LIMS in pharmaceutical industry: a guide for Indian QC labs

What does a LIMS do in a pharmaceutical QC lab?

Schedule M describes quality control as the part of GMP concerned with sampling, specifications and testing, and with the records that make sure materials are not released for use, nor products for sale, until their quality has been judged compliant (Part I, 19.1). A LIMS keeps that work in one system.

WHO's guideline for QC laboratories asks for a data management system that ensures traceability. It can be paper based or software based, and WHO names a LIMS as an example. Access to stored electronic data must be restricted to authorised people (TRS 1052, Annex 4, 3.25).

The table follows one sample through the lab. Clause numbers are from Part I of revised Schedule M unless marked otherwise.

A QC lab also manages things that are not samples. These include reference and working standards (section 15), reagents and volumetric solutions (14.37 and 14.38), instruments and their calibration (13.5, 17.3.10.16 and 17.3.10.17), and the stability programme (19.9). A LIMS that handles only samples leaves all of these on paper.

Why one system helps at product quality review

Every year, Schedule M's product quality review must cover all batches that failed specification and their investigations, changes to analytical methods, and stability results with any adverse trends (Part I, 2.3.2). When results, OOS files and stability data sit in separate registers and spreadsheets, someone has to assemble that review by hand.

Which rules shape a pharma LIMS in India?

Revised Schedule M

G.S.R. 922(E), dated 28 December 2023, replaced Schedule M of the Drugs Rules, 1945. A corrigendum, G.S.R. 666(E) of 25 October 2024, named these rules the Drugs (Second Amendment) Rules, 2023. Three sections of Part I matter most for a LIMS: section 17 on documentation, section 19 on QC, which the table above covers, and section 20 on computerised systems.

Clause 17.2.8 allows records to be kept by electronic data processing, on conditions. Only authorised persons may enter or modify data, and there must be a record of changes and deletions. Access is restricted by passwords or other means, and the entry of critical data is independently checked. Electronic records are backed up, and the data stays readily available for the whole retention period.

Section 20 then sets the rules for every GMP computerised system, including a LIMS:

Part XII, for API manufacturers, repeats these rules in clause 5.4. It adds that electronic signatures, if used, must be authenticated and secure (6.1.9). Its list of laboratory control records includes a complete record of all raw data with graphs, charts and spectra, every calculation, and the signature of a second person who reviewed the original records (6.6.1).

When did revised Schedule M come into force?

• Large manufacturers (turnover above ₹250 crore): six months from publication (rule 6 of G.S.R. 922(E)).
• Small and medium manufacturers (turnover of ₹250 crore or less): twelve months from publication.
• The 2025 extension: G.S.R. 127(E) of 11 February 2025 let small and medium manufacturers with turnover below ₹250 crore apply in Form A, within three months, with an upgrade plan. For them, the deadline moved to 31 December 2025. Form A asked for a gap analysis that included lab equipment and documentation.

All of these dates have passed. We found no later extension on CDSCO's gazette notifications page when we checked in October 2026.

If you supply the US: 21 CFR Part 11 and FDA's data integrity guidance

Part 11 sets the criteria under which FDA treats electronic records and signatures as trustworthy and equivalent to paper (11.1). For a LIMS, the key controls in 11.10 are:

• validation of the system, including the ability to detect invalid or altered records (a);
• accurate and complete copies, in human-readable and electronic form, for inspection (b);
• access limited to authorised individuals (d);
• secure, computer-generated, time-stamped audit trails that record entries and actions which create, modify or delete records, without obscuring what was recorded before, kept as long as the records themselves (e);
• authority checks, so only authorised people can sign, alter a record or perform an operation (g).

A signed electronic record must show the signer's printed name, the date and time, and the meaning of the signature, such as review or approval (11.50). The signature must be linked to its record so it cannot be copied to another one (11.70). Each electronic signature belongs to one person only (11.100). A signature not based on biometrics uses at least two components, such as an ID and a password (11.200).

FDA's guidance "Data Integrity and Compliance With Drug CGMP" (December 2018) answers questions that come up in every QC lab:

• Data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate: ALCOA (question 1a).
• An audit trail lets you reconstruct the creation, modification or deletion of a record. FDA's example: an HPLC run's audit trail should show the user, the date and time, the integration parameters and any reprocessing (1c).
• Shared logins do not meet the CGMP rules, because actions cannot be traced to one person (5).
• Whoever reviews a record also reviews its audit trail. Where the rules fix the timing, such as before batch release, the audit trail is reviewed at the same time (7 and 8).
• Writing data on scraps of paper and copying it to a notebook later is not acceptable. A LIMS can be designed to save after each entry (12).
• A result can be invalidated only with a documented, scientifically sound justification, and the original data stays in the record (2).
• Each workflow needs validating for its intended use, not just the system (3).

If you supply Europe: EU GMP Annex 11

Annex 11 (revision 1, in operation since 30 June 2011) is still the version on the European Commission's EudraLex Volume 4 page. A revision of Annex 11 and Chapter 4, with a new Annex 22 on artificial intelligence, went to public consultation from 7 July to 7 October 2025. Points from the current text that matter for a custom LIMS:

• User requirements should describe the required functions, be based on a documented risk assessment, and be traceable through the life cycle (4.4).
• For bespoke or customised systems, there should be a process for formal assessment and reporting of quality and performance measures at every life-cycle stage (4.6).
• Formal agreements must exist with third parties that provide, configure, validate or maintain the system (3.1).
• If data moves from an old system, validation checks that values and meaning are not altered (4.8).
• The audit trail records GMP-relevant changes and deletions, the reason for each is documented, and audit trails are regularly reviewed (9).
• Electronic signatures are permanently linked to their record and include the time and date (14).

What do WHO and PIC/S add?

WHO's Guideline on data integrity (TRS 1033, Annex 4, 2021) says:

• audit trails should be enabled when the software is installed and stay enabled at all times (11.11);
• shared logins or generic user access should not be used (11.9);
• system administrators should be few, without a conflict of interest in the data, and their activity should be logged (11.8);
• an inserted image of a signature is not adequate unless it was created as part of a validated electronic signature process (11.14);
• backups should be restored periodically to check them (11.19);
• the routine review of data includes audit trails (12.3).

WHO's good practices for pharmaceutical QC laboratories were revised in 2024 (TRS 1052, Annex 4), updating the 2010 text in TRS 957, Annex 1. The revision names the LIMS directly:

• an SOP should describe how the LIMS or other recording system is used, its access rules, and the frequency and type of backup, in the cloud or on another server, including restoring data (3.30);
• electronic forms made in software such as Microsoft Excel should be validated (3.35);
• when a LIMS is hosted off site, the lab should confirm that the host meets the guideline's requirements (3.36);
• the analytical worksheet can be kept in an electronic system such as a LIMS (6.33);
• the number, nature and root causes of OOS results should be reviewed at management review (6.83);
• a certificate of analysis contains the same information as the analytical test report (6.89).

PIC/S PI 041-1 (1 July 2021) discourages hybrid systems, where part of a record is on paper and part is electronic, and says they should be replaced whenever possible (9.10).

What does ALCOA+ mean?

ALCOA+ is a set of nine attributes for good data. WHO defines it as attributable, legible, contemporaneous, original and accurate, with added emphasis on complete, consistent, enduring and available (TRS 1033, Annex 4, glossary). PIC/S explains each attribute in PI 041-1, section 7.5.

Which pharmacopoeias does a pharma LIMS need to handle?

Indian labs test against the Indian Pharmacopoeia (IP) and, where a market or a customer asks for them, the USP–NF, the British Pharmacopoeia (BP) and the European Pharmacopoeia (Ph. Eur.). The current IP is IP 2026, the 10th edition, released on 2 January 2026 with 3,340 monographs. The Indian Pharmacopoeia Commission (IPC) has since issued amendment lists.

Schedule M requires pharmacopoeias, reference standards and reference spectra to be available in the QC lab (17.3.2.5), and IP reference standards to be obtained from the IPC (15.2). It also notes that specifications may need periodic revision to keep up with new editions of the IP or other official pharmacopoeias (17.3.2.4). In a LIMS, that means specifications need version control: when a monograph changes, the old version stays linked to the results that were tested against it.

Which features should a pharma LIMS have?

Take this checklist to every demo, and ask to see each item working on screen. Clause numbers are from revised Schedule M, Part I, unless marked otherwise.

On OOS, FDA's guidance "Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production" (Revision 1, May 2022) describes a Phase I laboratory investigation and, when no clear laboratory error is found, a Phase II full-scale investigation. It notes that much of the guidance may be useful for out-of-trend results too. WHO's data integrity guideline also expects OOS, out-of-trend and atypical results to be investigated under written procedures (TRS 1033, Annex 4, Appendix 1, example 4).

On stability, store pull points as data in each protocol rather than fixed in the software. ICH is consolidating its stability guidelines, Q1A to Q1F and Q5C, into a single Q1 guideline, which was released as a Step 2 draft in April 2025.

Ready-made or custom LIMS: which suits an Indian pharma lab?

A ready-made LIMS is a product you configure. A custom LIMS is built for your lab from your SOPs and URS. Both can work in a GMP lab. The differences are in fit, validation effort and who controls changes.

GAMP 5 (second edition) groups software components from infrastructure and standard components through configured components to custom applications. An ISPE article on the second edition stresses that these categories are a continuum, not a validation checklist. Validation effort is scaled to the system's GxP impact, complexity and novelty. In plain terms, custom code needs more testing because it is new, so choose a developer who documents and tests their work.

Whichever route you take, ask three questions before you sign: who holds the source code, how changes are handled after go-live, and what documentation you get for validation. For cost drivers such as licences, hosting and support, see our guide to LIMS software price in India.

How does a custom LIMS project work, step by step?

The order below follows the life-cycle ideas in Annex 11 and GAMP 5. GAMP 5's second edition supports iterative and incremental development, so the system can be built and shown to you in stages rather than in one release at the end.

How long this takes depends on how many sample types, tests and formats your lab has, and how quickly the URS and design are approved. Ask any developer for a plan with dates for each step, not a single go-live date.

What does validation (CSV) involve, and who does it?

Computerised system validation (CSV) is documented evidence that the LIMS does what your URS says, reliably, in your lab. Your lab's QA owns it. Schedule M places the duty on the manufacturer, whose GMP computerised systems must be validated (20.1). WHO's QC lab guideline expects a validation master plan, and a validation report verified by the quality manager and approved by the laboratory director, or by people they designate (TRS 1052, Annex 4, 3.30). Annex 11 asks the regulated user to make sure the system was developed under an appropriate quality management system, and to assess the supplier (4.5).

Validation usually covers:

• a validation plan with roles, scope and acceptance criteria;
• the URS and the risk assessment behind it;
• an assessment of the supplier;
• installation and operational qualification of hardware and software (Schedule M 20.2);
• testing of each requirement, with each test traceable to a requirement in the URS (Annex 11, 4.4);
• a validation report that releases the system for use;
• after go-live, change control, incident records, backup and restore checks, and periodic review to keep it validated (Schedule M 20.7 to 20.9; Annex 11, clause 11).

FDA's data integrity guidance gives a useful warning (question 3). Qualifying a platform shows the platform meets its specifications. It does not show that a particular workflow calculates correctly. For a LIMS, this means checking your actual worksheets: an assay calculated by the system should match the same calculation done by hand, with the same rounding.

GAMP 5 (second edition) encourages regulated companies to make full use of their suppliers' knowledge, experience and documentation. In practice, the developer supplies system documentation and test records, fixes what QA finds, and keeps later changes under change control. The decisions and the approval stay with your QA.

Where pharma labs lose time without a LIMS

None of these problems looks serious on the day it happens. They build up over months and come to light at an inspection or a customer audit.

Retyping from instrument printouts. A balance or pH meter printout is stapled to the worksheet. The values are written into the worksheet, then into a logbook, then into a register, and each copy needs a second person to check it. FDA's guidance accepts the printout as the original record for simple instruments like these, which must then be kept. For instruments such as FT-IR, the electronic file is the original and a printout is not enough (question 10). Values noted on a rough sheet and copied later are not acceptable at all (question 12).

Stability pull dates missed. Pull dates live in a spreadsheet or on a wall chart. When a pull is missed, the gap shows up in the stability data, and that data feeds expiry dates and the annual product quality review (Schedule M 19.9 and 2.3.2).

OOS investigations on paper. Each OOS sits in its own file. WHO expects the number, nature and root causes of OOS results to be reviewed together at management review (TRS 1052, 6.83). With paper files, building that trend means reading every file again.

CoAs typed in Word. Results are retyped from the worksheet into a Word CoA, and a scanned signature is pasted at the bottom. A typing slip goes out to the customer with the batch. WHO's data integrity guideline says an inserted image of a signature is not adequate unless it was created as part of a validated electronic signature process (TRS 1033, 11.14).

Audit-trail gaps found in inspections. Shared logins on instrument PCs, audit trails switched off, and Excel sheets where anyone can edit a formula. Among the possible causes of rising data integrity observations, WHO's guideline lists computerised systems that cannot meet regulatory requirements, or are not properly managed and validated (TRS 1033, 1.1). FDA notes that data integrity violations have led to warning letters, import alerts and consent decrees.

Expired solutions and overdue instruments. A volumetric solution past its re-standardisation date, or a balance past its calibration date, gets used because nothing stops it. Every result produced with it then has to be looked at again.

For the wider cost of running a lab on spreadsheets, see the hidden cost of Excel in labs.