CSV
Computer System Validation (CSV)
Computer system validation establishes documented evidence that a computerized system consistently performs according to predetermined specifications and quality attributes within its regulated context.
Lifecycle deliverables
- Validation plan defining scope, approach, roles and deliverables
- User requirements specification written to be testable
- Functional and configuration specifications
- Risk assessment linking functions to product quality, safety and data integrity
- Supplier assessment and leverage rationale
- Test strategy: installation, functional, integration, user acceptance
- Traceability matrix from requirement to test evidence
- Defect management and resolution records
- Validation summary report and release decision
Common system types
- MES and electronic batch records
- LIMS, ELN and chromatography data systems
- eQMS — deviations, CAPA, change control, training, documents
- ERP modules affecting GxP decisions (materials, batch status, distribution)
- Historians, SCADA, BMS and EMS
- Serialization and track-and-trace platforms
- Equipment-embedded and instrument control software
Configuration versus customization
Configured commercial software and custom code carry different risk profiles and warrant different assurance depth. Custom code introduces defects the supplier has never tested; configuration changes can be equally consequential when they alter calculations, workflows, permissions or record retention.
Keeping systems validated
Validation status is a maintained condition. Upgrades, patches, interface changes, new users and new business processes each have the potential to invalidate assumptions made during the original project. A regression strategy tied to risk keeps upgrade cycles manageable.
Primary references
- FDA — Process Validation: General Principles and Practices
- FDA — Computer Software Assurance for Production and Quality System Software
- FDA — 21 CFR Part 11, Electronic Records; Electronic Signatures
- FDA — Data Integrity and Compliance With Drug CGMP
- FDA — General Principles of Software Validation
Information published on ValidationEngineering.com is educational and informational. It is not legal or regulatory advice and is not a guarantee of regulatory compliance or of any inspection outcome. Organizations remain responsible for their own quality decisions.
FAQ
CSV — common questions
- What is GAMP 5 software categorization used for?
- It scales effort to risk: infrastructure and non-configured products need less bespoke testing than configured products and custom applications. Categorization justifies the testing approach; it does not remove the need to verify intended use.
- How much supplier documentation can be leveraged?
- As much as a documented supplier assessment supports. A qualified supplier with demonstrable development and testing controls can reduce your verification scope, provided you still test the configuration and business process you actually use.
- Does every system need full validation?
- No. GxP impact and intended use determine scope. Systems with no impact on product quality, patient safety or data integrity should be handled by IT change control, not validated.
Next step
Need CSV resources or remediation?
Tell us which systems are in scope and what stage you are in.