Define the test objective and scope
State the GxP function, requirement, failure scenario, expected control, automated scope, excluded scope, environment, test data, expected results, execution trigger, retained records, and review route. Automation is useful for stable, repeatable checks but does not remove the need to assess the test tool and test code.
Suitability of the automated test
Review the test tool’s intended use, version and configuration, access, test-code review, source control, libraries, data generation, environment control, expected-result independence, failure handling, logs, screenshots or exports where useful, traceability, and change impact. Demonstrate that a deliberately failing application condition causes the test to fail rather than silently pass.
Completed fictional regression example
A nightly automated suite checks an eQMS approval workflow. The suite creates a CAPA, attempts unauthorized closure, records approval, signs, exports the record, and verifies the audit history. During qualification, the application is configured deliberately to permit unauthorized closure. The automation still reports pass because it checks only the final status, not the rejected transition.
The team adds an explicit expected rejection, verifies role identity, records the response and audit event, reviews test code independently, and reruns positive, negative, and interruption cases. The corrected suite supports regression evidence for the stable configured workflow. Exploratory testing remains for unusual open-state and concurrent-review behavior.
Maintenance
Control test-code changes, dependencies, data, environment, selectors, and acceptance criteria. Review failures rather than rerunning until green. Reassess coverage when the application, workflow, interface, test tool, library, or intended validation use changes.
Regulatory and procedural context
Primary sources. FDA CSA guidance ↗ describes scripted, unscripted, and other testing activities within a risk-based approach.
Company procedure. The organization’s approved validation, change-control, supplier-management, information-security, data-integrity, records-retention, and Quality approval procedures determine the required records, roles, and approval route.
CSVtoCSA practitioner interpretation. Automated results are useful only when the automation itself is controlled and shown capable of detecting the relevant failure. This is a recommended validation approach, not a statement that every listed activity is a direct regulatory requirement.