Operations · worksheet · CSVtoCSA editorial

SaaS change-impact worksheet

Version 2.0 · Updated 2026-09-21 · Operations

Assess changed functions, local evidence needs and the conditions for continued use.

Adapt this template to your intended use, applicable requirements, and approved procedures.

When to use it

Use before documenting the corresponding assessment or decision.

Information needed before starting

  • Supplier release notes and deployment date
  • Current configuration, integrations and open-record states
  • Relevant supplier evidence and local risk/test records

Field instructions

  • Release: Identify the supplier release/version and planned deployment date, including the authoritative release-information reference.
  • Changed component: Describe what changed and which shared component, workflow, rule or export could be affected.
  • Local use: Explain how the changed function is configured and used locally, including the decisions and records that rely on it.
  • Dependencies: List interfaces, shared rules, roles, data states and other functions whose behavior could change indirectly.
  • Supplier evidence: Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
  • Local checks: Select checks for the uncovered local risks. Define representative conditions, expected results and the evidence to retain.
  • Operational preparation: Identify required procedure, training, access, support and monitoring updates and who confirms readiness.
  • Deployment condition: State what must be demonstrated or resolved before the specified use can continue; define any restriction and accountable decision owner.
  • Recovery: Explain rollback or containment, record reconciliation and restoration checks if deployment causes an unacceptable result.
  • Monitoring: State what will be compared or monitored, against which baseline, by whom and how often. Define discrepancy thresholds and the response.

Does the assessment include indirect effects and records already in progress?

Completed fictional example

Fictional teaching example; replace its values with your own assessed facts and evidence.

FieldCompleted example
Release8.4
Changed componentCAPA conditional routing
Local useSite/severity-based review and closure
DependenciesExisting records, site master data, role directory, API transitions
Supplier evidenceEngine test summary with stated exclusions
Local checksBranch, blank-value, existing-state, permission, and interface challenges
Operational preparationSupport instructions and affected-user communication
Deployment conditionRelevant defects resolved or formally assessed before authorized release
RecoveryDefined record and configuration recovery; supplier rollback feasibility confirmed
MonitoringUnexpected routes, unowned tasks, unauthorized transitions

Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

FieldYour entry
Release____________________
Changed component____________________
Local use____________________
Dependencies____________________
Supplier evidence____________________
Local checks____________________
Operational preparation____________________
Deployment condition____________________
Recovery____________________
Monitoring____________________
Relevant regulations and guidance

These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.

Computer Software Assurance for Production and Quality Management System Software ↗

Regulatory guidance / GMP guideline · United States · February 2026

Scope: Medical-device manufacturers assuring software used in production or their quality management system.

Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.

Status: Final / published · Checked 2026-09-21

Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.

Read source details and applicability →

EudraLex Volume 4, Annex 11 — Computerised Systems ↗

Regulatory guidance / GMP guideline · European Union · January 2011 revision

Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.

Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.

Status: Final / published · Checked 2026-09-21

The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.

Read source details and applicability →
Was this useful? Leave feedback

Was this resource useful?

Was this template clear and useful? Tell us which instruction or field could be improved.

Loading contribution options…

Questions and moderated discussion

Questions and discussion

Ask a question or share a perspective. Contributions are reviewed before publication.

Loading contribution options…

Suggest a correction

Sent privately to the editorial moderation queue. Your account email and correction are not published as a comment. Do not include confidential or personal information.

Resource: SaaS change-impact worksheet

Loading sign-in status…

Correction details