A 14-month validation cycle
A publicly listed European pharmaceutical company began modernizing an Oracle Forms quality management system in January 2024. The technical migration finished in November 2024. The Computer System Validation (CSV) cycle finished in January 2026. The validation took longer than the build.
This is the defining feature of pharma modernization. The code is the easy part.
What GxP actually requires
Good Practice (GxP) regulations cover any system that touches drug development, manufacturing, distribution, or pharmacovigilance. In the US, that’s FDA 21 CFR Part 11 for electronic records and signatures, plus the predicate rules in Parts 210, 211, and 820. In Europe, EU Annex 11 covers computerised systems used in GMP environments.
The common thread: any system that produces or stores GxP-relevant data must be validated, controlled, and auditable across its full lifecycle.
The four validation deliverables
CSV produces four primary documents: User Requirements Specification (URS), Functional Specification (FS), Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ). Plus a traceability matrix linking each requirement to each test.
For an Oracle Forms application with 200 to 400 screens, the validation package typically runs 3,000 to 8,000 pages. Most of that is test evidence: screenshots, test scripts, signed approvals.
Why Oracle Forms applications stayed validated
The reason pharma kept Oracle Forms running long past its expiration date is straightforward: the existing systems were already validated. Replacing them means revalidating everything. The cost of change is measured against the cost of doing nothing, and doing nothing is often cheaper for another year.
Until it isn’t. Oracle Forms 6i is unsupported. Forms 11g extended support is winding down. The talent pool is shrinking. At some point the risk of staying outweighs the cost of moving.
Descriptor-driven generation collapses the validation cycle
The validation work that consumes 14 months on a hand-written modernization can compress dramatically when the application is generated from a JSON descriptor. The reason is that validation maps cleanly onto the descriptor.
The URS describes what the system should do. The descriptor encodes those requirements in a machine-readable form. The generator produces the implementation. The traceability matrix becomes a query, not a manual mapping exercise. Test scripts can be generated from the same descriptor that produced the code.
We’ve seen pharma teams cut CSV cycle time from 14 months to 5 by treating the descriptor as the validation artifact.
Electronic signatures and audit trails
Part 11 requires electronic signatures that are unique, attributable, and tamper-evident. It requires audit trails that record every change to electronic records. These are well-understood requirements, but they’re easy to implement inconsistently across a large application.
A generated system implements them once, at the framework level. Every screen inherits the same signature workflow, the same audit trail format, the same retention policy. The validation team reviews the framework, not 280 separate implementations.
Data integrity and ALCOA+
ALCOA+ — Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available — is the data integrity standard regulators apply to GxP systems. The principles are straightforward. Implementing them across a legacy Oracle Forms application that grew over 20 years is not.
The migration is the rare opportunity to bring a system into ALCOA+ compliance without a separate remediation project. The new architecture can enforce timestamping, user attribution, and immutability from day one.
The validation team is the customer
In pharma modernization, the validation team has veto power over the technical team. Migration plans that don’t involve QA and validation from the first week run into resistance later. The engineering team builds something. The validation team rejects it because the documentation isn’t in the right format. The cycle repeats.
The successful pharma migrations we’ve worked on bring the validation lead into the architecture conversation before any code is generated. The descriptor format gets reviewed for validation-friendliness up front.
The bottom line
Pharma modernization isn’t a technology problem. It’s a validation problem with a technology component. The migrations that succeed treat CSV deliverables as primary artifacts and use code generation specifically to compress the validation cycle. The technology savings are real. The validation savings are larger.