CSV practice

What is computer system validation (CSV)?

2026-10-30 · Author: M.A., Validation Lead

What computer system validation means

In pharmaceutical, biotech and medical device manufacturing, software that touches product quality, patient safety or the integrity of regulated records has to be shown to be fit for its intended use. Computer system validation is how that is shown: a planned set of activities and documents that let an inspector or auditor see what the system is supposed to do, how that was verified, and who reviewed the evidence.

The scope covers laboratory systems such as LIMS and chromatography data systems, manufacturing systems such as MES and SCADA, quality systems such as an eQMS or document management, ERP modules with GxP impact, and increasingly cloud and SaaS applications. The intended use sets the scope: the same product can need full validation at one company and very little at another.

What the regulations require

Annex 11 applies to all forms of computerised systems used as part of GMP-regulated activities. The application should be validated and the IT infrastructure qualified. EU GMP Annex 11 — Computerised Systems

Risk management should be applied throughout the lifecycle of the computerised system, taking into account patient safety, data integrity and product quality. EU GMP Annex 11, section 1

Systems that hold electronic records must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. 21 CFR §11.10(a)

Appropriate controls must be exercised over computer or related systems so that changes to master production and control records, or other records, are made only by authorised personnel. 21 CFR §211.68(b)

The validation lifecycle and its deliverables

GAMP 5 describes a risk-based lifecycle running from concept through project and operation to retirement, and groups software into categories 1, 3, 4 and 5, from infrastructure software to custom applications. ISPE GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition (July 2022)

Whatever the methodology, a validation package usually contains the same chain of documents, each building on the one before it:

• Validation plan: scope, approach, roles, the deliverables to be produced and the acceptance criteria.
• User Requirements Specification (URS): what the system must do for its intended use, written so each requirement can be tested.
• Functional and design specifications (FS, DS): how the system, as configured, meets each requirement.
• Risk assessment, often a functional risk assessment (FRA): which functions affect patient safety, product quality or data integrity, and how hard each must be tested.
• Test protocols and execution records (IQ, OQ, PQ or equivalent): objective evidence that the system works as specified.
• Requirements traceability matrix (RTM): every requirement linked to its risk, its tests and their results.
• Validation summary report: what was done, the deviations and how they were resolved, and the conclusion that the system is fit for use.

Go-live does not end validation. The validated state is maintained through change control, periodic review, incident and deviation handling, backup and restore checks, and finally retirement with the data migrated or archived.

Computerised systems should be periodically evaluated to confirm that they remain in a valid state and are compliant with GMP. EU GMP Annex 11, section 11

Risk-based validation and CSA

Validation effort should follow risk. A function that calculates a batch release result deserves rigorous, scripted testing; a report layout option may need little more than a documented check. Testing everything with the same depth is not more thorough. It buries the tests that matter among the ones that do not.

FDA recommends a risk-based approach to establishing confidence in production and quality system software, with less burdensome assurance activities, including unscripted testing, where the risk is lower. FDA, Computer Software Assurance for Production and Quality Management System Software (final guidance, 3 February 2026; supersedes the 24 September 2025 version)

Computer Software Assurance is often presented as a replacement for CSV. It reads better as a change of emphasis inside the same discipline: critical thinking first, documentation in proportion to risk, and evidence that is useful rather than voluminous.

Where validation usually goes wrong

• Requirements that cannot be tested, such as “the system shall be user-friendly”, so nothing can trace to them.
• Risk assessments written after the tests, to justify what was already done.
• Traceability that exists in the matrix but not in the evidence: a test listed against a requirement it never exercised.
• Supplier documentation accepted without assessing the supplier or reading what the documents cover.
• Validation treated as a project milestone, with no change control or periodic review once the system is live.

Where Valready fits

Valready is an AI-assisted Computer System Validation (CSV) documentation platform — every document is reviewed by a human before release. It drafts the deliverables above, from the URS to the traceability matrix, keeps the links between them, and marks every export as a draft. AI never approves: a named reviewer accepts or rejects each document, and approval happens in your own QMS.