--- title: "Computer software assurance: right-sized testing | QLogixCMC" description: "FDA's CSA approach scales validation testing to the risk of each function. What changed from CSV, how to apply it, and an interactive estimate of the effort saved." url: https://qlogixcmc.com/blog/computer-software-assurance-how-much-testing markdown: https://qlogixcmc.com/blog/computer-software-assurance-how-much-testing.md updated: 2026-09-29 publisher: "QLogixCMC (QLogixCMC LLC)" language: en-US --- Validation 29 September 2026 3 min readBy QLogixCMC # Computer software assurance: how much testing does your system actually need? Computer software assurance (CSA) is FDA's risk-based approach to establishing confidence that software used in production and in the quality system does what it is intended to do. Its point is that testing effort follows the risk of each function: scripted, documented testing where a failure could affect product quality or patient safety, and unscripted or ad hoc testing, with the result recorded, everywhere else. Most validation packages still test every function the same way. ## What changed FDA published its computer software assurance guidance in draft in 2022 and finalized it in 2025. It does not change what 21 CFR Part 11, Part 211 or Part 820 require; it changes how much evidence is reasonable for each function. GAMP 5 Second Edition, published in 2022, had already moved the industry's own guidance in the same direction with its emphasis on critical thinking over documents. The practical effect is that a site may stop producing a scripted test, with screenshots, for every menu item, and instead put its effort where a wrong result would matter. The risk assessment that decides which is which becomes the document an inspector reads first. ## The method in four steps - Identify the intended use of the software and of each feature, in the site's own process - Assess the risk of each feature: does a failure affect product quality, patient safety or the integrity of a GMP record directly, indirectly or not at all - Choose the assurance activity to match: scripted testing for high-risk features, unscripted testing for medium, ad hoc testing or vendor evidence for low - Record what was tested, by whom, when, with what result and what was found, in enough detail for the test to be repeated Interactive Testing hours: everything scripted versus scaled to risk High-risk functions12 Medium-risk functions25 Low-risk functions60 Vendor evidence assessed and accepted for standard functions 59%less testing effort with CSA 291 hours scripted end to end, against 120 hours scaled to risk, with the high-risk functions tested the same way in both. - Traditional: every function scripted - CSA: scripted, unscripted and ad hoc by risk Segments left to right: high, medium and low risk; lighter means lower risk. Illustrative planning figures. High-risk functions, the ones whose failure could affect product quality or patient safety, get the same scripted, documented testing under both approaches. The saving is in the medium- and low-risk functions, which CSA covers with unscripted and ad hoc testing whose results are still recorded, and in accepting vendor evidence where it is adequate. ## Where sites go wrong - Treating the vendor's validation package as sufficient without assessing it against the site's configuration and intended use - Scripting everything out of habit, so a 400-page package says little about the ten functions that matter - No risk rationale on file, which turns a lean package into an unexplained one - Unscripted testing that was done but never recorded, so it did not happen as far as an inspector is concerned - No periodic review, so the risk assessment describes a system three releases old ## How QLogixCMC helps QLogixCMC writes the validation master plan and the risk model, runs the risk assessment with the people who use the system, assesses vendor evidence, and executes the scripted tests with the site's users while recording the unscripted ones. The same approach is applied to AI-enabled features, where the intended use and the test records matter more, not less. ## Related services - [Validation and computer software assurance](https://qlogixcmc.com/services/validation-and-csa) - [GxP systems implementation and administration](https://qlogixcmc.com/services/gxp-systems-implementation) - [AI and digital quality](https://qlogixcmc.com/services/ai-and-digital-quality) ## Facing this at your site? Bring the numbers from the figure above. We will say what we would assess first and what we would leave alone. [Request a meeting](https://qlogixcmc.com/contact) ## Questions this post answers ### Is CSA less rigorous than traditional CSV? No. High-risk functions get the same scripted, documented testing as before. CSA removes the uniform documentation from functions whose failure would not affect product quality, patient safety or record integrity, and asks for a risk assessment that explains the difference. ### Will an inspector accept unscripted testing? Yes, when the risk assessment explains why the function qualifies for it, the test and its result are recorded with the tester and the date, and the high-risk functions still carry scripted evidence. Unscripted does not mean unrecorded. ### Can we rely on the vendor's validation package? Where it covers the site's intended use, yes, after assessing the supplier and the package. What the vendor could not test, the site's configuration, its procedures and its integrations, the site tests itself. ## More from the blog - [Technology transfer · 20 October 2026Onshoring drug manufacturing: the tech transfer and validation path to a US site](https://qlogixcmc.com/blog/onshoring-drug-manufacturing-tech-transfer) - [AI and digital quality · 13 October 2026AI in the GMP quality system: what Annex 22 and your next inspector will ask](https://qlogixcmc.com/blog/ai-in-gmp-quality-system-annex-22) - [Sterile manufacturing · 6 October 2026Annex 1 three years on: the contamination control strategy inspectors now read first](https://qlogixcmc.com/blog/annex-1-contamination-control-strategy) ## Talk it through with someone who has run a plant Bring your backlog, your submission timeline or the Form 483. We will tell you plainly what we would do first, what it would take, and what we would leave alone. [Request a meeting](https://qlogixcmc.com/contact)[Email us](mailto:contact@qlogixcmc.com) In the first meeting we cover - What is on your mind: a backlog, a submission, a validation program, an inspection date or a system that is not working - What we would assess first, and what we would leave alone - Whether an engineer on your site, a fixed-scope assessment or a defined deliverable is the right way to start ## More from QLogixCMC - [Onshoring drug manufacturing: the tech transfer and validation path to a US site](https://qlogixcmc.com/blog/onshoring-drug-manufacturing-tech-transfer.md): Bringing a product to a new US site: gap analysis, qualification, method transfer, engineering and PPQ batches and PAI readiness, with an interactive timeline. - [AI in the GMP quality system: what Annex 22 and your next inspector will ask](https://qlogixcmc.com/blog/ai-in-gmp-quality-system-annex-22.md): EU GMP Annex 22: what the draft asks of AI in GMP, the questions inspectors already ask, and an interactive look at AI-drafted deviation investigations. - [Annex 1 three years on: the contamination control strategy inspectors now read first](https://qlogixcmc.com/blog/annex-1-contamination-control-strategy.md): What the revised EU GMP Annex 1 asks of sterile manufacturers, where inspections find gaps, and an interactive EM trend that catches a contamination shift early. - [Comparability for cell, gene and mRNA therapies: proving a process change left the product unchanged](https://qlogixcmc.com/blog/cell-gene-mrna-therapy-comparability.md): Why advanced therapies change process so often, what ICH Q5E and FDA's CGT guidance expect, and an interactive study showing why lot count decides the result. - [Why 21 CFR 211.192 stays the most-cited observation, and how a backlog really comes down](https://qlogixcmc.com/blog/211-192-investigations-backlog.md): What 211.192 requires, the three ways investigations fail, and an interactive burn-down showing when a deviation backlog clears and which records go first. - [QLogixCMC home](https://qlogixcmc.com/index.md): CMC consulting for biotech, pharma and CDMOs: Module 3 from IND to BLA, control strategy, GMP quality systems, validation, CAPA and FDA inspection readiness. - [Services](https://qlogixcmc.com/services.md): QLogixCMC services, on site or remote: CMC and regulatory, quality systems, validation and CSA, investigations and CAPA, inspection readiness, GxP systems and AI. - [Request a meeting](https://qlogixcmc.com/contact.md): Talk to QLogixCMC about a CMC submission, your quality system, validation, an investigation backlog or an FDA inspection. We reply to set up a time. - [llms.txt: a summary of the site for AI assistants](https://qlogixcmc.com/llms.txt) - [Site map](https://qlogixcmc.com/sitemap.md) --- Source: https://qlogixcmc.com/blog/computer-software-assurance-how-much-testing Cite this page as https://qlogixcmc.com/blog/computer-software-assurance-how-much-testing QLogixCMC · contact@qlogixcmc.com · +17146639012