SaaS assurance
The SaaS Version Problem: Assuring Software You Cannot Freeze
A release-aware assurance model for regulated SaaS: control the decision boundary, not an imaginary frozen build.
Practitioner library
Insights
Deep, decision-focused material for the assurance problems that do not fit a generic checklist.
Filter insights by category
23 resources in All
Supplier assurance
Why “The Vendor Validated It” Is Not an Assurance Conclusion
Vendor evidence can reduce duplicate effort, but only after the customer establishes relevance, credibility, and the remaining evidence gap.
Test strategy
When Exploratory Testing Produces Better Evidence Than a Script
A disciplined comparison of scripted, unscripted, and hybrid evidence—plus a practical charter for high-risk workflow testing.
01
Foundation · Published
From Deterministic Validation to AI Assurance
AI changes the assurance problem because correct behavior can no longer be reduced to “the same input always produces the same output.” A professional CSA strategy therefore validates the complete sociotechnical system: intended use, data, model, application logic, human decisions, operating controls, and evidence over time.
02
Foundation · Published
Classifying AI Systems and Drawing the Boundary
An AI assurance strategy fails early when the team treats “the model” as the system. This chapter provides a practical taxonomy and boundary method for predictive models, computer vision, generative AI, retrieval-augmented generation, embedded vendor features, and agents.
03
Foundation · Published
Intended Use and Context of Use
The intended-use statement is the anchor for AI requirements, risk, data, evaluation, human oversight, monitoring, and change control. This chapter shows how to write one that is precise enough to validate.
04
Foundation · Published
GxP Applicability and Risk-Based Scoping
Professional AI assurance starts by identifying the governing process and record—not by declaring that every AI tool is GxP or that every assistant is merely “productivity software.” This chapter provides a feature-level scoping method.
05
Practitioner · Published
Governance, Accountability, and the AI Inventory
AI governance becomes operational only when every production use has an owner, an identifiable configuration, a risk decision, a monitoring obligation, and a controlled path to change or retirement. This chapter turns policy into lifecycle gates.
06
Practitioner · Published
Risk Analysis for AI Failure and Uncertainty
AI risk analysis must move beyond a generic statement that “the model may be wrong.” The practitioner must identify how a specific error arises, how it propagates through the process, whether it can be detected, and which controls actually interrupt the chain.