Assess the release before choosing the tests
A release schedule does not determine the testing scope. Review supplier release notes, changed functions, known issues and available supplier evidence. Then assess the impact on your configuration, interfaces, records and operating process.
Choose risk-based verification for the affected use. Broader regression may be needed when shared components or uncertain changes could affect other important functions.
A weekly SaaS eQMS update
Fictional case. One release changes dashboard colors, corrects a workflow engine and updates signed-PDF exports.
- Dashboard: check display and usability where no GxP decision depends on the color.
- CAPA workflow: test configured approval branches, unauthorized transitions and existing open records.
- Signed export: verify record revision, signer identity and signature meaning.
- Supplier evidence: use relevant regression results for unchanged standard behavior.
A legacy blank site value bypasses a required review. Keep that use restricted until correction and targeted retesting support release.
Production release
Record the version, assessment, evidence, unresolved issues, restrictions, approval and monitoring needed for the intended use. Keep rollback or recovery arrangements ready.
Detailed practice, examples and references
Initial SaaS implementation
Define the supplier and service, approved intended use, GxP assessment, customer configuration, interfaces, migrated data, access and roles, electronic records and signatures, and shared-responsibility boundary. The initial validation package should cover supplier assessment, requirements, configuration specification, functional risk assessment, migration and interface plans, testing, deviations, validation summary, release readiness, and operational ownership.
Routine supplier releases
For every release, review authoritative release notes, known issues, supplier testing, security notices, and customer configuration exposure. Map changed components to enabled GxP functions and shared dependencies. Choose one of four outcomes: no relevant impact, documentation or monitoring only, targeted confirmation, or broader regression and formal escalation.
Major supplier changes
Treat architecture, authentication or identity, application programming interface (API), data model, major workflow, hosting, sub-processor, and material data-location changes as assessment prompts—not automatic risk conclusions. Determine whether the approved use, records, control effectiveness, availability, recovery, privacy, or previously demonstrated performance can change.
Recurring fictional eQMS example
A weekly eQMS release contains a cosmetic dashboard change, a workflow-engine defect correction, and a signed-PDF export update. The customer accepts supplier regression for the unchanged standard platform. A brief usability check covers the dashboard. Configured CAPA branches, legacy open records, unauthorized transitions, signer identity, signature meaning, record revision, and accurate copy are tested locally. The release is approved only after a legacy blank-value routing deviation and missing signature meaning are corrected.
Maintaining the validated state
| Operational evidence | What the review should establish |
|---|---|
| Incidents and problems | Whether actual failures challenge prior risk assumptions or controls |
| Change control and releases | Whether cumulative changes remain within the approved use and evidence boundary |
| Supplier performance | Notification quality, defect handling, service levels, and unresolved commitments |
| User access review | Continued appropriateness of business, Quality, support, and privileged roles |
| Backup and restore | Supplier and customer responsibilities and demonstrated record retrieval |
| Business continuity | Dependencies, recovery objectives, workarounds, reconciliation, and return to service |
| Periodic review | Evidence-based conclusion that current use remains supported |
Regulatory and procedural context
Primary sources. FDA CSA guidance ↗ discusses risk-based assurance and the use of supplier evidence. EU GMP Annex 11 ↗ addresses lifecycle risk management and supplier/service-provider responsibilities for applicable GMP systems.
Company procedure. The organization’s approved validation, change-control, supplier-management, information-security, data-integrity, records-retention, and Quality approval procedures determine the required records, roles, and approval route.
CSVtoCSA practitioner interpretation. Continuous delivery needs continuous impact assessment, not automatic repetition of the historical protocol or automatic acceptance of the supplier’s label. This is a recommended validation approach, not a statement that every listed activity is a direct regulatory requirement.
Practitioner guidance by Sandip Thorat · Simplified 17 September 2026. Apply the requirements and approved procedures relevant to your system. Report a correction.
Questions and discussion
Ask a question or share a perspective. Contributions are reviewed before publication.
Loading contribution options…