I spent five years inside four of the largest pharmaceutical companies in the world, and every one of them had its own idea of how to do things. Some made millions of pages of paperwork to justify the work. Others made thousands. The FDA passes both.
Compliance is in the eye of the beholder. The page count tells you what the company believes compliance looks like, and that belief is the only thing it measures.
The inspector is a different beholder. FDA’s own FAQ on the Form 483 says observations are made when “conditions or practices observed” point to a problem, and that investigators “are instructed to note only what they saw during the course of the inspection.” Saw. A page gets read when it answers a question the investigator asked. The rest of the binder is for the company.
My estimate from those years, and it is an estimate: people who don’t understand computer system validation do about four times the work of the people who do, and still get 483s, because the 483 is written about their practices.
Both halves have one cause. If you can’t say which requirement a document answers, you can’t tell which document to skip, so you produce all of them. The practice, who reviews the audit trail and when, who holds the login, stays whatever it was. Paper doesn’t change a practice. The shop with the most of it arrives at the inspection with the same practices it had and a longer cart to wheel them in on.
FDA put its own version in writing when it drafted its software assurance guidance in 2022: the burden of validation should be “no more than necessary to address the risk”. The guidance went final in September 2025. The million-page shops wrote their pages before that and will keep writing them after. The guidance was never what they were answering to. They were answering their own doubt about whether they had done enough.
The investigator writes down what they saw. There is no line on the form for the weight of the binder.