When it comes to testing, the key distinction between computer system validation (CSV) and computer software assurance (CSA) lies in their approaches. CSV adopts a thorough "test everything" mindset, while CSA promotes using critical thinking for more efficient and effective testing.
The following blog post summarizes an article written by ValGenesis Senior Director of Product Marketing Steve Thompson for MedTech Intelligence. It outlines how companies can determine the optimal level of testing intensity for risk-based CSA validation, ensuring a streamlined, least burdensome approach. Read the full article at medtechintelligence.com.
The FDA's CSA draft guidance has garnered significant interest from life sciences companies struggling with traditional CSV methods. The new framework aims to streamline the validation process by focusing testing efforts on higher-risk systems rather than validating everything, which has been the common practice.
While there are differences between CSV and CSA, both methodologies emphasize the risk-based, least burdensome approach first introduced in the FDA's 2002 guidance on General Principles of Software Validation. Despite being over two decades old, many companies have struggled to interpret and apply this approach, leading to overtesting and exhaustive documentation due to fear of regulatory consequences. Enter CSA.
Computer software assurance encourages the use of unscripted testing methods and automated validation tools to address the shortcomings of traditional testing, which can overlook high-risk issues and unnecessarily burden resources.
The article highlights various test methodologies recommended by CSA, including scripted testing for high-risk features and systems, and introduces new methodologies such as ad hoc testing, exploratory testing, and unscripted testing. These methods aim to achieve better testing coverage while being less time-consuming than traditional scripted testing.
Risk-based testing is a crucial principle of CSA, with a focus on categorizing systems as high, medium, or low risk. Different levels of validation rigor are applied based on the risk level, with high-risk systems undergoing more formal validation, medium-risk systems leveraging subject matter experts and critical thinking, and low-risk systems potentially requiring no validation.
Regulatory guidance matrices are suggested as tools to help manage risk and ensure consistent application of testing methodologies. By incorporating these matrices into risk management processes, companies can make more informed decisions about testing strategies.
The article concludes by emphasizing that validation is not a black-and-white process but rather a nuanced and flexible one. In addition to digital tools, it encourages the use of critical thinking and a combination of testing methodologies based on risk assessment and other relevant factors.
For a deep dive into CSA, read our comprehensive Guide to Computer Software Assurance, or contact us to learn more about ValGenesis VLMS with Design Manager, our purpose-built solution designed to help life sciences companies comply with the new CSA guidance.