Glossary · GxP: good practices
Computerized system validation (CSV) and computer software assurance (CSA)
Also known as: CSV, CSA, Computer system validation, Computer software assurance
Computerized system validation (CSV) is the documented evidence that a computerized system used in GxP work does what it is intended to do, reliably and consistently, throughout its lifecycle. Computer software assurance (CSA) is the risk-based approach described in the FDA guidance “Computer Software Assurance for Production and Quality System Software”, finalized in September 2025, which directs assurance effort to software features that affect product quality and patient safety instead of exhaustive scripted testing.
- GxP
- Pharma
- USA
In one sentence
CSV proves that a GxP computerized system is fit for its intended use; CSA is the FDA's risk-based approach for device production and quality software.
Example
A device manufacturer's electronic complaint-handling tool is assessed under CSA: the reporting function that feeds vigilance decisions gets scripted tests, while low-risk screen layouts are checked through unscripted exploratory testing, recorded in a short summary.
How it applies
- Scope: Systems that create, change, hold or report GxP data or control GxP processes: manufacturing execution, laboratory systems, document management, complaint handling and similar.
- CSV in the EU: Annex 11 asks for validation based on risk management, covering the lifecycle, supplier assessment, data, audit trails, change control and periodic evaluation. GAMP 5 is the common method.
- CSA in the USA: The FDA guidance applies to software used in production or in the quality system of device manufacturers. It asks which features pose high process risk and matches the assurance activity — scripted, unscripted or ad hoc testing, supplier evidence — to that risk.
- Not the device itself: Software that is itself a medical device is developed under IEC 62304 and verified and validated as part of the device; CSV and CSA concern the tools used to make and control products.
- Technical documentation: Both approaches need a record of intended use, risk rationale, the activities performed and the conclusion. CSA reduces paperwork that adds no value; it does not remove the need for evidence.
CSV vs. CSA
CSV is the long-established term for validating GxP computerized systems and in practice often meant heavy, uniformly scripted testing. CSA is not a new legal requirement but a way of doing the same job with effort weighted by risk. The FDA CSA guidance is written for device manufacturers; for drug manufacturers the cGMP and Part 11 expectations remain the reference, and GAMP 5 supports a similar risk-based approach.