Computer Systems Validation × FDA × AI
FDA Computer Software Assurance: How CSA Changes CSV Without Erasing It
- Computer Software Assurance
- CSA
- FDA
- Risk-based validation
- CSV
FDA’s Computer Software Assurance for Production and Quality System Software is the most important vocabulary change in validation in a generation. CSA does not delete CSV. It tells you to stop scripted-testing a password field for the fourteenth time and to put your eyes on process risk. High-risk intended use still gets rigorous, documented challenge. Low-risk supporting software can be assured with vendor documentation, exploratory tests, and monitoring.
The unique challenge is the split. QA that cannot defend why a historian is high-risk and a training LMS is not will lose the inspection. IT that hears “CSA” as “less paperwork” will write the 483. SR Soft staffs CSA-literate validation leads and the engineers who can describe intended use in one sentence.
What changes on Monday
- Intended use and process risk before a single script
- Unscripted / exploratory testing where risk allows — recorded, not vibes
- Vendor evidence that is actually read and versioned
- Automated test evidence that is trustworthy
- QA that can defend the split to an investigator
- 01
Inventory by intended use
Not by vendor. Not by “it’s SAP.”
- 02
Risk workshop
Process owner, QA, IT. Signed split.
- 03
High-risk protocols
Challenge remains. Scripts earn their keep.
- 04
Low-risk assurance packs
Vendor + exploratory + monitor. Named reviewer.
- 05
Inspection story
One narrative QA can tell without the SI in the room.
An S/4 batch-release path is not a Category 3 spreadsheet. CSA does not make S/4 “unvalidated.” It makes the evidence proportional. Our S/4 cells include that conversation from blueprint. Fortune 500 quality orgs moving from CSV theater to CSA buy the cell, not a training course.
Effort shift under CSA
Defending the split
CSA lives or dies on whether QA can explain why a batch-release path is challenged and a training LMS is assured. That explanation is a signed workshop, not a vibe. Unscripted tests are recorded — objective, observer, outcome — not “we clicked around.” Vendor evidence is versioned and read. Automated tests are trustworthy only if the framework is in the assurance pack. We restaff so IT cannot hear “less paperwork” and QA cannot hear “more scripts.”
S/4 quality and batch are not Category 3 because someone said “CSA.” They are high-risk until the process owner says the harm is low — and they will not. We put that conversation in blueprint. The binder thins. The challenge remains where harm is real.
