Complex assurance scenario
Low-code CAPA workflow
Controlling citizen configuration without treating every platform feature as custom code.
Context
Quality operations configures CAPA intake, routing, effectiveness checks, and dashboards on a managed low-code platform.
Intended Use
Control CAPA records and approvals; dashboards support oversight but not automated closure.
Boundary
Approved app version, data model, formulas, automations, roles, connectors, environments, and platform release controls.
Failure Chain
A maker changes a condition → effectiveness task is skipped → CAPA closes without required verification.
Existing Controls
- Separated development and production
- solution packaging
- restricted maker role
- platform audit log
Evidence
- Formula review
- workflow tests
- role challenge
- deployment record
- audit-log review
Evidence Gaps
Emergency production edit capability is enabled for two administrators without compensating review.
Test Design
Script closure gates and permissions; use pairwise combinations for type, severity, owner, due date, and extension; explore interruption and rework states.
Decision
Approve after removing direct production edit and establishing break-glass review.
Residual Risk
Platform updates may change connector or formula behavior.
Monitoring
Solution version, privileged actions, failed flows, overdue tasks, and unexpected closures.
Reassessment Triggers
- New connector
- formula change
- platform deprecation notice
- privileged production action
Inspection Questions
- Who can change logic?
- How is promoted configuration identified?
- What prevents bypass of effectiveness review?