Computer software assurance (CSA) is the FDA’s risk-based approach to establishing confidence that software used in production and quality systems is fit for its intended use. The guidance was first published as a draft in 2022 and was written for medical device production and quality system software, but its thinking is widely applied across pharma alongside GAMP 5 Second Edition.
CSA asks a simple question first: if this feature fails, could it affect product quality or patient safety? High-risk features get rigorous, scripted testing; lower-risk features can be assured with unscripted, ad hoc or exploratory testing, and vendor evidence can be leveraged. The aim is to spend validation effort where it reduces risk, rather than generating paperwork for every screen.
Why it matters in GMP
Traditional CSV often produced thick binders of screenshots for low-risk functions while critical functions received no more attention than anything else. CSA and GAMP 5 Second Edition both push towards critical thinking, smarter testing and better use of supplier activities — while still expecting clear, traceable evidence that the system is fit for purpose.
- Identify intended use and classify each feature by risk.
- Choose the assurance activity that fits the risk.
- Record enough evidence to show what was tested and the outcome.
How Swat iQua Suite handles it
Swat iQua Suite includes a computerised system assurance register: a controlled list of system requirements with low, medium or high risk levels, approved with an e-signature by someone other than the owner. Approved requirements cannot be edited — a controlled correction creates a new version and keeps the original — and each requirement is traced to its test cases and executions. A coverage report shows which approved requirements have a verified execution and where the gaps are.