Computerized Systems Validation & Assurance

A risk-based assurance framework

Intended use drives everything. Two organizations can run the same software and legitimately arrive at different assurance approaches because the system supports different decisions and different records.

A workable framework establishes intended use, assesses risk against that use, selects assurance activities proportionate to the risk, and records the evidence and the reasoning. Critical thinking is the deliverable; documents are the residue.

• Define intended use and system boundaries
• Classify the system and identify high-risk functions
• Select assurance activities — unscripted, scripted, or a combination
• Establish requirements and traceability where risk warrants it
• Leverage supplier activities where the supplier has been assessed
• Record results, defects and the release decision

Lifecycle controls after go-live

Most inspection findings involve the operational phase, not the initial project. Access control drifts, audit trails stop being reviewed, changes are made without impact assessment, and periodic review is deferred until an audit forces it.

• Change control and configuration management
• Access management and periodic user access review
• Audit trail review procedures with defined frequency and scope
• Backup, restore and business continuity verification
• Incident and deviation handling
• Periodic review with documented conclusions
• Decommissioning and record retention/migration

Supplier assessment and leveraging vendor work

Suppliers do meaningful quality work. Leveraging it is legitimate and encouraged where the supplier's development, testing and release practices have been assessed and the assessment is documented. What cannot be delegated is the regulated organization's responsibility for the system as configured and used in its own environment.

Legacy systems

Legacy systems rarely have complete documentation. A defensible path is a documented gap assessment against current expectations, risk-ranked remediation, compensating controls where technical fixes are not feasible, and a retirement or replacement plan where the residual risk cannot be reduced.