Define intended use
State who uses the system, for which regulated decision or record, with which inputs and boundaries.
CSA foundation
Start Here
CSA is not less rigor. It is the discipline of putting the strongest evidence where software failure can matter.
Follow the failure
Describe how software failure could reach patient safety, product quality, data integrity, or a required record.
Recognize existing controls
Do not treat testing as the only control. Include process review, reconciliation, access, monitoring, and supplier controls.
Select evidence
Use scripts for deterministic controls, exploratory charters for uncertain workflows, automation for stable high-volume checks, and supplier evidence where credible.
Defend the decision
Explain why the combined evidence is enough, what residual risk remains, and which event requires reassessment.