[{"data":1,"prerenderedAt":496},["ShallowReactive",2],{"\u002Fblog\u002Fcsa-vs-csv-risk-based-assurance-planning":3},{"id":4,"title":5,"author":6,"body":7,"category":476,"date":477,"description":478,"draft":479,"excerpt":480,"extension":481,"heroImage":482,"heroImageAlt":483,"meta":484,"navigation":485,"path":486,"seo":487,"slug":480,"stem":488,"tags":489,"__hash__":495},"blog\u002Fblog\u002Fcsa-vs-csv-risk-based-assurance-planning.md","CSA vs CSV: What Changes, and Which Guidance Applies?","QikSolve",{"type":8,"value":9,"toc":462},"minimark",[10,22,25,30,33,41,50,65,70,79,82,86,89,92,159,162,166,178,181,253,256,260,301,304,349,352,356,363,381,385,394,403,407,456],[11,12,13,14,21],"p",{},"Computer software assurance (CSA) versus computerised system validation (CSV) is not a choice\nbetween assurance and no assurance. First identify the software’s intended use, the process it\nsupports, and the requirements that apply. FDA’s\n",[15,16,20],"a",{"href":17,"rel":18},"https:\u002F\u002Fwww.fda.gov\u002Fregulatory-information\u002Fsearch-fda-guidance-documents\u002Fcomputer-software-assurance-production-and-quality-management-system-software",[19],"nofollow","CSA guidance","\naddresses software used in medical-device production or a medical-device quality management\nsystem. Risk-based assurance principles can also inform work on a pharmaceutical quality\nmanagement system, but a pharmaceutical GMP team must establish its applicable requirements\nrather than assume that FDA’s device-sector guidance changes its obligations.",[11,23,24],{},"The practical difference is one of scope and method: the FDA guidance describes a risk-based\napproach and possible activities for establishing confidence in in-scope automation. It does not\nmake the word “CSA” a general exemption from validation, nor does it replace the need to identify\nthe applicable quality-system requirements.",[26,27,29],"h2",{"id":28},"start-with-scope-not-the-software-label","Start with scope, not the software label",[11,31,32],{},"CSV is often used as shorthand for planning and documenting\nassurance that a system is fit for its intended use. It is not one universal regulation with\nidentical requirements in every industry and jurisdiction. Risk-based validation principles also\npredate the FDA’s CSA guidance.",[11,34,35,36,40],{},"The FDA’s February 2026\n",[15,37,39],{"href":17,"rel":38},[19],"Computer Software Assurance for Production and Quality Management System Software guidance","\ndescribes recommendations for computers and automated data-processing systems\nused as part of medical-device production or a quality management system. FDA says it supersedes\nthe September 2025 version and aims to help manufacturers comply with the Quality Management\nSystem Regulation (QMSR), 21 CFR Part 820. FDA guidance describes the agency’s current thinking;\nit is not itself a regulation.",[11,42,43,44,49],{},"The ",[15,45,48],{"href":46,"rel":47},"https:\u002F\u002Fwww.fda.gov\u002Fmedical-devices\u002Fpostmarket-requirements-devices\u002Fquality-management-system-regulation-qmsr",[19],"QMSR","\nbecame effective on 2 February 2026 and applies to finished medical-device manufacturers\nthat intend to commercially distribute devices. It incorporates ISO 13485:2016 by reference,\nsubject to applicable FDA requirements. The QMSR is a regulation; the CSA document is guidance.\nKeep those source types distinct when writing a plan.",[11,51,52,53,58,59,64],{},"For a pharmaceutical GMP system, identify the jurisdiction, product and process scope, applicable\nGMP requirements, and local quality procedures. FDA’s device CSA guidance does not apply merely\nbecause the software is a register or because a team calls its work “CSA”. For example, the\nEuropean Commission’s ",[15,54,57],{"href":55,"rel":56},"https:\u002F\u002Fhealth.ec.europa.eu\u002Fmedicinal-products\u002Feudralex\u002Feudralex-volume-4_en",[19],"EudraLex Volume 4 page","\nlists Annex 11 (Computerised Systems) as revised in January 2011 and separately lists the\n",[15,60,63],{"href":61,"rel":62},"https:\u002F\u002Fhealth.ec.europa.eu\u002Fconsultations\u002Fstakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en",[19],"2025 consultation draft",".\nA consultation draft is not the\nfinal guideline. Applicability and any local adoption or transition arrangements still need\nqualified assessment.",[66,67,69],"h3",{"id":68},"what-should-an-australian-medicines-manufacturer-check","What should an Australian medicines manufacturer check?",[11,71,72,73,78],{},"Start with the ",[15,74,77],{"href":75,"rel":76},"https:\u002F\u002Fwww.tga.gov.au\u002Fproducts\u002Fmedicines\u002Fmanufacturing\u002Fmanufacture-medicine\u002Fgood-manufacturing-practice-gmp\u002Fcomplying-pics-guide-good-manufacturing-practice-medicinal-products",[19],"TGA’s PIC\u002FS adoption and applicability guidance",",\nnot the latest overseas publication alone. The TGA identifies PIC\u002FS PE 009-17, dated\n25 August 2023, as applying from 1 September 2025 to the manufacture of medicines, active\npharmaceutical ingredients and sunscreens, subject to exemptions. Annexes 4, 5 and 14 are not\nadopted in Australia. Assess the relevant product scope, manufacturing principles and any\napplicable phased implementation arrangements with the responsible Quality \u002F Regulatory owner.",[11,80,81],{},"For an Australian pharmaceutical register, this means checking the locally applicable GMP\nframework before selecting assurance activities. FDA device-sector CSA guidance and EU\nconsultation drafts do not, by themselves, change Australian requirements. This comparison\nis not a determination of the requirements for an individual site or system.",[26,83,85],{"id":84},"what-changes-in-the-assurance-conversation","What changes in the assurance conversation?",[11,87,88],{},"Distinguish CSA as an assurance approach from the scope of FDA’s specific CSA guidance.\nFor a medical-device or pharmaceutical quality management system, intended use, risk and\nevidence remain useful starting points for assurance planning. FDA’s guidance describes\nrecommendations for its device-sector scope; it does not make a pharmaceutical QMS subject\nto that guidance merely because the team adopts similar methods.",[11,90,91],{},"CSA is not the opposite of CSV. Focusing on the activities that provide confidence in automation\nis compatible with established lifecycle and risk-based validation thinking; it does not justify\ncaricaturing all CSV as exhaustive scripting or paperwork.",[93,94,95,111],"table",{},[96,97,98],"thead",{},[99,100,101,105,108],"tr",{},[102,103,104],"th",{},"Question",[102,106,107],{},"Device production or QMS software",[102,109,110],{},"Pharmaceutical GMP software",[112,113,114,126,137,148],"tbody",{},[99,115,116,120,123],{},[117,118,119],"td",{},"What must be scoped first?",[117,121,122],{},"Whether the system is used in medical-device production or the QMS, and whether the manufacturer and software are within the relevant FDA scope.",[117,124,125],{},"The product, process, jurisdiction, applicable GMP requirements, and the organisation’s procedures.",[99,127,128,131,134],{},[117,129,130],{},"What source can inform the approach?",[117,132,133],{},"The current FDA CSA guidance can inform a risk-based assurance approach for in-scope software; QMSR requirements remain regulatory requirements.",[117,135,136],{},"The applicable local GMP framework and procedures. FDA’s device CSA guidance is not a substitute.",[99,138,139,142,145],{},[117,140,141],{},"What does the plan need to explain?",[117,143,144],{},"Intended use, credible failure consequences, selected activities, results, issues, and the basis for acceptance.",[117,146,147],{},"The same decision logic, mapped to the applicable pharmaceutical requirements and site responsibilities.",[99,149,150,153,156],{},[117,151,152],{},"What must not be assumed?",[117,154,155],{},"That a supplier package or a “low-risk” label proves the configured use is suitable.",[117,157,158],{},"That a device-sector recommendation or a different jurisdiction’s draft changes local GMP duties.",[11,160,161],{},"The table is a scoping aid, not a legal determination. A quality or regulatory owner must confirm\nwhich requirements apply before a team approves its assurance plan.",[26,163,165],{"id":164},"worked-example-a-register-that-says-closed-too-soon","Worked example: a register that says “closed” too soon",[11,167,168,169,173,174,177],{},"Suppose a register shows deviation ",[170,171,172],"code",{},"DEV-2026-0001"," as closed while its linked corrective-action\nrecord ",[170,175,176],{},"CR-0001"," remains open. This is an illustrative failure scenario, not a test result or a\nclaim that a particular system has failed.",[11,179,180],{},"The same visible mismatch can have different assurance implications depending on how the register\nis used:",[93,182,183,196],{},[96,184,185],{},[99,186,187,190,193],{},[102,188,189],{},"Planning item",[102,191,192],{},"Device manufacturer example",[102,194,195],{},"Pharmaceutical GMP example",[112,197,198,209,220,231,242],{},[99,199,200,203,206],{},[117,201,202],{},"Intended use to confirm",[117,204,205],{},"Does the register only help track work, or does a production\u002FQMS process rely on its status or reports?",[117,207,208],{},"Does the register only support follow-up, or do staff rely on it for a GMP decision, escalation, or controlled record?",[99,210,211,214,217],{},[117,212,213],{},"Foreseeable failure",[117,215,216],{},"A missed follow-up leaves a required quality action open while the system presents it as closed. Consider effects on the device QMS and downstream decisions.",[117,218,219],{},"A missed follow-up obscures an open deviation or action. Consider effects on the pharmaceutical quality process and the records or decisions that rely on it.",[99,221,222,225,228],{},[117,223,224],{},"Applicable source",[117,226,227],{},"If in scope, assess the FDA QMSR and use the current FDA CSA guidance as a recommendation for the assurance approach.",[117,229,230],{},"Establish the applicable GMP framework and site procedure first. Do not import FDA device guidance as an exemption.",[99,232,233,236,239],{},[117,234,235],{},"Evidence to plan",[117,237,238],{},"Trace the status requirement to the configured workflow and select checks that can reveal the mismatch. Review relevant supplier evidence, configuration, interfaces, and reports.",[117,240,241],{},"Trace the procedure and intended use to the configured controls and checks. Review relevant supplier evidence, configuration, interfaces, records, and reports.",[99,243,244,247,250],{},[117,245,246],{},"Decision record",[117,248,249],{},"Document scope, risk rationale, chosen activities, actual results, unresolved issues, and authorised acceptance.",[117,251,252],{},"Document the applicable requirements, scope, rationale, activities, actual results, issues, and authorised acceptance.",[11,254,255],{},"Do not assign a risk score from the example alone. Establish the actual use, possible consequences,\nexisting manual or technical controls, and responsible decision-makers. If the register merely\ndisplays status, that may change the assessment; it does not automatically make the use\nlow-risk. If the register triggers a quality or release decision without an independent check, the\nteam should reassess its assumptions and controls.",[26,257,259],{"id":258},"a-practical-planning-sequence","A practical planning sequence",[261,262,263,271,277,283,289,295],"ol",{},[264,265,266,270],"li",{},[267,268,269],"strong",{},"Describe the use."," Name the process, users, information, outputs, and decisions that rely on\nthe system. “Quality register” is not a sufficient intended-use statement.",[264,272,273,276],{},[267,274,275],{},"Confirm the applicable framework."," Record product and jurisdiction scope, applicable\nrequirements, and the quality owner who confirms them. Separate regulations, final guidance,\nlocal procedures, and consultation drafts.",[264,278,279,282],{},[267,280,281],{},"Describe credible failures."," For each important requirement, ask what could happen if the\nfunction fails, gives an incorrect result, or is unavailable. Consider how the failure could be\ndetected and what other controls exist.",[264,284,285,288],{},[267,286,287],{},"Choose proportionate activities."," Use the scope and risk rationale to select supplier\nevidence, configuration review, testing, or other checks. Explain why each activity provides\nuseful evidence for this use; do not select a method only because the team calls it CSA or CSV.",[264,290,291,294],{},[267,292,293],{},"Record what actually happened."," Keep expected outcomes separate from observed results.\nRecord deviations, unresolved issues, review, acceptance authority, and any limitations.",[264,296,297,300],{},[267,298,299],{},"Maintain the decision."," Define which changes to intended use, configuration, data, reports,\ninterfaces, or procedures trigger impact assessment and possible further assurance.",[11,302,303],{},"For the example above, a planning record could start with this blank row and be completed by the\nresponsible team:",[93,305,306,327],{},[96,307,308],{},[99,309,310,313,316,318,321,324],{},[102,311,312],{},"System and intended use",[102,314,315],{},"Requirement and failure scenario",[102,317,224],{},[102,319,320],{},"Selected activity and rationale",[102,322,323],{},"Actual evidence and result",[102,325,326],{},"Issue \u002F acceptance owner",[112,328,329],{},[99,330,331,334,337,340,343,346],{},[117,332,333],{},"To be completed by the system owner",[117,335,336],{},"To be assessed against the actual process",[117,338,339],{},"To be confirmed by Quality \u002F Regulatory",[117,341,342],{},"To be selected and justified",[117,344,345],{},"Not performed in this article",[117,347,348],{},"Named authorised owner required",[11,350,351],{},"This article does not supply an executed protocol, test evidence, risk classification, or acceptance\ndecision. Those belong to the organisation’s controlled process.",[26,353,355],{"id":354},"keep-the-claim-proportionate","Keep the claim proportionate",[11,357,358,359,362],{},"The useful question is not “Can CSA replace CSV?” It is: ",[267,360,361],{},"Which requirements apply to this\nintended use, and what evidence supports the organisation’s acceptance decision?"," A risk-based\napproach is not permission to omit evidence; nor does a larger document set, by itself, establish\nthat the important failure modes were addressed.",[11,364,365,366,370,371,375,376,380],{},"For background on risk-based validation principles, read\n",[15,367,369],{"href":368},"\u002Fblog\u002Fpractical-risk-based-computerised-system-validation","Practical Risk-Based Computerised System Validation",".\nFor a worked register context, see\n",[15,372,374],{"href":373},"\u002Fblog\u002Fvalidating-a-sharepoint-quality-register","Validating a SharePoint Quality Register",".\nWhen you are ready to turn the scope into a practical plan, explore\n",[15,377,379],{"href":378},"\u002Fproduct\u002Fvalidation-planning-for-sustainable-teams","validation planning for sustainable teams",".",[26,382,384],{"id":383},"further-reading-and-training","Further reading and training",[11,386,387,388,393],{},"For an industry perspective on risk assessment and supplier evidence, see\n",[15,389,392],{"href":390,"rel":391},"https:\u002F\u002Fwww.pharmout.net\u002Fservices\u002Fvalidation-services\u002Fcomputer-system-validation\u002F",[19],"PharmOut’s computer system validation overview",".\nThis is a commercial service-provider resource, not regulatory authority.",[11,395,396,397,402],{},"For structured learning on validation, risk management and data integrity, consider the\n",[15,398,401],{"href":399,"rel":400},"https:\u002F\u002Fwww.onlinegmptraining.com\u002Fproduct\u002Fgxp-computerised-systems\u002F",[19],"GxP Computerised Systems course from Online GMP Training",".\nThis is a commercial training option. Confirm the syllabus and source currency with the provider;\ncourse completion does not establish that a particular system is validated or compliant.\nUse the primary regulatory sources below to determine applicable requirements.",[26,404,406],{"id":405},"sources-and-scope-notes","Sources and scope notes",[408,409,410,418,425,433,441,448],"ul",{},[264,411,412,413,417],{},"U.S. Food and Drug Administration, ",[15,414,416],{"href":17,"rel":415},[19],"Computer Software Assurance for Production and Quality\nManagement System Software",",\nfinal guidance, February 2026. Scope and status checked 22 October 2026.",[264,419,412,420,424],{},[15,421,423],{"href":46,"rel":422},[19],"Quality Management System Regulation (QMSR)",".\nEffective 2 February 2026; applicability checked 22 October 2026.",[264,426,427,428,432],{},"Therapeutic Goods Administration, ",[15,429,431],{"href":75,"rel":430},[19],"Complying with the PIC\u002FS Guide to Good Manufacturing\nPractice for medicinal products",".\nAustralian adoption, product scope and exceptions checked 22 October 2026; assess applicable\nimplementation arrangements before relying on the guidance.",[264,434,435,436,440],{},"European Commission, ",[15,437,439],{"href":55,"rel":438},[19],"EudraLex Volume 4",",\nAnnex 11 listing checked 21 October 2026.",[264,442,435,443,447],{},[15,444,446],{"href":61,"rel":445},[19],"consultation on revised Chapter 4 and Annex 11 and new Annex 22",".\nDraft\u002Fconsultation status checked 21 October 2026.",[264,449,412,450,455],{},[15,451,454],{"href":452,"rel":453},"https:\u002F\u002Fwww.fda.gov\u002Fregulatory-information\u002Fsearch-fda-guidance-documents\u002Fgeneral-principles-software-validation",[19],"General Principles of Software Validation",",\nfinal guidance, January 2002. Historical context only; the 2026 CSA guidance supersedes its\nSection 6 for the production and QMS software in its scope.",[11,457,458,461],{},[267,459,460],{},"Scope limits:"," This is general education, not legal advice, a jurisdiction-specific\napplicability decision, or a validated solution design. Confirm the relevant local requirements\nand transitions with the responsible Quality \u002F Regulatory owner before relying on the comparison.",{"title":463,"searchDepth":464,"depth":464,"links":465},"",2,[466,470,471,472,473,474,475],{"id":28,"depth":464,"text":29,"children":467},[468],{"id":68,"depth":469,"text":69},3,{"id":84,"depth":464,"text":85},{"id":164,"depth":464,"text":165},{"id":258,"depth":464,"text":259},{"id":354,"depth":464,"text":355},{"id":383,"depth":464,"text":384},{"id":405,"depth":464,"text":406},"Compliance","2026-10-22","Compare FDA computer software assurance guidance with established validation principles, then scope a register assurance plan to its intended use and applicable requirements.",false,null,"md","\u002Fimages\u002Fblog\u002Fqiksolve-blog-csa-vs-csv-abstract-1200x900.webp","Abstract geometric hero image for CSA vs CSV: What Changes, and Which Guidance Applies?",{},true,"\u002Fblog\u002Fcsa-vs-csv-risk-based-assurance-planning",{"title":5,"description":478},"blog\u002Fcsa-vs-csv-risk-based-assurance-planning",[490,491,492,493,494],"csa","csv","risk-based-validation","software-assurance","quality-register","RPSFMypUtDTR_BkEDbaOyOOGEumYNJs4dIQFgu0f5lo",1792629722282]