CSV and CSA Guidance

Find the guide, tool, or worked example that addresses the validation question.

Complete a GxP Assessment Plan requirements and tests

Does this system require validation?

Start with intended use and regulated reliance. Product name, hosting model, and software category do not settle applicability.

Assess the system

Is this system GxP?

Trace the system to a regulated activity, required record, decision, or supporting control. Record unknowns instead of forcing a conclusion.

Screen GxP applicability

Does 21 CFR Part 11 apply?

Confirm the predicate record, electronic reliance, submission pathway, and signature use. Treat Part 11 as a scoped record question, not a software label.

Run the Part 11 screen

How much testing is appropriate?

Use the functional risk assessment to set test depth. Consider failure mode, GxP consequence, known expected results, configuration complexity, existing controls, detectability, and applicable supplier testing.

Plan requirements and tests

Can supplier testing be leveraged?

Yes, for a defined scope when version, function, environment, results, exceptions, and local differences have been reviewed. A certificate alone is not coverage.

Assess existing evidence

Should testing be scripted or unscripted?

Write clear test steps for critical checks with known expected results. Use structured exploratory work where interaction, novelty, or context creates uncertainty that a narrow script may miss.

Select a testing method

Does this spreadsheet require assurance?

Assess the decision supported, formula and data complexity, user control, change exposure, independent checks, and the consequence of an incorrect output.

Use the Spreadsheet Assurance Playbook

How should SaaS be assured?

Separate the supplier platform, local configuration, integrations, data responsibilities, release cadence, and the exact workflows relied upon by your organization.

Use the SaaS Assurance Playbook

How should an AI-enabled tool be assessed?

Define the model’s role and prohibited actions, failure modes, evaluation data, critical misses, human oversight, approved conditions of use, monitoring, and stop conditions.

Use the AI Assurance Playbook

Does this change require regression testing?

Trace what changed, which shared components and controls are touched, what could regress, and whether existing automated or supplier evidence remains applicable.

Assess release impact

What evidence is needed before release?

Before release, reconcile the validation plan, approved URS, functional risk assessment, supplier evidence, executed IQ/OQ/PQ or UAT, deviations, RTM, SOPs, training, and the VSR conclusion.

Prepare a validation approach

When is periodic review required?

Follow the frequency and triggers defined in the validation SOP. Review changes, incidents, access, backup and restore, audit trails, supplier releases, open CAPA, procedures, and evidence that the system remains in a validated state.

Maintain the validated state

Project starting point

Prepare the initial GxP assessment and validation approach.

The system-use tool records unknowns as information needed and identifies what to confirm in the validation plan, URS, functional risk assessment, supplier assessment, and test strategy. It does not approve a system or accept residual risk.

Check system use