How do you validate a LIMS, and what should LIMS validation test scripts cover?

1How LIMS validation works.

A LIMS calculates results, flags those out of specification (OOS) and decides what a reviewer sees, so the rules treat it as part of the laboratory record. 21 CFR 211.68(b) says “Input to and output from the computer or related system of formulas or other records or data shall be checked for accuracy”, and where data such as laboratory calculations are “eliminated by computerization”, “a written record of the program shall be maintained along with appropriate validation data”.¹ Annex 11 says simply: “The application should be validated”.²

What gets validated is your use of the system. FDA’s data integrity Q&A puts it plainly: “If you validate the computer system but you do not validate it for its intended use, you cannot know if your workflow runs correctly.”³ In a LIMS, that use is your specifications, methods, calculations, workflows, roles and certificate templates, which did not exist when the supplier tested. Record them as a configuration baseline: a versioned list of every setting and configured object, so you can show that what runs in production is what you tested.

GAMP 5 (second edition) categorises components, using a whole-system category only to scope supplier assessment, so a LIMS’s configured parts and custom scripts are assessed separately (GAMP 5 software categories).⁴ Risk then sets the depth: a function that decides pass or fail with nothing downstream to catch an error gets robust scripted testing, while a management dashboard may rest on supplier evidence. The method is on risk-based validation, the lifecycle on computer system validation, and timelines on how long a LIMS implementation takes.

2LIMS validation plan template.

Annex 15 allows qualification documents to be combined where appropriate, so a small project can run plan and protocol as one document.⁵ For a LIMS, write these sections:

2.1Cloud and SaaS LIMS.

With a hosted LIMS the supplier runs the platform and may push releases on its own schedule. Annex 11 requires formal agreements setting out each third party’s responsibilities.² The draft adds oversight through service levels and KPIs, documentation “accessible and can be explained from their facility”, an exit strategy that keeps control of your data, and a contract covering “the process for release of new system versions and on the regulated user’s possibility to test these prior to release”.⁶ So record which tenant settings are yours, the release notice you get, a validation tenant that receives each release first, and how you reach the supplier’s evidence during an inspection.

3What LIMS test scripts should cover.

The draft Annex 11 lists what testing should focus on: “access privileges, release of products and results, calculations, audit trails, error handling, handling of alarms and warnings, boundary and negative testing, reports and interfaces, and restore from backup.”⁶ The current Annex 11 asks for test scenarios that consider “system (process) parameter limits, data limits and error handling”.² For a LIMS, that becomes:

Test audit trail review as a workflow: PIC/S expects audit trails assessed for GMP relevance during qualification,¹¹ and MHRA accepts review by validated exception reports, each then a function with its own test cases.¹² Write negative cases for the traps a configuration hides: a blank accepted as zero, a limit compared before rounding, a supplier default left in place. For instrument links, see LIMS instrument integration; for migration, data migration validation.

3.1Extra cases for a contract laboratory or CDMO.

• Client segregation: a user scoped to one client cannot see another client’s samples, results or certificates, and client accounts cannot change data. FDA found customers given an “Analyst” role in a CDMO’s laboratory data system.¹³
• Client specifications and shared configuration: each client’s specifications apply only to its products, and a change to a shared method, calculation or workflow is assessed client by client. FDA expects quality agreements to say how changes to specifications and laboratory records are made.¹⁴

4A LIMS test script template.

Draft Annex 11 wants scripts “described in sufficient detail to ensure a correct and repeatable conduct of test steps and prerequisites”, each traced to a requirement.⁶

Verify installation and configuration before “commencing any test activity”:⁶ a test on a configuration you do not release proves nothing about the one you do.

5Example: a test script for a microbial count calculation.

This example is invented for illustration. A QC laboratory is validating a LIMS before go-live. Requirement URS-031: for the total aerobic microbial count (TAMC) on oral suspension OS-14, the LIMS calculates colony-forming units (cfu) per gram as the mean of the duplicate plate counts, multiplied by the dilution factor and divided by the volume plated in millilitres; reports a mean of zero as less than the detection limit; flags as OOS any result above 200 cfu/g, the maximum acceptable count for the specification’s criterion of 10² cfu/g; and refuses a result with no dilution factor or volume.

That criterion is a configuration trap. The Japanese Pharmacopoeia’s text, harmonised with the European and US pharmacopoeias, sets 10² cfu/g for aqueous oral preparations, reads 10² cfu as a maximum acceptable count of 200, and judges “the average of replicate counts”;¹⁵ the 19th edition of 10 April 2026 keeps this.¹⁶ A limit typed in as 100 would fail compliant batches.

Step 7 failed. The supplier’s template assumed 1 mL pour plates and had no volume term, so a spread-plate result read ten times too low. Deviation DEV-LIMS-009 corrected the formula under change control, releasing baseline CB-08; the five other count methods built from the template were checked, and two were corrected and retested. Version 2 of TS-LIMS-031 passed all eight steps on CB-08, the baseline released for GMP use.

Steps 4 and 5 test the limit from both sides, steps 1 and 2 fail if the criterion is configured as 100, step 2 also tests a fractional mean, and step 3 an empty plate. Found after go-live, the same fault would put every result it touched under review.

6After go-live: changes and periodic review.

Annex 11 wants every change, “including system configurations”, made “in a controlled manner in accordance with a defined procedure”.² Not every change needs new scripts.

The first row rests on reuse: for an identical copy of a configuration already tested, an ISPE article suggests testing only each instance’s parameters,⁴ here the limits, units and decimals, checked “by a second operator or by validated electronic means”.²

7What inspectors cite.

“In addition, your Laboratory Information Management System (LIMS) did not include a dilution factor to calculate the number of cfus per gram or milliliter of product for microbial limit test results, as required by your own procedures and applicable compendial methods.” Reliance Life Sciences, warning letter 320-26-117, 18 August 2026¹⁷

FDA said releasing products “based solely on raw plate count averages entered into your LIMS without applying the required dilution factor” left no evidence each batch met its specification, and asked for a review of every microbial limit result for US products within expiry.¹⁷ The example’s script is the test that catches it.

“Additionally, a similar deficiency was observed in LIMS, in which we found that certain users have the privilege and roles to editing or removing data and system parameters that do not pertain to the scope of their responsibilities.” Immacule Lifesciences, Form FDA 483, 18 September 2025¹³

The investigators confirmed that a LIMS document manager with analyst-level access “was able to make changes to the pH result for a drug product”.¹³ Validation role tests should find that first. When FDA cited Laboratorios Jaloma under 211.68(b) in May 2026, it asked for “A list of all software configurations (both equipment software and laboratory information management system) and versions, details concerning all user privileges, and oversight responsibilities for your computerized systems.”¹⁸ Expect to produce your LIMS configuration baseline and role matrix on request.

8How it runs in Seal.

In Seal’s LIMS, calculations are configured as part of the method with explicit inputs, units and reporting rules, and boundary values, missing inputs, division by zero and rounding are verified whenever a calculation changes. Requirements, specifications, configuration, verification results and approval are kept together and updated with the configuration they describe, so a revised calculation or limit is a reviewed configuration change with its evidence attached.

Seal’s computer system assurance records follow a configured supplier LIMS through supplier review, configuration baseline, automated and manual test cases and release. In its worked example, a supplier default of one decimal place rounded a pH specification of 7.40 ± 0.05 to 7.4 ± 0.1; the automated and manual tests both failed, and the release could not publish until every approved test passed on the version being released. Neil can prepare a validation traceability matrix that keeps mapped tests apart from executed evidence, because a linked but unexecuted test does not satisfy a requirement.