CSVtoCSAPractical Software Assurance
SearchSubscribe
Menu

Fictional worked example · CSVtoCSA editorial

SaaS Release Assessment

One release, three changes, and three different evidence decisions for presentation, workflow, and signature behavior.

Published 12 September 2026 · Context updated 21 September 2026 · Version 2.0

All organizations, identifiers, test results and decisions in this example are fictional teaching material.

Information available and assumptions

Local CAPA routing and signature meanings are defined and representative legacy records are available. The same supplier release affects functions with different consequences.

Scope and decision record

Standard case study record

Scope and decision fields

Read these fields before the detailed worked case. All organizations, identifiers, test outcomes, and decisions are fictional teaching material.

GxP Assessment
The SaaS eQMS supports controlled CAPA records and electronic approvals. Release impact differs for presentation-only change, configured routing logic, and electronic-signature association.
Change or Issue
One supplier release includes a dashboard color change, a CAPA-routing engine change, and an exported electronic-signature change.
Functions Affected
  • Dashboard status presentation
  • CAPA approval routing
  • Electronic-signature display and record association
Potential Impact
The dashboard change has low direct GxP impact; routing could bypass approval; signature change could misrepresent who approved which record revision.
Deviations / Known Issues
No dashboard deviation occurs. A legacy blank site value bypasses routing and the export initially omits signature meaning in the fictional execution; both require correction and retest.
In this example

Situation

A multi-tenant eQMS release changes dashboard colors, the CAPA-routing engine, and the signature block used in exported approved records.

Intended Use

Users create, investigate, route, approve, sign, retain, retrieve, and export controlled CAPA records. The dashboard supports prioritization; the workflow and signed export preserve required approval meaning.

Failure Scenarios

The color change could make status harder to distinguish. The routing change could bypass Quality approval for a legacy blank site value. The export change could omit signature meaning or associate the signature with the wrong revision.

Existing Controls and Evidence

The supplier provides release notes, known defects, automated regression results for the standard platform, and rollback information. The customer maintains a configuration inventory, local workflow specification, representative open records, monitoring, and prior protocol results.

Testing Approach

Perform an accessibility and usability confirmation for the dashboard rather than broad regression. Script each material CAPA routing branch, unauthorized transitions, open-record state, and legacy data condition. Script signer identity, meaning, time, record association, revision, accurate copy, and export retrieval. Explore interruption and concurrent-review paths around the critical controls.

Deviations and Validation Conclusion

The dashboard check passes. The fictional blank site value bypasses routing and the first export omits signature meaning. Release is restricted until both are corrected and targeted retest passes. One release does not require one uniform regression scope.

Reassessment Criteria

Reassess shared-service changes, new workflow configuration, identity or signature changes, supplier incidents, monitoring signals, or undocumented behavior.

Limitations and unresolved questions

Dashboard success does not cover routing or exported signatures. Restricted functions remain unavailable until correction and appropriate retesting support their use.

Relevant regulations and guidance

These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.

Computer Software Assurance for Production and Quality Management System Software ↗

Regulatory guidance / GMP guideline · United States · February 2026

Scope: Medical-device manufacturers assuring software used in production or their quality management system.

Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.

Status: Final / published · Checked 2026-09-21

Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.

Read source details and applicability →

EudraLex Volume 4, Annex 11 — Computerised Systems ↗

Regulatory guidance / GMP guideline · European Union · January 2011 revision

Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.

Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.

Status: Final / published · Checked 2026-09-21

The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.

Read source details and applicability →
Was this useful? Leave feedback

Was this resource useful?

Tell us what helped and what could be clearer. Usefulness feedback does not establish technical validity or regulatory compliance.

Loading contribution options…

Questions and moderated discussion

Questions and discussion

What additional information would you need before making this decision?

Loading contribution options…

Suggest a correction

Sent privately to the editorial moderation queue. Your account email and correction are not published as a comment. Do not include confidential or personal information.

Resource: SaaS Release Assessment

Loading sign-in status…

Correction details