How-to guide · Computer System Validation

CSV vs CSA: what changed and what still needs documenting

Team ValidLeaf · September 2026 · 6 min read

In 2022, FDA issued draft guidance on Computer Software Assurance (CSA) for production and quality system software — and the industry promptly split into two camps: those who heard "less documentation" and those who heard "no validation." Both are wrong. Here's what CSA actually changes, what it leaves alone, and what it means for a mid-size manufacturer.

What CSA actually is

CSA is a risk-based framework for establishing confidence in software used in production and quality systems. Its core idea: apply critical thinking to decide how much assurance each software feature needs, based on the risk that the feature fails and the risk that the failure harms product quality or safety. High-risk features get rigorous, scripted testing. Low-risk features can rely on lighter assurance — including unscripted testing and leveraging existing verification — as long as the rationale is documented.

What changed

• Less scripted documentation for low-risk software. Traditional CSV often produced the same exhaustive protocol package regardless of risk. CSA explicitly permits leaner evidence where risk is low.
• Unscripted testing counts — when justified. Exploratory and ad-hoc testing, with documented intent and results, can satisfy assurance needs for lower-risk features.
• Focus on intended use. Assurance effort centers on how the software is actually used in your process, not on validating every capability the vendor shipped.
• Critical thinking is a deliverable. The risk assessment and the reasoning behind your assurance choices are themselves evidence — document them.

What did NOT change

• High-risk software still needs rigorous validation. Anything that directly affects product quality, safety, or data integrity still gets the full treatment: requirements, risk assessment, scripted testing, traceability.
• 21 CFR Part 11 still applies. CSA doesn't touch electronic records and signatures — audit trails, access controls, and validation of systems holding regulated records remain required.
• You still need objective evidence. "We thought about it" isn't assurance. The evidence gets leaner for low risk; it doesn't disappear.
• Predicate rules are untouched. Your GMP obligations to validate and control haven't moved a millimeter.

What this means for a mid-size manufacturer

• Risk-rank your systems first. Most plants have never formally classified their software by risk. That classification is now the foundation of your entire approach — do it before anything else.
• Document the reasoning, not just the testing. A one-page risk assessment explaining why a feature got light assurance is more valuable than a fifty-page protocol nobody believes.
• Keep scripted testing where risk is high. Batch release calculations, environmental monitoring alarms, label-printing logic — these stay rigorous.
• Evolve your CSV procedures; don't discard them. Update your SOPs to incorporate risk-based assurance levels rather than starting from zero — inspectors respect a thoughtful evolution more than a fashionable rewrite.

Where to start

Inventory your computerized systems, classify each by risk to product quality, and gap-assess your current validation evidence against a risk-based standard. The result is usually good news: less work than traditional CSV demanded, focused where it actually matters. Our CSV practice builds exactly this — risk-ranked assurance packages sized for mid-size operations.