Research & Publications

Research questions in software assurance and digital quality

This section organizes technical questions, educational methods, and research directions. Work is identified by its actual status. A practitioner article explains an argument. A proposed study describes a method to be carried out. A completed study requires reported methods, results, limitations, and accessible supporting material where sharing is permitted.

The educational examples on CSVtoCSA are not evidence of measured project outcomes. They help make methods understandable and testable.

Research direction 1: Evaluating AI-assisted validation-document review

Status: Proposed study. No empirical results are claimed on this page.

Question

Under what conditions does an AI-assisted workflow help qualified reviewers identify protocol issues without increasing consequential missed findings or unsupported conclusions?

Proposed method

Create a documented collection of fictional or appropriately authorized protocols and requirements. Establish reference findings through independent qualified review and adjudication. Separate development cases from evaluation cases. Define the AI configuration and permitted use before evaluation.

Compare assisted and unassisted review using a study design that addresses differences between reviewers, case difficulty, assignment order, and learning. Measure final reviewer findings, severity-specific misses, false findings, source-verification behavior, and total review effort.

What would be reported

Describe the dataset, inclusion criteria, reference process, configuration, matching rules, denominators, comparison design, results, uncertainty, and limitations. Report unfavorable outcomes and failed cases. Share synthetic materials and analysis instructions where appropriate so others can examine the work.

Boundaries

Results from one document type or reviewer group should not be generalized automatically. Synthetic documents may not represent the complexity of real projects. Confidential project materials require appropriate authorization and cannot be made public merely to strengthen a portfolio.

Research direction 2: Decision consistency in SaaS change assessment

Status: Proposed study.

Question

Does a structured change-impact worksheet help practitioners make more consistent and better-explained assurance decisions than an unstructured release-note review?

Proposed method

Prepare fictional SaaS releases with different effects: cosmetic display, conditional routing, shared date logic, signature export, API behavior, and incomplete supplier information. Have practitioners assess affected uses, evidence gaps, proposed activities, and release conditions.

Evaluate whether reasoning identifies the intended dependencies and failure paths. Use independent adjudication and an explicit rubric rather than assuming one author’s answer is uniquely correct. Measure agreement and explanation quality separately from effort.

Expected contribution

A transparent case set, scoring rubric, analysis, and discussion of disagreement could help practitioners see which questions improve assessment. This is a proposed contribution, not a claim that the method has already demonstrated improvement.

Research direction 3: What makes assurance evidence reviewable?

Status: Proposed study.

Question

Can another qualified reviewer reconstruct the basis for a release decision from the evidence package without informal explanation?

Proposed method

Create comparable fictional evidence packages that differ in traceability, context, exception handling, and presentation. Ask reviewers to identify the use, tested failures, unresolved issues, and decision limits. Record accuracy, ambiguity, time, and requests for missing information.

Practical value

The study could inform better evidence records and training examples. It should not assume that shorter records are always better or that more documentation necessarily improves understanding.

How research is distinguished from commentary

A research report needs a defined question and reproducible method, not just a technical title. A named method needs clear attribution to its foundations and evidence before claims of novelty or effectiveness. External publication and peer-review status should be described exactly as they occurred.

For self-published writing, use the label “self-published practitioner article.” For a conference presentation, identify the actual event, date, role, and available proceedings. For a completed study, link the report, methods, and permitted supporting materials.