Quick Summary
The FDA's Computer Software Assurance (CSA) initiative is a risk-based way to optimize validation — not replace it. CSA concepts are acceptable under current regulations, and the FDA is actively encouraging the approach. This article explains what CSA is, how it relates to your existing Computer System Validation (CSV) and QA procedures, and the flexible entry points USDM offers to help life sciences companies adopt CSA principles within their own policies and SOPs.
The life sciences industry’s quest for improved patient safety and product quality is heavily dependent on the use of technology throughout its business processes. These technologies include on-premise, cloud, enterprise, manufacturing, laboratory, instruments, and equipment.
To support this quest, the industry and the U.S. Food and Drug Administration (FDA) are working together to optimize the process through which these systems and technologies are validated. This initiative, led by the FDA, is called Computer Software Assurance (CSA). CSA is the FDA’s endorsement of and “how to improve” the risk-based approach to validation.
CSA is a process to optimize validation, not a replacement of validation. CSA concepts are acceptable under current regulations. The FDA is actively encouraging the approach and has confirmed that inspectors are being aligned with CSA. Guidance on CSA is on the FDA’s A list and planned for release in December 2021.
The Center for Devices and Radiological Health (CDRH) is working in cooperation with the Center for Biologics Evaluation and Research (CBER) and the Center for Drug Evaluation and Research (CDER) on CSA, making the guidance applicable to the life sciences industry.
CSA is a process to optimize validation — not a replacement for it. The goal is to shift effort away from documentation for documentation's sake and toward the testing and assurance activities that actually reduce risk.
CSV and CSA: Same Goal, Smarter Effort
As the FDA moves forward, USDM fully understands, accepts, and respects that computer systems must be validated for each company and the users’ intended use. Additionally, these systems can only be validated by the company under their respective policies and procedures.
The shift from a traditional CSV mindset to a CSA mindset is fundamentally about applying critical thinking and risk to decide how much assurance a given system feature needs — based on its impact to patient safety, product quality, and data integrity. High-risk features earn rigorous, scripted testing; lower-risk features can rely on lighter, unscripted, or vendor-leveraged approaches. The result is the same level of confidence with far less low-value paperwork.
A Framework to Adopt CSA Within Your Existing SOPs
USDM offers a framework on how a life sciences company can begin to understand and adopt some of the CSA principles now and do so within their company’s existing Computer System Validation (CSV) and QA Standard Operating Procedures (SOPs). USDM’s CSA framework offers flexible, adaptable points of entry that fit your unique need – a virtual workshop, training, a validation process assessment, support to pilot a CSA project, or revision to your validation methodology, and SOPs to adopt the CSA principals. The steps you take will get you closer to realizing the many benefits of CSA processes and procedures.
Flexible Entry Points to a CSA Program
- Educate — virtual workshops and training to align Quality and IT on CSA principles.
- Assess — a validation process assessment to find where critical thinking and risk can replace low-value documentation.
- Pilot — hands-on support to run a CSA pilot on a real system and prove the approach.
- Operationalize — revise your validation methodology and SOPs so CSA principles become repeatable across your portfolio.
USDM has been supporting life sciences organizations to validate their IT systems through the continually evolving approach to validation. Further, USDM is on the leading edge of best practices in validation for advanced technologies (i.e., relational technologies, shared services, advanced analytics and AI/ML tools, IoT, and SaaS systems.). USDM is working closely with the FDA to ensure our support to life sciences companies is current and aligned with recommended practices.
A modern CSA program also benefits from sustaining validated systems over time. Approaches such as continuous compliance and Cloud Assurance help keep cloud and SaaS systems in a validated state as vendors push frequent updates — and a mature validation lifecycle management practice keeps these efficiencies in place long after the initial project. For organizations extending CSA thinking to emerging AI/ML and analytics tools, the same risk-based discipline maps directly onto AI governance and compliance.
CSA Program Deliverables
- CSA training and education
- Preliminary feedback and recommendations on your CSA plan and roadmap
- Summary report detailing recommendations and next steps
- CSA roadmap
- CSA Assurance Plan
- Complete validation sets for on-premise and cloud applications
Why Partner with USDM
- 20+ years of life sciences domain expertise
- Thousands of GxP projects delivered globally
- Bridge the gap between Quality and IT
- Flexible delivery models to meet your need
- Reduced risk with qualified SMEs and best-in-class project management
- Efficient onboarding and knowledge transfer built on virtual playbook best practices
Learn how USDM deployed CSA methodologies to drive meaningful efficiencies for a large biotech customer in this case study.
Additional CSA References
- Blog: Top CSA Insights
- Webinar: Update from the FDA on CSV Changes
- White Paper: CSA: What You Need to Know About the FDA’s Upcoming Guidance
- White Paper: Regulated GxP Workloads in the Public Cloud
- Blog: Lessons from USDM’s Cloud Assurance Automated Testing Tool for Box GxP
FAQ: Aligning CSV with the FDA's CSA Approach
What is Computer Software Assurance (CSA)?
CSA is an FDA-led initiative that endorses and explains how to improve the risk-based approach to validation. It is the FDA's guidance on optimizing how systems and technologies are validated, with the Center for Devices and Radiological Health (CDRH) working alongside CBER and CDER to make it applicable across the life sciences industry.
Does CSA replace Computer System Validation (CSV)?
No. CSA is a process to optimize validation, not a replacement for it. Computer systems still must be validated for each company and the users' intended use, under that company's own policies and procedures. CSA simply directs effort toward the activities that most reduce risk and away from low-value documentation.
Is CSA acceptable under current regulations?
Yes. According to this article, CSA concepts are acceptable under current regulations. The FDA is actively encouraging the approach and has confirmed that inspectors are being aligned with CSA.
How can my company start adopting CSA principles now?
You can begin within your existing CSV and QA SOPs. USDM offers flexible entry points — a virtual workshop, training, a validation process assessment, support to pilot a CSA project, or revisions to your validation methodology and SOPs — so you can adopt CSA principles at a pace and scope that fit your organization.
How does CSA relate to data integrity and 21 CFR Part 11?
CSA's risk-based thinking focuses validation effort on the features that most affect patient safety, product quality, and data integrity. That same discipline supports compliance obligations such as 21 CFR Part 11 for electronic records and signatures, ensuring high-risk functionality receives the rigor it requires.
Ready to Optimize Your Validation Program?
USDM helps life sciences companies adopt CSA principles within their existing CSV and QA procedures — through workshops, assessments, pilots, and methodology revisions. Contact us to discuss your unique approach to CSA today.
About the Author
Jim Macdonell is the Vice President of Medical Device Solutions at USDM Life Sciences. Jim is responsible for driving solutions for our medical device customers and staying at the forefront of regulatory and technology challenges facing the medical device industry. Jim is a seasoned consulting leader with more than 25 years of experience defining client strategies and building and managing implementation teams.