[{"data":1,"prerenderedAt":444},["ShallowReactive",2],{"\u002Fblog\u002Fquality-register-risk-based-assurance-plan":3},{"id":4,"title":5,"author":6,"body":7,"category":424,"date":425,"description":426,"draft":427,"excerpt":428,"extension":429,"heroImage":430,"heroImageAlt":431,"meta":432,"navigation":433,"path":434,"seo":435,"seoTitle":428,"slug":428,"stem":436,"tags":437,"updated":428,"__hash__":443},"blog\u002Fblog\u002Fquality-register-risk-based-assurance-plan.md","From Functional Risk Assessment to Test Cases for a SharePoint Quality Register","QikSolve",{"type":8,"value":9,"toc":411},"minimark",[10,14,23,28,31,50,54,57,146,149,161,247,250,253,290,294,328,331,335,341,344,351,355,358,362,370,379,387,392,408],[11,12,13],"p",{},"How do you turn a functional risk assessment (FRA) into useful test cases for a SharePoint quality\nregister as part of computerised system validation (CSV)? Here, CSV means computerised system\nvalidation, not a comma-separated values file. Start with the decisions people rely on the\nregister to support. For each in-scope requirement and failure mode in the FRA, identify the\ncontrol intended to prevent or detect it, then define a test condition and evidence that would\nshow whether the control works in the configured environment.",[11,15,16,17,22],{},"The worked example below shows traceability for a SharePoint List. It focuses on the step\nfrom an FRA to protocol test cases; it is not an end-to-end validation process, a complete\nprotocol, a prescribed document count, or evidence that a real configuration has passed. The existing\n",[18,19,21],"a",{"href":20},"\u002Fblog\u002Fvalidating-a-sharepoint-quality-register","SharePoint validation overview"," covers the broader\nplanning deliverables; this narrower companion focuses on a reusable requirement-to-test row and\nthree illustrative examples.",[24,25,27],"h2",{"id":26},"the-example-in-scope","The example in scope",[11,29,30],{},"Assume a fictional deviation register uses a SharePoint List to track a stable identifier, owner,\nclassification, status, due date and link to an authoritative deviation record. The broader\nrecord-versus-register boundary and planning deliverables are covered in the SharePoint validation\noverview linked above. This example assumes that intended-use scope has already been defined and\nfocuses on turning in-scope FRA items into checks.",[11,32,33,34,38,39,42,43,49],{},"For Australian medicinal-product ",[35,36,37],"strong",{},"Good Manufacturing Practice (GMP)"," work, a direct check of\nthe ",[35,40,41],{},"Therapeutic Goods Administration (TGA)"," page about the\n",[18,44,48],{"href":45,"rel":46},"https:\u002F\u002Fwww.tga.gov.au\u002Fproducts\u002Fmedicines\u002Fmanufacturing\u002Fmanufacture-medicine\u002Fgood-manufacturing-practice-gmp\u002Fcomplying-pics-guide-good-manufacturing-practice-medicinal-products",[47],"nofollow","Pharmaceutical Inspection Co-operation Scheme (PIC\u002FS) Guide to Good Manufacturing Practice","\non 30 October 2026 identified the Guide dated 25 August 2023 (PE 009-17) and stated that Annexes\n4, 5 and 14 are not adopted in Australia. This identifies the adopted guide, not the applicability\nof every requirement to a particular product or process. Confirm the use case, any exemptions and\ntransition provisions with the current TGA guidance; do not treat a newer international\npublication or proposal as an Australian requirement without checking its adoption and\napplicability.",[24,51,53],{"id":52},"turn-an-fra-risk-into-a-test-case","Turn an FRA risk into a test case",[11,55,56],{},"For each in-scope FRA item, carry its requirement and failure mode into a test that challenges the\ncontrol intended to prevent or detect that failure. Preserve the approved assessment rationale;\ndo not create new risk scores or acceptance thresholds for the example.",[58,59,60,82],"table",{},[61,62,63],"thead",{},[64,65,66,70,73,76,79],"tr",{},[67,68,69],"th",{},"Requirement \u002F intended function",[67,71,72],{},"FRA failure mode and effect",[67,74,75],{},"Proposed control",[67,77,78],{},"Proposed check and expected result",[67,80,81],{},"Evidence and owner",[83,84,85,106,126],"tbody",{},[64,86,87,94,97,100,103],{},[88,89,90,93],"td",{},[35,91,92],{},"R-ID:"," Each register entry retains a distinct, stable RecordID.",[88,95,96],{},"A duplicate or mislinked identifier obscures which event is being followed.",[88,98,99],{},"Use an identifier and uniqueness control supported by the configured design; reconcile imported records.",[88,101,102],{},"Attempt a duplicate through each enabled entry or import path. The duplicate is prevented or detected and isolated before anyone relies on it.",[88,104,105],{},"Test inputs, configuration reference and exception record; System Owner.",[64,107,108,114,117,120,123],{},[88,109,110,113],{},[35,111,112],{},"R-STATUS:"," Reported status agrees with the authoritative record.",[88,115,116],{},"The register shows an event as closed while the controlled record remains open.",[88,118,119],{},"Define who may change status and how the register is reconciled with its source.",[88,121,122],{},"Use a controlled test record with a known status mismatch. The discrepancy is detected, routed and recorded for disposition.",[88,124,125],{},"Expected-versus-actual comparison and reconciliation record; Process Owner.",[64,127,128,134,137,140,143],{},[88,129,130,133],{},[35,131,132],{},"R-REPORT:"," A decision-supporting report returns all eligible records.",[88,135,136],{},"Filters, paging or an incomplete query omit an overdue or unclassified record.",[88,138,139],{},"Define the query, its inclusion rules and a known comparison set.",[88,141,142],{},"Using the fixed five-row fixture below at 15 October 2026, 09:00 Australia\u002FMelbourne, verify four open items, one overdue item and one item missing a due date.",[88,144,145],{},"Input set, query\u002Fconfiguration version and output comparison; Reporting Owner.",[11,147,148],{},"These are illustrative requirements and expected results, not verified SharePoint capabilities or\nobserved test outcomes. Each real requirement needs an owner, a reference to the approved intended\nuse, and acceptance criteria appropriate to the organisation's process.",[11,150,151,152,155,156,160],{},"For the report check, use this ",[35,153,154],{},"synthetic"," fixture with a fixed demonstration clock of 15 October\n2026, 09:00 Australia\u002FMelbourne. Treat an item as overdue when its due date is before 15 October\nand its status is not ",[157,158,159],"code",{},"Closed","; a missing due date is a separate exception.",[58,162,163,179],{},[61,164,165],{},[64,166,167,170,173,176],{},[67,168,169],{},"RecordID",[67,171,172],{},"Status",[67,174,175],{},"Due date",[67,177,178],{},"Expected report check",[83,180,181,195,208,221,234],{},[64,182,183,186,189,192],{},[88,184,185],{},"DEV-2026-0001",[88,187,188],{},"Investigation open",[88,190,191],{},"2026-10-14",[88,193,194],{},"Overdue",[64,196,197,200,202,205],{},[88,198,199],{},"DEV-2026-0002",[88,201,188],{},[88,203,204],{},"2026-10-15",[88,206,207],{},"Due today",[64,209,210,213,215,218],{},[88,211,212],{},"DEV-2026-0003",[88,214,159],{},[88,216,217],{},"2026-10-13",[88,219,220],{},"Closed, not overdue",[64,222,223,226,228,231],{},[88,224,225],{},"DEV-2026-0004",[88,227,188],{},[88,229,230],{},"2026-10-16",[88,232,233],{},"Open, not overdue",[64,235,236,239,241,244],{},[88,237,238],{},"DEV-2026-0005",[88,240,188],{},[88,242,243],{},"—",[88,245,246],{},"Missing due date",[11,248,249],{},"Expected counts are four open items, one closed item, one overdue item, one due today and one\nmissing due date. These are arithmetic expectations for the fixture, not observations from a\nconfigured system.",[11,251,252],{},"Copy and complete this row for each in-scope requirement:",[58,254,255,273],{},[61,256,257],{},[64,258,259,261,263,265,268,270],{},[67,260,69],{},[67,262,72],{},[67,264,75],{},[67,266,267],{},"Check and expected result",[67,269,81],{},[67,271,272],{},"Actual result",[83,274,275],{},[64,276,277,280,282,284,286,288],{},[88,278,279],{}," ",[88,281,279],{},[88,283,279],{},[88,285,279],{},[88,287,279],{},[88,289,279],{},[24,291,293],{"id":292},"derive-test-cases-from-fra-findings","Derive test cases from FRA findings",[295,296,297,304,310,316,322],"ol",{},[298,299,300,303],"li",{},[35,301,302],{},"Select an in-scope FRA finding."," Use the approved assessment and its existing rationale;\ndo not rescore the risk or create new acceptance thresholds for the test plan.",[298,305,306,309],{},[35,307,308],{},"Extract the test-design inputs."," Trace the intended function or requirement, failure mode,\npossible effect and existing control. Identify the configured role, data, report or workflow\npath involved.",[298,311,312,315],{},[35,313,314],{},"Challenge the control."," Choose positive, negative or boundary conditions that exercise the\nfailure mode through the enabled paths relevant to intended use, such as manual entry or\nimport. Use synthetic data for planned examples.",[298,317,318,321],{},[35,319,320],{},"Make the protocol case executable."," State prerequisites, inputs, steps, expected result,\nevidence to retain and the responsible owner. Keep the expected result separate from the actual\nresult, which is recorded only during execution.",[298,323,324,327],{},[35,325,326],{},"Check coverage and traceability."," Link each test back to its FRA finding and control. Record\na rationale when a risk is addressed by another control or is outside the test scope; do not\nimply that the example covers every platform feature.",[11,329,330],{},"The goal is a defensible link from an approved risk finding to a test that can challenge its\ncontrol—not a complete validation package. A focused set of tests can be useful when its scope,\nlimitations and evidence are clear.",[24,332,334],{"id":333},"what-to-do-when-a-check-fails","What to do when a check fails",[11,336,337,338,340],{},"Suppose a duplicate ",[157,339,185],{}," is accepted through an enabled import path. Record the actual\ninput, configuration version, result and evidence. Do not quietly change the expected result or\ndescribe the check as passed.",[11,342,343],{},"The responsible team should assess whether the duplicate can misidentify or mislink an event,\nidentify any affected records, and decide whether use should be restricted while the issue is\ninvestigated. Record remediation and define a retest for the failed path and any affected paths.\nThe accountable acceptance authority—not the example matrix—decides whether remaining limitations\nare acceptable for the intended use.",[11,345,346,347,350],{},"For this example, the failure and all test outcomes are ",[35,348,349],{},"unexecuted",". No real SharePoint\nconfiguration, supplier evidence, risk rating or release decision is represented.",[24,352,354],{"id":353},"keep-the-plan-specific-to-the-system","Keep the plan specific to the system",[11,356,357],{},"Use the matrix as a traceability aid, not a fixed package of documents or evidence that a\nconfiguration passed. If a requirement, control or relevant workflow changes, review whether the\nFRA finding and its linked test cases still represent the intended use. New electronic approvals,\nsignatures, automated classification or a change to the authoritative record are not assumed in\nthis register example.",[24,359,361],{"id":360},"related-reading-and-next-step","Related reading and next step",[11,363,364,365,369],{},"For general risk-based computerised system validation principles, see\n",[18,366,368],{"href":367},"\u002Fblog\u002Fpractical-risk-based-computerised-system-validation","Practical Risk-Based Computerised System Validation",".",[11,371,372,373,378],{},"For another example of mapping functional failure scenarios to testing and procedural controls, see\n",[18,374,377],{"href":375,"rel":376},"https:\u002F\u002Fwww.pharmout.net\u002Fdownloads\u002FPharmOut-risk-assessment-example.pdf",[47],"PharmOut's worked functional-risk assessment example (PDF)",".\nIt illustrates risk-to-control mapping, not a complete test protocol or a prescribed scoring\nmethod. PharmOut is a QikSolve partner; this is supporting reading, not regulatory authority or a\nsubstitute for your organisation's approved risk method.",[11,380,381,382,386],{},"If you are deciding how to plan validation work for a quality system, explore\n",[18,383,385],{"href":384},"\u002Fproduct\u002Fvalidation-planning-for-sustainable-teams","QikSolve's validation-planning guidance",".\nYour organisation remains responsible for its regulatory decisions, configuration, testing,\nacceptance and ongoing control.",[388,389,391],"h3",{"id":390},"source-to-recheck-before-release","Source to recheck before release",[393,394,395,401],"ul",{},[298,396,397],{},[18,398,400],{"href":45,"rel":399},[47],"TGA: Complying with the PIC\u002FS Guide to GMP",[298,402,403],{},[18,404,407],{"href":405,"rel":406},"https:\u002F\u002Fwww.tga.gov.au\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-10\u002Fpics-gmp-guide-annexes.pdf",[47],"TGA-hosted PIC\u002FS GMP Guide Annexes",[11,409,410],{},"Confirm the current source versions, jurisdiction and applicability before making a specific\nregulatory claim. The article's illustrative checks are not legal advice or an assessment of an\norganisation's compliance.",{"title":412,"searchDepth":413,"depth":413,"links":414},"",2,[415,416,417,418,419,420],{"id":26,"depth":413,"text":27},{"id":52,"depth":413,"text":53},{"id":292,"depth":413,"text":293},{"id":333,"depth":413,"text":334},{"id":353,"depth":413,"text":354},{"id":360,"depth":413,"text":361,"children":421},[422],{"id":390,"depth":423,"text":391},3,"Compliance","2026-11-04","A focused computerised system validation (CSV) example showing how to turn a functional risk assessment (FRA) into useful, risk-based protocol tests for a SharePoint quality register.",false,null,"md","\u002Fimages\u002Fblog\u002Fqiksolve-blog-fra-to-test-cases-abstract-1200x900.webp","Nested warm-grey architectural frames with a blue alignment line on a light neutral background.",{},true,"\u002Fblog\u002Fquality-register-risk-based-assurance-plan",{"title":5,"description":426},"blog\u002Fquality-register-risk-based-assurance-plan",[438,439,440,441,442],"risk-based-validation","quality-register","traceability","sharepoint","validation-evidence","SyyzFOpaPD2iruprhog7cO8j5PdhTvARXTRyXPUI_PM",1793835312779]