029-12-18

Intervals by risk call: High 12 months, Medium 24 months, Low 36 months. First review counts from the date the system is validated.

9.Approval

Each signature shows the printed name, the date and time, and the meaning of the signature (21 CFR 11.50).

Signature 01

Role: Validation Lead
Printed name: blank
Meaning: Authorship
Date and time: YYYY-MM-DD hh:mm UTC

Signature 02

Role: QC Laboratory Manager
Printed name: blank
Meaning: Review
Date and time: YYYY-MM-DD hh:mm UTC

Signature 03

Role: Head of Quality
Printed name: blank
Meaning: Approval
Date and time: YYYY-MM-DD hh:mm UTC

QA-VMP-001 v1.0. A printed copy is for reference; check the version in force before use.

Fig. 01

A tabbed validation binder with its fold-out schedule, the shape of a master plan over its system files.

What the rule says

§ 11.10(a): Systems holding Part 11 records are validated for accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
Predicate rules: The records rules the system serves, such as § 211.68(b) for drug CGMP or § 58.130(e) for GLP, carry their own computer controls and are enforced in full.
2003 guidance: FDA asks for a justified, documented risk assessment of each system's potential to affect product quality and safety, and record integrity.
§ 11.10(k)(2): Revision and change control, with an audit trail, for systems documentation.
§ 11.50(a): Each signature on the approved plan shows printed name, date and time, and meaning.
Annex 11, 4.3: EU GMP: an up-to-date inventory of relevant systems and their GMP functionality.
Annex 11, 11: EU GMP: systems are periodically evaluated to confirm they remain in a valid state.

What a validation master plan is

A validation master plan is the one controlled document that says which computerised systems a site validates, how deep the work goes for each, who signs what, and how the systems stay validated after go-live. Each system then gets its own requirements, risk assessment, protocols, trace and report under it.

No FDA rule names a document called a VMP. What the rules ask for is validated systems: Part 11 asks for “validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records” (§ 11.10(a)), and the predicate rules carry their own computer controls. EU GMP Annex 11 § 4.3 asks for “an up to date listing of all relevant systems and their GMP functionality”. A VMP is the usual place a small lab keeps that inventory and shows the work is planned. The computer system validation guide walks the lifecycle the plan sits on.

How to use this template

01Header. Number, version and effective date, and the organisation type. The type rewrites the regulatory basis and the approach wording; tick the EU box if Annex 11 applies too.
02Scope. Classes of systems and records in scope, and what is out with the document that covers it instead. An inspector reads the out-of-scope list first.
03Systems. One block per system: intended use, the GxP records it holds, impact, risk call, owner and a target date. This is the inventory.
04Roles. Roles, not names, so the plan survives a resignation. Put the supplier in: its evidence is part of the work.
05Change and review. Point at your change control and periodic review SOPs and pick a review interval per risk call.
06Sign-off. Author, reviewer and the quality unit's approval, each with the meaning of the signature.

Then copy the plan into your document system or print it for wet-ink signature. If you are unsure whether a system holds Part 11 records at all, run it through the Part 11 applicability checker first.

How the plan sizes the work

The risk call on each system decides what its five documents look like. The table below is our house practice for a small lab, not a regulatory table: FDA's 2003 Part 11 guidance asks for “a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity”, and leaves the sizing to you.

Deliverable	High	Medium	Low
URS	Full URS	Full URS	Short URS
Risk assessment	Per function	Per function	System level
Test protocol	IQ, OQ, PQ scripted	IQ, OQ on high functions	IQ + supplier evidence
Traceability	Full matrix	Full matrix	Summary trace
Report	Summary report	Summary report	Short report

The documents link to their own generators: the URS template for numbered requirements with the Part 11 rows, the IQ OQ PQ template for protocols with expected and actual results, and the traceability matrix template to show every requirement reached a test.

Software type, without the numbers

The inventory records each system's software type with the names ISPE's GAMP 5 (second edition, 2022) uses: infrastructure software, tools and IT services; standard system components; configured components; and custom applications and components. GAMP 5 is industry guidance, not regulation, and ISPE itself says categorisation is not a validation checklist. The GAMP 5 guide explains where it fits.

Device makers: the CSA reading

Choose “Medical device maker” in the header and the plan switches to FDA's computer software assurance guidance for production and quality management system software, final since September 24, 2025 and reissued February 3, 2026. The risk call becomes binary in FDA's words: high process risk where a failure “may result in a quality problem that foreseeably compromises safety”, otherwise not high. The plan maps High to high process risk and Medium and Low to not high.

Testing follows suit: scripted or hybrid for high process risk; unscripted (scenario, error-guessing, exploratory) is allowed where risk is not high. The report becomes an assurance record. CSA supplements FDA's General Principles of Software Validation rather than replacing it, and Part 11 still applies to the records. CSA vs CSV sets the two side by side, and the CSA validation scope planner makes the call feature by feature.

Common misreading

“CSA applies to our drug lab.” FDA wrote CSA for device makers (CDRH and CBER). A drug, biologics or GLP lab may borrow its risk ideas, and the lab version of this plan says so in those words.

Worked example: a four-system QC lab

The pre-filled plan is a small QC lab testing oral solid dose products for release and stability under 21 CFR 211. Four systems, three with Part 11 records. Here is why each got its risk call.

System	Impact, risk	Why	First review by
SYS-01Chromatography data system (6 HPLC)	Direct, High	Results decide batch release; a wrong integration or a lost reprocessing step reaches a patient. High, and the CDS gets scripted IQ, OQ and PQ.	2028-02-26
SYS-02LIMS (vendor-hosted)	Direct, High	Holds the specification check and the CoA approval signature, so its e-signatures fall under §§ 11.50 to 11.300. High.	2028-04-30
SYS-03Temperature monitoring (stability chambers, sample fridges)	Direct, Medium	An undetected excursion can invalidate stability data, but the chamber's own display and a weekly check catch most failures. Medium.	2029-01-29
SYS-04File server and nightly backup	Indirect, Low	Creates no record and makes no decision; it protects copies. Indirect impact and Low, but the restore test is still part of its IQ.	2029-12-18

Twenty documents in all, five per system. The CDS and the LIMS carry most of the effort; the server's set is short. For buying a tool to run this paperwork instead of a shared drive, see the validation software comparison.

Where the rule says so

§ 11.10(a): Validate systems for accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
§ 11.10(k)(2): Revision and change control, with an audit trail, for systems documentation.
§ 211.68(b): Drug CGMP computer controls: authorised changes only, input and output checked for accuracy, a backup file of data.
§ 58.130(e): GLP automated data: the person entering data is identified at input; changes do not obscure the original entry.
§ 820.7 and ISO 13485: Device makers validate production and quality system software under subclauses 4.1.6, 7.5.6 and 7.6.
Annex 11, 4.3: An up-to-date inventory of relevant systems and their GMP functionality.
Annex 11, 10: Changes, including configuration, are made in a controlled manner under a defined procedure.
Annex 11, 11: Systems are periodically evaluated to confirm they remain in a valid state.

Annex 11 is the 2011 text, in operation since 30 June 2011; a revision went to consultation in 2025 and the 2011 text remains the one in force. The Annex 11 guide covers the rest of it.