# SaaS Release Assessment Template

Version 2.0 · Updated 2026-09-21 · Operations

Determine whether a supplier release affects approved GxP functions and what evidence or monitoring is required.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

For scheduled and emergency releases to supplier-controlled multi-tenant services.

## Information needed before starting

- Supplier release notes and deployment date
- Current configuration, integrations and open-record states
- Relevant supplier evidence and local risk/test records

## Field instructions

- **Release and date:** Record the exact version/release and effective date from an authoritative source, including configuration identifiers needed to reproduce the assessment.
- **Authoritative change information:** Reference the supplier release notes or approved change request, including version, issue date and unresolved ambiguities.
- **Affected GxP functions:** Identify the function or requirement and its controlled reference. Explain the regulated process or record that depends on it.
- **Configuration and interface exposure:** List local settings, interfaces and existing record states touched by the release. Identify shared dependencies that need impact assessment.
- **Potential failure and impact:** Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
- **Supplier evidence:** Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- **Customer evidence needed:** List the unanswered questions or missing evidence, the action owner and due date. Explain what cannot be concluded until they are resolved.
- **Decision and rationale:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
- **Post-release monitoring:** State what will be compared or monitored, against which baseline, by whom and how often. Define discrepancy thresholds and the response.
- **Reassessment criteria and approval:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.

Review the authoritative release information.

Map changed components to enabled GxP functions and shared dependencies.

Assess risk, detectability, evidence, and open defects.

Choose no impact, targeted confirmation, regression, restriction, or escalation.

## Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

| Field | Completed example |
| --- | --- |
| Release and date | Fictional eQMS 8.4; 15 September 2026 |
| Authoritative change information | Dashboard color, routing engine, and export signature block |
| Affected GxP functions | CAPA route and exported signed record |
| Configuration and interface exposure | Local site/severity conditions and open legacy records |
| Potential failure and impact | Approval bypass or incorrect signature association |
| Supplier evidence | Release note, defect list, standard workflow regression summary |
| Customer evidence needed | Targeted routing, open-state transition, signature export, and role challenge |
| Decision and rationale | Approve only after mapping correction and retest; broad platform regression is not justified |
| Post-release monitoring | Routing exceptions, audit-trail discrepancies, and export complaints for seven days |
| Reassessment criteria and approval | Critical incident, workflow or identity change, or threshold breach; Quality approval required |

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Release and date | ____________________ |
| Authoritative change information | ____________________ |
| Affected GxP functions | ____________________ |
| Configuration and interface exposure | ____________________ |
| Potential failure and impact | ____________________ |
| Supplier evidence | ____________________ |
| Customer evidence needed | ____________________ |
| Decision and rationale | ____________________ |
| Post-release monitoring | ____________________ |
| Reassessment criteria and approval | ____________________ |

## Related guidance

- [Review the SaaS release example](https://csvtocsa.com/case-studies/saas-eqms-weekly-releases)

- [View the concise change worksheet](https://csvtocsa.com/worksheets/saas-change-impact)

- [Plan periodic review](https://csvtocsa.com/learn/guidance/periodic-review)

Canonical page: https://csvtocsa.com/templates/saas-release-assessment