Computer system validation
Computer system validation, or CSV, is the documented process used to show that a GxP system is fit for its intended use. The validation effort should reflect the risk of the system and how it is used.
Validation lifecycle
Planning, testing, reporting, and change control all form part of the validation record.
Planning
Defines the scope, approach, and acceptance criteria in the validation plan.
Specification
Defines what the system must do in the user requirements specification, then documents the functional and design specifications.
Verification
Tests the system against the specifications, including installation, operation, and performance in the actual process.
Reporting and operation
Summarizes the evidence in a validation summary report. Once in operation, the system remains under change control and periodic review.
The V model pairs each level of specification with its corresponding test. Verification traditionally includes installation qualification, operational qualification, and performance qualification.
Risk based validation
GAMP 5 categorizes software by how custom it is. Infrastructure and off the shelf software used as supplied generally requires less validation; configured products require validation of the configuration, while custom software requires more extensive validation. A risk assessment then identifies the functions that affect patient safety, product quality, or data integrity.
The level of validation should be based on risk.
Computer Software Assurance
FDA's guidance places more emphasis on the testing needed for the risk being assessed. Vendor testing, unscripted testing, and automated assurance can be used where appropriate, with formal scripted testing for higher risk functions.
This can reduce formal testing when the risk assessment supports it.
Where validation goes wrong
Validating every function to the same depth, regardless of risk.
Validating the system once and not reassessing it after changes.
Validation documents that no longer match the system that was actually built.
Traceability gaps between requirements and the evidence showing they were met.
SequoiaAT supports computer system validation for life sciences software. Our work includes validation planning, verification, and test automation.
Regulated documents migrated into Veeva Vault for a biotechnology company running clinical studies, with controlled migration, validation, and document integrity checks.
Read the case study →