Validating your monitoring system, in three clear parts

Not once you have assessed Sematics and accepted its evidence. Sematics validates the platform and verifies each release according to its risk. You assess Sematics, approve your reliance on that evidence for the functions you use, and qualify what Sematics can't: your requirements, your configuration, notification to your people, your hardware and your procedures. You stay accountable for your use of the system, as Annex 11 expects.

As a continuous, risk-based lifecycle aligned to EU GMP Annex 11, applying the stricter July 2025 consultation draft where it asks more. Risk is assessed following ICH Q9(R1) and the risk-based approach of GAMP 5, function by function. Requirements trace through the functional design and the platform specification to the tests and their results. Each release is the unit of evidence: every test suite runs on an environment built from it, results are sealed so any later change would show, and the programme includes a verification report for each release, reviewed by people who didn't do the work, and a validation summary; ask us for the current status and the latest approved documents under the quality and technical agreement. See Annex 11, clause by clause.

Each release is assessed and verified by Sematics according to its risk. Minor releases, which don't change validated behaviour, are deployed with release notes afterwards. Major releases are notified in advance with the release documentation and a configuration regression report run against your current configuration export. Urgent fixes are verified too, and documented to you after deployment. You assess each release under your change control and check the system after deployment.

Not usually. Routine changes (user accounts, names) are recorded in the audit trail. A change to who is notified is also followed by an end-to-end alarm test, as our alarm testing position recommends. Changes within the qualified design (a limit or delay within your URS bounds, another escalation tier) are made with a reason and approved as your procedure requires. Only a change to the design, such as a new site or limits outside your URS, goes through change control with the affected DQ and PQ tests.

It is handled as a deviation. The programme is designed so a failed test on a critical function raises one automatically. Each deviation is contained, assessed for its effect on each customer's records, notifications and reports, and affected customers are told. Records are never altered to correct an error: a supplementary record states the correction. The root cause is found, corrective and preventive action agreed, and its effectiveness checked before the deviation is closed.

Every user has a named account with two-factor login on by default (a company-wide setting to enforce it is being added), permissions follow roles by company, site, zone and asset, and no customer can see another's data, which is tested. Data is encrypted in transit, backups are encrypted at rest, administrative access is limited and reviewed, and the programme includes backups to a second location, restore tests and defined recovery objectives; ask us for the current status of each. Your part is alternative monitoring during any downtime.

Staff at Sematics, JTF and other partners are trained for their roles before doing the work, with checks of understanding and refreshers. The programme provides for internal audits by people independent of the work, a management review of releases, deviations, security, supplier performance and training, assessment and oversight of every supplier the platform relies on, and a periodic review of the validated state at least once a year; ask us for the current status. Under the QTA you can audit Sematics too.

Partly. JTF validates the monitoring system it supplies: the Sematics platform, through Sematics, and the JTF hardware, through IQ and OQ at your site, and we support your qualification of its configuration and use. For your fridges, freezers and cold rooms, our temperature mapping service gives you the temperature distribution evidence their qualification needs (usually part of OQ and PQ). Approving that qualification, and validating your processes, stays under your own validation plan.