CSA Decision Center

What decision are you trying to make?

Does this system require validation?

Start with intended use and regulated reliance. Product name, hosting model, and software category do not settle applicability.

Assess the system

Is this system GxP?

Trace the system to a regulated activity, required record, decision, or supporting control. Record unknowns instead of forcing a conclusion.

Screen GxP applicability

Does 21 CFR Part 11 apply?

Confirm the predicate record, electronic reliance, submission pathway, and signature use. Treat Part 11 as a scoped record question, not a software label.

Run the Part 11 screen

How much testing is appropriate?

Set depth by credible failure, determinism, complexity, existing controls, detectability, and the evidence already available for the exact use.

Use the Test Selection Compass

Can supplier testing be leveraged?

Yes, for a defined scope when version, function, environment, results, exceptions, and local differences have been reviewed. A certificate alone is not coverage.

Apply the Evidence Leverage Ladder

Should testing be scripted or unscripted?

Script deterministic, critical control points. Use structured exploratory work where interaction, novelty, or context creates uncertainty that a narrow script may miss.

Select a testing method

Does this spreadsheet require assurance?

Assess the decision supported, formula and data complexity, user control, change exposure, independent checks, and the consequence of an incorrect output.

Use the Spreadsheet Assurance Playbook

How should SaaS be assured?

Separate the supplier platform, local configuration, integrations, data responsibilities, release cadence, and the exact workflows relied upon by your organization.

Use the SaaS Assurance Playbook

How should an AI-enabled tool be assessed?

Define the model’s role and prohibited actions, failure modes, evaluation data, critical misses, human oversight, operating envelope, monitoring, and stop conditions.

Use the AI Assurance Playbook

Does this change require regression testing?

Trace what changed, which shared components and controls are touched, what could regress, and whether existing automated or supplier evidence remains applicable.

Assess release impact

What evidence is needed before release?

Build a traceable argument from intended use through credible failure, controls, requirements, executed evidence, exceptions, residual uncertainty, and approval authority.

Build an assurance strategy

When is periodic review required?

Use risk-based triggers and evidence freshness—not a calendar alone—to decide when the assurance case needs review, renewal, or focused challenge.

Build continued assurance

Still uncertain?

Document the uncertainty instead of forcing certainty.

The CSA Strategy Advisor preserves unknowns, proposes review questions, and shows why a recommendation was made. It does not approve a system or accept residual risk.

Open the CSA Strategy Advisor