CSV, CSA, and AI Assurance Glossary

Term	Plain-language explanation	Practical example
Intended use	The job people rely on the system to perform	ERP blocks issue of quarantined material
Context of use	The circumstances in which the task is performed	Expert reviewers using source documents during protocol review
CSV	Establishing and maintaining evidence that a computerized system suits its intended use	Assessing and supporting an eQMS lifecycle
CSA	Software-assurance thinking focused on confidence in use through risk-informed activities	Selecting tests around meaningful production or quality failures
GxP	Shorthand covering different regulated good-practice areas	GMP and GCP have different contexts
Validation plan	The approved record defining validation scope, roles, approach, deliverables, acceptance, and schedule	A plan identifies which SaaS functions require customer OQ or UAT and which supplier evidence will be leveraged
Validation protocol	An approved plan for executing defined qualification or testing activities	A combined IQ/OQ protocol states prerequisites, test data, expected results, evidence, and deviation handling
URS	User requirements specification: controlled statements of what users and the regulated process need	The eQMS prevents closure until required investigation and approval steps are complete
FRS / FS	Functional requirements specification or functional specification describing required system behavior	The workflow creates an effectiveness task when the CAPA type and risk meet defined conditions
Configuration specification	Controlled description of settings, roles, rules, forms, reports, and other configured behavior	Approved routing, due-date, permission, and electronic-signature settings for an eQMS
DS	Design specification describing how a custom solution or component is designed to meet requirements	Interface services, transformation logic, error handling, and logging used to meet the URS
SDLC	Software development lifecycle used to plan, build, review, test, release, operate, and retire software	Supplier or internal engineering controls reviewed during supplier assessment
IQ	Installation qualification: documented verification that the approved environment, software, and components are installed or provisioned correctly	Confirming the approved application release, tenant, integration endpoints, and required services
OQ	Operational qualification: documented verification that functions and controls operate across defined conditions	Challenging calculation boundaries, permissions, workflow gates, signatures, and interface errors
PQ	Performance qualification: evidence that the system supports the intended process under representative operating conditions	Trained users execute a deviation workflow with realistic records and procedures
UAT	User acceptance testing performed by representative users against approved business and user requirements	Quality users confirm that configured CAPA routing supports the approved process
RTM	Requirements traceability matrix connecting requirements to risk, specifications, tests, deviations, and results	URS-014 links to FRA-07, OQ-012, deviation DV-03, and the accepted retest
Test protocol	Approved instructions and acceptance criteria for planned validation testing	A protocol covers prerequisites, roles, data, actions, expected results, actual results, and objective evidence
Test script	A predefined test case or sequence with expected results	Verifying that an unauthorized role cannot approve or electronically sign a record
Test evidence	The controlled record showing what was executed and observed	System logs, data comparisons, screenshots with context, exports, and tester observations
Deviation	A documented departure from an approved protocol, expected result, procedure, or requirement	An OQ step fails because an incorrect role was configured; impact, correction, and retest are recorded
RT / retest	Re-execution performed after a failure is understood and corrected	Repeating the affected OQ steps and justified regression after a configuration fix
VSR	Validation summary report: the approved conclusion covering execution, deviations, traceability, open items, residual risk, and release recommendation	Quality reviews the completed CSV package before authorizing production use
Validated state	The condition in which current evidence continues to support fitness for intended use and applicable requirements	Change control, incidents, access review, backup testing, and periodic review confirm continued control
QMS	Quality management system: the organization’s controlled processes, responsibilities, procedures, and records	The validation SOP defines required approvals, document controls, and change-management expectations
SOP	Standard operating procedure defining an approved process and responsibility	The CSV SOP defines validation categories, deliverables, review, approval, and record retention
WI	Work instruction providing detailed steps for performing a controlled task	A WI explains how to execute, document, and review exploratory testing sessions
Requirement	A defined need or expected behavior	An unauthorized user cannot close a CAPA
Risk	The assessed relationship between a possible failure and its consequences, using the applicable method	Wrong unit mapping could support an incorrect acceptance decision
Control	A measure that prevents, detects, or manages a failure	Blocking an unknown disposition code
Residual risk	Risk remaining after the assessed controls	An unresolved failure possibility accepted within defined conditions
Objective evidence	Information that supports an assessable conclusion	A traced transaction comparison with expected and actual outcomes
Traceability	A visible connection among use, requirement, risk, evidence, and decision	Requirement MAT-02 linked to interface test IF-T08
Scripted testing	Testing with predefined conditions, actions, and expected results	Expiry boundary check at a defined time
Exploratory testing	Learning, test design, and execution conducted together within a purpose	Investigating CAPA reassignment combinations
Negative test	A challenge to behavior that should be rejected or prevented	Attempting approval without permission
Boundary test	A check around a point where behavior changes	Just below, at, and above a specification limit
Regression testing	Checking relevant existing behavior after a change	Rechecking routing after a workflow-engine update
Supplier evidence	Evidence supplied by the product or service provider	Version-specific standard-feature test records
SaaS	Software delivered as an online service	A hosted eQMS with supplier-managed releases
eQMS	Electronic quality management system	Controlled documents, deviations, CAPA, and related workflows
LIMS	Laboratory information management system	Sample, test, result, and laboratory workflow management
MES	Manufacturing execution system	Managing and recording defined production execution activities
ERP	Enterprise resource planning system	Material, inventory, and business-process management
CAPA	Corrective and preventive action	Investigating and addressing a quality problem through a controlled process
Audit trail	Recorded history of relevant events and changes	Who changed a controlled value and when, with required context
Data lineage	The path from source information through transformations to use	PDF extraction, indexing, retrieval, and AI finding
ALCOA	Common data-integrity shorthand: attributable, legible, contemporaneous, original, accurate	A result linked to its creator, context, and trustworthy record
RAG	Retrieval-augmented generation: retrieved material is supplied to support generation	An assistant answers using selected approved procedure passages
Groundedness	The extent to which a claim is supported by its provided source	A cited passage actually supports the stated instruction
Hallucination	Generated content presented as factual without adequate support	An invented procedure requirement
False positive	A proposed finding that is not a real issue under the reference definition	Flagging an approved exception as a defect
False negative	A reference issue the system fails to identify	Missing an incorrect acceptance limit
Precision	Correct findings divided by all proposed findings	32 correct out of 38 proposed findings
Recall	Correctly identified reference issues divided by all reference issues	32 identified out of 40 reference issues
Evaluation leakage	Evaluation information influences development or otherwise undermines the intended independence	Tuning a prompt repeatedly on the final test cases
Drift	A change in data, behavior, or performance relevant to the use	New document formats lead to more extraction failures
Prompt injection	Untrusted content attempts to redirect the assistant’s behavior	A document tells the assistant to disclose restricted information
Agent	An AI-enabled application that can select or execute actions through tools	An assistant creating proposed investigation tasks
Human oversight	Defined human checks and decisions with suitable authority and capability	A qualified reviewer verifies sources and disposes findings
Reassessment	Revisiting a conclusion when relevant conditions change	Evaluating a new parser or source corpus