Choosing a LIMS for a Growing Biotech QC Lab

Why LIMS Selection Is Different at a Growing Biotech

Biotech LIMS selection starts from a different place than the same decision at a large company. A large pharmaceutical company choosing a LIMS usually replaces something. It has years of specifications, methods, stability protocols, and sample volumes to move, and a team whose job is to run lab systems. A growing biotech often has none of that. The lab may consist of a few analysts, a mix of development and QC work, results arriving from contract labs as PDF certificates, and a shared drive full of spreadsheets. The selection problem is not “which system replaces the old one” but “what does this lab need to become, and when.”

That difference changes almost every part of the decision. Requirements are harder to write because the processes are still forming. Validation resources are thin. The volume that justifies an instrument interface may be a year away. And the regulatory expectations that the system must support are not fixed: they grow as the product moves through clinical development.

The Lab You Have Now Is Not the Lab You Are Buying For

The most common mistake we see is buying for the current lab. A team with twenty samples a week and one HPLC chooses a light tool that handles sample login and result entry, then finds eighteen months later that it cannot manage a stability program with dozens of pull points, specification versions that change between clinical phases, or the audit trail review expectations of a preapproval inspection. The opposite mistake happens too: a company buys an enterprise system configured for a commercial network of labs, then spends a year and most of its validation budget configuring functions nobody will use until after approval.

The better starting point is a plain stage plan. Where will the program be in three years? Will QC release testing stay with a contract lab, move in-house, or split? Will the company file a biologics license application or a new drug application, and roughly when? Will there be a second product? The answers set the requirements more than any feature list does.

How the Regulatory Frame Changes With the Program

The regulatory expectations on the lab change in steps. FDA’s guidance on CGMP for Phase 1 investigational drugs explains that most Phase 1 investigational drugs, including biological drugs, are exempt from 21 CFR Part 211 under 21 CFR 210.2(c). They are still subject to CGMP under the statute, and the guidance sets out what FDA expects for Phase 1 laboratory controls: scientifically sound tests run under written procedures, records of all test results and changes in procedures, calibrated equipment, retained samples, and a stability study during the trial.¹ The same guidance states that Phase 2 and 3 manufacturing remains subject to Parts 210 and 211.¹

In Europe, the Commission’s detailed guidelines on GMP for investigational medicinal products take a similar staged view. They say procedures should be flexible enough to allow for changes as knowledge of the process grows and should be appropriate to the stage of development, while requiring full control and traceability of changes to specifications and instructions.³

At the end of the clinical program comes the preapproval inspection. FDA’s current compliance program for preapproval inspections, issued in June 2026 with an implementation date of August 10, 2026, keeps three primary objectives: readiness for commercial manufacturing, conformance to the application, and a data integrity audit.⁷ For CDER-regulated biological products, a separate program issued in April 2026 lists computerized systems validation, completeness and accuracy of CGMP data, and computerized system access control and audit trail under its data integrity objective.⁸ A LIMS chosen during Phase 2 will very likely be the system inspectors look at during those inspections.

Requirements That Matter at Each Stage

We find it useful to describe three stages. They do not map exactly to clinical phases, because some companies bring testing in-house early and others stay outsourced through approval. What defines each stage is where the testing happens and what the data will be used for.

Stage 1: Early Clinical, Testing Mostly Outsourced

In the first stage, release and stability testing is done by a contract manufacturer or contract testing lab. The biotech’s own lab, if it has one, does development work and perhaps some characterization. The sponsor’s quality team reviews certificates of analysis, approves or rejects batches, and tracks stability results reported by the contract lab.

The regulatory point that matters most here is that outsourcing the testing does not outsource the responsibility. FDA’s guidance on quality agreements puts it directly: “No matter who tests the products, the owners’ quality units are ultimately responsible for ensuring that the products are manufactured in accordance with CGMP.”² The same guidance recommends that quality agreements cover how contract labs communicate all test results to the owner for disposition decisions, who investigates out-of-specification and out-of-trend results, and that electronic records will be stored in accordance with CGMP and be immediately retrievable.²

What does that mean for systems? At this stage, many biotechs do not need a full LIMS. They need a controlled, structured place to hold results received from contract labs, linked to batches and specifications, so the quality team can review trends and make disposition decisions from data rather than from a folder of PDFs. That can be a module of an existing quality system, a light LIMS, or a well-controlled interim approach, depending on volume. The requirements worth writing down are:

• Structured capture of external results against a specification version, not only attachment of a certificate.
• Stability study tracking for the studies the contract lab runs, including pull schedule, time points, and results as they arrive. FDA’s Phase 1 guidance recommends a stability study using representative samples through the clinical trial.¹
• Retained sample records. The Phase 1 guidance recommends retaining samples for at least two years after trial termination or withdrawal of the IND.¹
• A clean export of everything above, because this data will move into whatever system the company adopts next.

The mistake to avoid in Stage 1 is buying a system that will be abandoned at Stage 2 without a plan for its data. Results from early batches and early stability studies often end up in regulatory submissions. The draft consolidated ICH Q1 guideline notes that it does not apply directly during clinical development, but also states that data from development batches meeting its primary stability requirements may be used to support a regulatory submission.⁹ If those results are scattered across systems with no audit trail and no clear version history, someone will spend weeks reconstructing them before a filing.

Stage 2: Late Clinical, Bringing Testing In-House

In the second stage, the company starts running its own QC testing: release testing for clinical batches, raw material testing, in-house stability, perhaps environmental monitoring if it has its own manufacturing. Parts 210 and 211 apply to Phase 2 and 3 manufacturing.¹ This is the stage where most growing biotechs buy their first real LIMS, and where the requirement list gets longer quickly.

Four requirement areas decide whether a LIMS will serve the lab well at this stage.

Specification versioning. Specifications change during clinical development. Acceptance criteria tighten as the company learns more, tests are added or dropped, and methods are revised. The EU guidelines for investigational products expect specifications to be reassessed during development and each new version to allow traceability to the previous one.³ The LIMS must let you hold several effective specification versions at once, tie each batch’s results to the version that applied, and show clearly what changed between versions. Ask vendors to show you this with your own examples. It is where light systems most often fall short.

Stability program management. Under 21 CFR 211.166, the stability testing program must be written and followed, and must cover sample size and test intervals, storage conditions, reliable test methods, and testing in the marketed container-closure system.⁴ In practice, a biotech entering Phase 3 may run registration stability studies on several batches, at several conditions, with many pull points and tests at each. The LIMS should create the pull schedule from a protocol, manage storage locations and sample inventory, generate the testing work at each time point, and report results by batch, condition, and time point. This is one of the heaviest uses of a QC LIMS and deserves the most demo time.

Incoming material testing and status. Section 211.84 requires each lot of components, containers, and closures to be withheld from use until it has been sampled, tested or examined, and released by the quality control unit.⁵ The LIMS needs to hold material and lot records, generate the sampling and testing work on receipt, and record a clear status decision. How that status reaches the warehouse, whether by manual update or by an ERP interface, is a separate question we come back to below.

Out-of-specification handling. FDA’s guidance on investigating OOS results, revised in May 2022, sets out how an OOS result should be investigated, starting with a laboratory investigation.⁶ The LIMS does not run the investigation, which usually belongs in the quality system, but it must flag an OOS result the moment it is entered, prevent a retest result from replacing it without a trace, and keep the original and any retest results linked and visible. Test this directly in the demo: enter a failing result and see what the system does next.

Stage 3: Commercial Readiness

The third stage begins roughly a year before a marketing application is filed and runs through the preapproval or prelicense inspection. The LIMS is now the source of data that will be compared with the application. FDA’s preapproval inspection program tells investigators to compare raw data, such as chromatograms, spectrograms, and analyst notebooks, with the summary data filed in the CMC section, and gives finished product stability, dissolution, content uniformity, and API impurity data as good candidates for this audit.⁷ It names failure to justify not reporting relevant data, such as aberrant results or gaps in a chromatographic sequence, as an example of a data integrity concern.⁷

The biologics program is more specific about computerized systems. Among other checks, it asks investigators to verify that audit trail functions are properly configured, enabled, and locked; that audit trails for critical data are independently reviewed during data review and batch release; that system administrator rights are assigned to people independent of those responsible for the record content; and that backup and restoration of data and metadata, including audit trails, is verified.⁸

The requirements that matter most at Stage 3 are therefore less about new features and more about how the system is set up and run: reviewable audit trails that a QC reviewer can use in a reasonable time, role separation that holds up to scrutiny, reports that tie a filed result back to its raw data, and a tested restore. If the LIMS was chosen well at Stage 2, Stage 3 is mostly configuration, procedure, and practice. If it was not, Stage 3 is when the company discovers it.

Configuration Versus Customization

Every LIMS vendor says its product is configurable. The useful question is what happens to your changes when the vendor releases a new version, and how much validation work each kind of change creates. That is the real difference between configuration and customization.

What the Terms Mean in Practice

GAMP 5 distinguishes configured products from custom applications, and ISPE’s good practice guide on laboratory computerized systems applies that risk-based approach to laboratory computerized systems across their life cycle, from concept to retirement.¹¹ In day-to-day terms, the line runs roughly like this:

• Configuration uses the tools the vendor built for that purpose: defining tests, specifications, sample types, workflows, user roles, and report templates through the application’s own setup screens. The vendor supports it, tests the underlying functions, and carries it forward in upgrades.
• Scripted extensions use a scripting or rules language the vendor provides to add logic the standard setup cannot express, such as an unusual calculation or a custom status rule. The vendor supports the language but not your script.
• Custom code changes the product itself or builds separate software around it: modified database objects, bespoke interfaces, or code the vendor has never seen. Nobody but you tests it, and it may break with every upgrade.

Where Customization Enters Without Anyone Deciding It

Few biotechs set out to customize their LIMS. It happens one reasonable request at a time. An analyst wants a calculation to match the spreadsheet the lab used for years. A quality reviewer wants a certificate of analysis in exactly the format a partner asked for. A scientist wants a status that does not exist in the standard workflow. Each change is small, and each is added under time pressure during implementation. Two years later the system has forty scripts, three custom reports that break on upgrade, and an interface nobody on staff understands.

For a growing company this matters more than for a large one, for three reasons. The team is small, so the person who wrote a script is often gone by the time it breaks. Validation resources are thin, so every script adds testing that competes with other work. And many LIMS products aimed at smaller labs are now offered as software as a service, where the vendor upgrades on its own schedule. Customization that a large company can manage with a dedicated team becomes a standing risk for a company with one lab systems lead.

A Simple Rule for Deciding

We suggest a short rule that implementation teams can apply without a meeting each time. Before anything moves beyond standard configuration, the requester answers three questions in writing. What requirement does this meet, and is it regulatory, scientific, or preference? What would the lab do if the change were not made? Who will own the change after go-live? If the answer to the first is preference and the answer to the second is “a slightly different procedure,” the lab changes the procedure. Everything that passes goes into a customization register with an owner, and the register is reviewed before each major vendor release.

That register is also one of the most useful documents to show a future inspector or acquirer, because it answers the question every reviewer eventually asks: what in this system is not standard, and why?

Validation Effort: What Drives It and How to Keep It Proportionate

Validation is where growing biotechs most often misjudge the effort of a LIMS project. Some teams plan as if validation were a documentation exercise at the end. Others copy a large company’s protocol set and produce hundreds of scripted test cases for functions that carry little risk. Both approaches take longer than they need to, and the second one often misses the functions that matter most.

Risk-Based Assurance Applied to a LIMS

The industry has moved toward risk-based assurance. ISPE’s article on computer software assurance and critical thinking describes an approach that starts with understanding intended use and risk, puts the most testing effort on functions that affect product quality and patient safety, uses unscripted and exploratory testing for lower-risk functions, and relies on supplier assessments to avoid repeating testing the vendor has already done.¹² FDA finalized its own Computer Software Assurance guidance for device production and quality system software in September 2025, and although it was written for devices, the same risk-based thinking is now common in pharmaceutical and biotech validation practice.

For a LIMS, applying this approach means separating functions into a few groups and testing each group in proportion to its effect on a batch decision.

Where the Testing Effort Belongs

Using Supplier Evidence

A well-run vendor has already tested its standard functions many times. The point of a supplier assessment is to decide how much of that testing you can rely on, so your team tests your configuration and your intended use rather than retesting the product. That requires real evidence: the vendor’s quality system, its release testing records, how it handles defects, and how it notifies customers of changes. A vendor that offers a validation package is helpful, but the package should be read as input to your own risk assessment, not as a substitute for it. The package cannot know your specifications, your roles, or your calculations.

One practical point for Stage 2 companies: the heaviest validation burden often comes from data migration, not from the software. If the lab moves specifications, methods, and stability data from spreadsheets or a light system, every migrated record has to be checked, and the migration approach itself needs testing. Plan it as its own workstream with its own risk assessment, and decide early which historical data will be migrated, which will be archived in a readable form, and which will stay where it is.

Instrument Integration Without an Endless Interface Backlog

Connecting instruments to the LIMS removes manual transcription, which is a well-known source of lab data errors. It also creates interfaces that must be built, validated, and maintained. A growing lab should connect instruments in order of the transcription risk they remove, not in order of how easy or impressive they are.

Which Instruments to Connect First

A useful order for most small QC labs is:

1. Balances and pH meters. High volume, simple data, frequent manual entry, and results that feed calculations. Direct capture removes a large share of transcription steps for a modest effort.
2. The chromatography data system. Chromatography usually produces the results that matter most for release and stability. The integration question here is less about moving numbers and more about which system is the record, discussed below.
3. Plate readers and other instruments with structured exports. Common in biologics labs for potency and impurity assays, often with vendor software that can export results in a predictable format.
4. Everything else, as volume justifies it. An instrument used a few times a month may be better served by a controlled manual entry with second-person verification than by an interface that needs revalidation every time the instrument software changes.

Standards Help, Within Limits

The lack of common interfaces is the main reason instrument integration takes as long as it does. An ISPE article from February 2026 on laboratory automation standards notes that most vendor-provided instrument interfaces are proprietary, which forces integrators to build custom software around each one, and argues for adoption of SiLA 2, OPC UA LADS, and Allotrope data formats to make instruments and software work together without bespoke connectors.¹³ A peer-reviewed report in Engineering in Life Sciences describes a biotechnology lab infrastructure in which new and legacy devices connect through the SiLA 2 standard to a central lab server that records every measurement, task, and result.¹⁴

For a buyer, the practical point is to ask each LIMS vendor which of these standards it supports today, in production, at customer sites, and which are on a roadmap. Support on a roadmap does not help a lab going live next year. Also ask which of your specific instrument models already have tested connectors, and who maintains them when the instrument vendor releases new software.

The Chromatography Question: Which System Holds the Record

Chromatography deserves its own decision. The chromatography data system holds the raw data: injections, integration events, processing methods, and the audit trail of reprocessing. The LIMS holds the reportable result and the batch decision. FDA’s preapproval inspection program directs investigators to compare raw data such as chromatograms with the summary data in the application, and to look for unexplained gaps in chromatographic sequences.⁷

That means the link between a LIMS result and its chromatographic raw data must be traceable in both directions. Whether results flow automatically or are entered with verification, the lab should be able to start from a filed result, find the LIMS record, and open the exact injection sequence behind it, including any reprocessing. Test this during selection with a mock stability result. If the path takes a specialist half a day to reconstruct, it will take longer during an inspection.

ERP Integration and the Question of Timing

Many growing biotechs do not have an ERP system when they choose their first LIMS. Some have a financial system with basic inventory. Others rely entirely on their contract manufacturer’s systems. This makes ERP integration a timing question more than a technical one.

What Crosses the Boundary

When both systems exist, the information that typically moves between ERP and LIMS is limited and predictable:

• From ERP to LIMS: material master data, lot or batch numbers, receipt events that should create sampling and testing work, and sometimes production orders that trigger in-process or release testing.
• From LIMS to ERP: the quality status decision for a lot (released, rejected, on hold), and sometimes retest or expiry dates.

The status decision is the part with regulatory consequences. Section 211.84 requires components to be withheld from use until the quality control unit releases them.⁵ If the warehouse works from ERP status, the ERP status must reflect the quality decision accurately and promptly, and nobody outside the quality unit should be able to change it. Whether that is enforced by an interface or by a controlled manual step matters less than whether it is enforced.

Where LIMS Fits in the Wider Architecture

The ISA-95 standard, which describes how business systems and manufacturing operations systems should exchange information, separates business planning and logistics systems such as ERP at Level 4 from manufacturing operations management systems at Level 3, and focuses on the interface between those two levels.¹⁵ In that model, a LIMS generally belongs with the operations systems at Level 3, alongside MES. The value of this framing for a small company is that it keeps each system’s job clear: ERP owns inventory, orders, and finance; LIMS owns samples, tests, results, and the quality decision on them. Trouble starts when both systems try to own the same data, such as material specifications maintained in two places.

When to Build the Interface

Our advice to most Stage 1 and early Stage 2 companies is to choose a LIMS that can integrate with ERP, confirm that the vendor has done it with the ERP products you are likely to adopt, and then not build the interface until transaction volume justifies it. A controlled manual status update with second-person verification is acceptable at low volumes, and it avoids building and validating an interface against an ERP configuration that will change as the company grows. The time to build it is when the manual step is producing errors or delays, or when commercial supply planning begins to depend on timely release status.

Questions to Ask Vendors

Vendor demonstrations are designed to show a product at its best. The questions below are meant to show how it behaves in the situations a growing biotech will meet. For each, we note what a good answer looks like. None of them favors a particular product, and several will produce uncomfortable pauses from any vendor, which is the point.

About the Product

About Validation and Change

• What evidence of your own testing will you share, and in what form? Can we audit you?
• How often do major releases occur, how much notice do customers get, and is a validation environment available before a release reaches production?
• What does your release note tell us about changes to functions we rely on, such as calculations, audit trail, and electronic signatures?
• How do your customers of our size typically divide validation work between your team, a partner, and their own staff?

About the Company, Support, and Exit

• How many customers of our size and modality run your product in GMP QC, and can we speak to two of them without a sales representative present?
• Who will implement our system: your staff, a partner, or a subcontractor? Can we meet the people, not the practice lead?
• If we leave, what do we receive: data only, or data with audit trails and metadata in a documented, readable format? What does that cost, and is it in the contract?
• How is pricing structured as we grow from ten users to fifty, and from one site to two?

The exit question is the one growing companies skip most often, and the one that matters most if the company is acquired. An acquirer’s diligence team will ask how the QC data can be moved or retained. The FDA quality agreements guidance expects electronic records to be immediately retrievable for the required retention periods,² and that expectation does not end when a software contract does.

A Selection Process Sized for a Growing Biotech

Large companies run LIMS selections over many months with long requirement documents and formal scoring by committees. A growing biotech needs the same discipline in a shorter form. We suggest a process of six steps that a small team can complete in roughly a quarter, alongside other work.

Who Should Be in the Room

The selection team should include the QC lead who will own the system, at least one analyst who will use it daily, a quality assurance representative who will review data and approve results, and whoever is responsible for computerized system validation, whether internal or a consultant. IT belongs in the room for security, identity, and hosting questions, but at a growing biotech the decision should be led by the lab and quality, because they will live with its consequences. Finance should see the pricing model early, particularly how it changes with users and sites.

Common Traps

Beyond the points already covered, three traps come up often enough to name. The first is scoring features that the vendor showed but you did not ask for, which rewards the best demo rather than the best fit. The second is treating the implementation partner as an afterthought; for a small company, the partner’s experience with your modality often matters as much as the product. The third is setting a go-live date from a funding milestone rather than from the work, which usually leads to compressed validation and a long list of items deferred to “phase two” that never arrives.

Conclusion

Choosing a LIMS at a growing biotech is less about finding the product with the most functions and more about matching the system to the path the company is on. Early on, the priority is structured, retrievable data from contract labs and a clean way to carry it forward. As testing moves in-house, specification versioning, stability management, material status, and OOS handling decide whether the system works. By the time an inspection approaches, what matters is how the system is configured and run: audit trails that are reviewed, roles that are separated, and filed results that trace back to raw data. Keeping close to standard configuration, putting validation effort where batch decisions are made, and building integrations only when volume justifies them keeps the system manageable for a small team as it grows.

Sakara Digital works with pharma and biotech organizations planning and selecting lab and quality systems at each stage of growth. If you are preparing to bring QC testing in-house, or want an independent view on whether your current LIMS plan will hold up at inspection, we are happy to have that conversation.

For Further Reading