# Software Change Impact Assessment

Version 2.0 · Updated 2026-09-21 · Operations

Determine affected GxP functions, risk, regression scope, readiness, and release conditions for a software or configuration change.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

For planned, supplier-managed, major, minor, and emergency software changes.

## Information needed before starting

- Authoritative change request
- Approved use, configuration and dependency inventory
- Risk/evidence baseline and proposed release plan

## Field instructions

- **Change and reason:** Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- **Approved intended use:** Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- **Affected GxP functions:** Identify the function or requirement and its controlled reference. Explain the regulated process or record that depends on it.
- **Configuration impact:** Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- **Interface and data impact:** Identify authoritative sources, receiving systems and record identifiers. Describe supported formats, units, timing, transformations and error handling.
- **Electronic record and signature impact:** Identify the required record context, history, identity and relationships. Explain how integrity, attribution and retrieval will be preserved and checked.
- **Security and access impact:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Failure scenarios and controls:** Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
- **Existing evidence:** Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- **Testing and regression scope:** Identify the assessed configuration, representative data, selected activities and expected results. Include abnormal and recovery paths and explain remaining coverage gaps.
- **Documentation and training:** List the controlled procedures, instructions and role-based training affected, with owner and completion evidence.
- **Release, monitoring, and approval:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.

Define the specific system, service, change, population, and intended use.

Complete each field from available records and accountable interviews; record unknowns rather than guessing.

Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.

Adapt the structure to the organization’s approved procedures and document-control process.

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Change and reason | ____________________ |
| Approved intended use | ____________________ |
| Affected GxP functions | ____________________ |
| Configuration impact | ____________________ |
| Interface and data impact | ____________________ |
| Electronic record and signature impact | ____________________ |
| Security and access impact | ____________________ |
| Failure scenarios and controls | ____________________ |
| Existing evidence | ____________________ |
| Testing and regression scope | ____________________ |
| Documentation and training | ____________________ |
| Release, monitoring, and approval | ____________________ |

## Related guidance

- [Read the related practical guide](https://csvtocsa.com/learn/guidance/software-change-control)

Canonical page: https://csvtocsa.com/templates/software-change-impact-assessment