Risk-Based Digital Validation for GxP Computerized Systems: Aligning CSA, QMSR, and GAMP 5 Second Edition with ValGenesis iVal™

 

Executive Summary

The move toward digitalization requires best-in-class digital tools to manage the intricacies of transformed business processes and realize the full potential of that transformation.

Expeditious strides in genetic engineering have enabled new treatments for previously unmet medical needs. At the same time, increasingly complex manufacturing environments and lessons learned from public health disruptions such as COVID-19 continue to pressure manufacturers to bring drugs to market faster while ensuring that product quality, patient safety, and data integrity are not compromised.

Despite these new challenges, validation remains a foundational discipline in the life sciences industry. Historically, it has been associated with extensive testing, copious documentation, and labor-intensive processes. However, validation practices and supporting technologies have evolved significantly.

Vendors now offer robust, purpose-built technology, such as the ValGenesis Validation Lifecycle Suite, with ValGenesis iVal™ serving as the validation lifecycle management system at the core of a unified digital validation approach. This digital, paperless approach affords users greater control in today’s constantly evolving manufacturing environment, which requires agility, shorter switchover times in multiproduct facilities, and stronger inspection readiness. iVal supports end-to-end validation by automating authoring, execution, and traceability while helping standardize validation and accelerate time to market across the enterprise.

This paper examines the critical thinking approach to computer software assurance (CSA) and the need for a robust risk management program to support evolving regulatory expectations and standards, such as the FDA’s current CSA guidance and ISPE’s GAMP 5 Second Edition. It also highlights technologies and methodologies that support modern risk-based validation practices in the life sciences industry (FDA, 2026a).

 

Key Regulations and Guidelines

Computer Software Assurance (CSA)

The U.S Food and Drug Administration’s Center for Devices and Radiological Health (CDRH) launched the Case for Quality (CfQ) initiative in 2011 to promote higher device quality and more effective quality practices. Building on those principles, the FDA’s Computer Software Assurance for Production and Quality Management System Software guidance describes a risk-based approach that focuses assurance activities on intended use, process risk, and objective evidence rather than on unnecessary documentation (FDA, 2026a).

For broader pharmaceutical and biotech computerized systems, the same principles should be applied alongside GAMP 5 Second Edition and applicable GMP and data integrity expectations.

Figure 1 illustrates the shift from traditional CSV toward a risk-based CSA approach, with greater emphasis on critical thinking and assurance rather than documentation.

 

 

Similarities and Differences Between Testing Methods

Scripted Testing

Traditional validation requires scripted testing. A significant amount of time is needed to:

1. Develop the test script.

2. Perform dry runs to avoid deviations during actual validation.

3. Maintain the test scripts for any updates to requirements.

Qualified individuals, such as validation engineers with appropriate education, experience, and training, develop the test scripts. However, they may not be the end users. They perform a quality control (QC) function, which is overseen by quality assurance (QA), on a system they may not understand, especially if the solution is new.

Therefore, developing the test scripts requires training on the system (or equipment, instrument, method, or process). Scripted testing remains appropriate when additional rigor is warranted. For software features, functions, or operations that pose high process risk, organizations may use scripted testing or a hybrid approach that combines scripted and unscripted testing, scaled appropriately. The objective is to show that the software performs as intended for the identified risk (FDA, 2026a).

For scripted testing, test cases, expected results, and required objective evidence are documented before execution. The appropriate level of detail, review, approval, repeatability, traceability, and auditability should be based on the software’s intended use and associated process risk. Any failures or deviations identified during execution should be documented, assessed, and resolved or appropriately justified according to established procedures (FDA, 2026a).

Ad Hoc Testing

The objective of ad hoc testing is to challenge the system, identify errors, and reveal issues that may not surface during tightly scripted execution. Ad hoc testing can be useful as part of a risk-based assurance approach, particularly when flexibility is needed to investigate system behavior. Although preapproval of a formal protocol may not always be required, testing should still be performed by qualified personnel and documented with sufficient objective evidence to support the outcome during an audit or inspection (FDA, 2026a).

Unscripted Testing

Unscripted testing does not mean uncontrolled testing. In unscripted testing, the tester applies knowledge of intended use, system behavior, prior results, and risk to select the most appropriate way to evaluate the software and document the outcome with sufficient objective evidence (FDA, 2026a).

 

Good Automated Manufacturing Practice (GAMP)

ISPE GAMP 5 Second Edition remains the leading good-practice guide for GxP computerized systems. It retains the first edition’s principles and framework while expanding their application to modern environments, including greater supplier and service-provider involvement, evolving software development approaches, and wider use of software tools and automation (ISPE, 2022).

The GAMP software categories help organizations classify computerized system components according to their nature and complexity and help inform an appropriate lifecycle approach (ISPE, 2022).

The categories remain unchanged in GAMP 5 Second Edition:

• Category 1: Infrastructure

• Category 3: Non-configurable (i.e., COTS)

• Category 4: Configurable

• Category 5: Custom

Note: GAMP 5 does not include Category 2. Firmware should be assessed according to the nature, complexity, and intended use of its software components.

A Risk-Based Approach

A risk-based approach has long been recognized as preferred practice and remains central to current CSA and GAMP 5 Second Edition thinking. The level of effort, formality, and documentation should be commensurate with the intended use and risk, with rigor focused where product quality, patient safety, data integrity, or process integrity could be affected.

Over-validation unnecessarily taxes resources and costs the industry millions of dollars. Furthermore, risk management was often incorrectly perceived as an early-stage task that simply categorized items as high, medium, or low risk. Once established and approved, projects moved forward, and risk was largely forgotten under the assumption that it had already been assessed (ISPE, 2022; ICH, 2023).

Misconceptions about risk persist today. It is important to understand that risk must be managed throughout the life of a system.

 

Meeting CSA, GAMP 5, and QMSR Expectations

Meeting current CSA, QMSR, and GAMP 5 expectations starts with a clear understanding of intended use and the requirements that define how the system should perform. A digital validation platform should help teams manage those requirements across the lifecycle, connect them to risk decisions, apply fit-for-purpose assurance activities, and maintain objective evidence, traceability, and change control (FDA, 2026a).

Requirements Management

Requirements elicitation and development skills are often lacking. Yet good requirements are the essential building blocks of any system, whether it is a computerized system, equipment, instruments, methods, or processes. Without good requirements, a system cannot be expected to perform as intended, meet user needs, or support successful validation.

Validation demonstrates that a system performs as intended, and intended performance is designed through requirements. Requirements originate with system users. Without a clear understanding of what users want or need, a system cannot be configured to meet those needs, making it impossible to demonstrate that the system performs as intended.

CSA and GAMP 5 expectations iVal supports:

1. Assess intended use and software scope

2. Manage requirements, specifications, and lifecycle traceability

3. Support requirement-level or function-level risk assessments

4. Apply risk-based assurance approaches and testing methods

5. Manage Agile and traditional validation workflows

6. Perform change impact assessments and periodic review

7. Capture digital objective evidence, audit trails, and approvals

8. Support supplier or service-provider evidence where justified

9. Maintain inspection-ready records in a controlled repository

10. Support standardized workflows, role-based access, and data integrity controls

 

The Four “C” Objectives

Several factors must be considered throughout the life of a system. Here are four:

1. Compliant

2. Consistent

3. Complete

4. Continuous
   
   

1. Compliant

The compliant objective signifies that the practice is compliant with the process, and the process complies with regulatory requirements, resulting in a quality output. ValGenesis iVal helps users support compliance through controlled workflows, approved templates, technical controls, and audit-ready records.

Technical controls within a validated system help enforce approved processes and reduce reliance on manual execution. Organizations can have greater confidence that required procedures are consistently followed and documented.

2. Consistent

Processes, practices, templates, controls, and procedures must be applied consistently across teams, systems, and sites. Inconsistent execution can create unexpected outcomes, make problems harder to identify and correct, and increase the risk of errors, deviations, and compliance gaps that may affect product quality or patient safety.

Auditors and inspectors often evaluate consistency across sites and functions to identify gaps in execution. A controlled digital validation process can help reduce variation by guiding users through approved templates, workflows, quality checks, and authorization steps. ValGenesis iVal supports this objective by helping organizations standardize validation practices, apply controlled workflows, and maintain consistent records across the validation lifecycle.

3. Complete

Effective risk management requires a complete view of the system, process, or activity being assessed. If all relevant factors are not considered, risks may be overlooked and important work may need to be repeated.

In this context, complete means end-to-end and comprehensive. Risk management activities should address all relevant areas and continue until risk has been appropriately controlled. Risk controls may reduce the probability or severity of harm, improve detectability, or avoid the risk where feasible. Residual risk should be evaluated and formally accepted when it meets established acceptance criteria. If risk cannot be adequately controlled, it may be necessary to revisit the design, remove a feature or function, introduce additional controls, or reconsider the system altogether (ICH, 2023).

ValGenesis iVal guides users through a connected validation process in which risk, testing, evidence, approvals, and controls are managed in a complete and traceable manner. Templates developed by authorized users and approved by QA help ensure that standards are applied consistently and that required activities are completed.

4. Continuous

Risk management is often incorrectly viewed as an activity performed only at the beginning of a project. In reality, risk management is a continuous process that extends throughout the validation lifecycle, from inception through retirement. Systems evolve over time as processes change, technology advances, and new risks emerge. As a result, risk must be continually evaluated and managed throughout the lifecycle.

ValGenesis iVal, part of the ValGenesis Validation Lifecycle Suite, enables organizations to manage risk through integrated risk assessments, configurable workflows, and standardized templates that support risk-based CSV and CSA practices across the validation lifecycle.

Users can evaluate risk, document mitigation actions, and connect risk outcomes to the appropriate validation activities, records, and controls. Lifecycle flow includes action planning, risk control, and ongoing monitoring, creating a feedback loop that helps maintain a controlled and audit-ready state. When risk outcomes or change events require additional controls or reassessment, iVal supports another iteration of the lifecycle to help ensure risks remain appropriately managed.

 

Testing Methodologies

ValGenesis iVal supports a broad range of testing methodologies that can be aligned to risk outcomes and assurance needs. This is important because a risk management process, through risk assessment, must include actions to eliminate risk or, if elimination is not possible, mitigate risk to an acceptable level.

Risk elimination and mitigation can be accomplished by implementing and testing risk controls.

When performing a risk assessment, questions are raised, values are selected, and risk outcomes are determined. The system analyzes the risk outcome and applies business rules. Business rules can be used to assign content types.

After requirements are developed, testing is required. The system identifies the appropriate test methodology based on risk outcomes. This relationship is discussed in more detail in subsequent sections.

Test Types Commonly Used to Test Systems

The FDA’s CSA guidance recognizes scripted, hybrid, and unscripted testing as assurance activity approaches that may be applied based on intended use and risk (FDA, 2026a).

Additional test types and test design techniques may be used within those approaches, depending on the software function, intended use, and risk. Examples include:

• Positive

• Negative

• Performance

• Security

• Boundary

• White box

• Gray box

• Black box

Performance testing evaluates the system’s ability to operate at acceptable levels. Security testing helps ensure that the system is protected from unauthorized access and other security risks. Boundary testing confirms that boundaries, such as the upper limit of quantitation (ULOQ) and the lower limit of quantitation (LLOQ), are enforced. It also verifies values near boundaries, including integer and decimal values, as well as values beyond established limits.

 

ValGenesis iVal™ for Risk-Based Digital Validation

 

Prerequisites

ValGenesis iVal supports a logical, risk-based validation progression across the lifecycle. With configurable templates, automated workflows, integrated risk assessment, and support for Agile validation and software development lifecycle (SDLC) processes, iVal helps organizations standardize validation activities while maintaining compliance, traceability, and audit readiness. Each stage is described below, beginning with the core prerequisites configured during implementation (ISPE, 2022).

 

Content Types

A content type represents a validation document of record used within the validation lifecycle. It could be a requirements document, such as a user requirements specification (URS), functional requirements specification (FRS), or design specification (DS). It could also be a qualification protocol, such as an installation qualification (IQ), operational qualification (OQ), or performance qualification (PQ). The system also supports content types for validation plans and validation summary reports.

For each content type, there may be one or more templates. For example, a company can have several different IQ templates. There is a one-to-many relationship between content types and templates.

Templates

Templates are used to standardize the structure, required fields, and approvals for each content type. In iVal, configurable validation templates and automated workflows help maintain consistency, reduce redundancy, and support fit-for-purpose execution across qualification and validation activities. Different templates may be used for different validation approaches, test methods, or organizational needs.

During configuration, content types are developed for different testing methodologies. Once established, templates can be developed for each type of content required based on the outcome of the risk assessment.

Risk and Process Conditions

A risk process can be configured in iVal to identify the process conditions that should be applied after a risk outcome is determined. There is a direct relationship between process conditions, content types, and templates. This allows the appropriate validation activity, control, or record to be triggered based on the outcome of the risk process. When these relationships are configured in advance, risk control, elimination, or mitigation can follow a controlled, standardized, and auditable path.

Business Rules

Business rules are configured in the system to apply predefined logic after a risk score or risk outcome has been determined. These rules use defined thresholds, conditions, or ranges to map the risk result to the appropriate downstream process condition.

When a risk assessment result falls within a defined range, the corresponding process condition is triggered. The process condition determines the required content type and associated template or templates for the validation activity. This helps ensure that the appropriate test deliverable, control, or follow-up record is generated to verify that the identified risk has been controlled or mitigated to an acceptable level.

 

Configuring the Risk Framework in iVal

Once the necessary prerequisites are in place, organizations configure the risk framework in iVal by defining the framework and specifying the templates used for risk identification, analysis, evaluation, mitigation planning, and risk control. Together, these configuration elements determine how risk information is captured, assessed, routed, and managed throughout the validation lifecycle.

Framework Definition

The framework definition establishes the structure of the risk framework. Organizations define the framework name, applicable domain or solution, associated validation program, and the data elements that must be captured throughout the risk process. These settings determine how the framework is configured and how the associated templates operate within the organization’s validation process.

The framework definition also identifies which templates are included in the risk framework. For each template, iVal allows organizations to define the data, business rules, and records required to support consistent risk evaluation and control. These configured settings help ensure risk management activities remain structured, traceable, and aligned with the organization’s validation process.

Risk Identification Template

The Risk Identification Template is used to identify and document potential risks associated with a requirement, function, process, system, or validation activity. It captures the initial risk context, including what could be affected and why further analysis may be required.

By documenting risk information in a controlled template, organizations can consistently identify potential risks and determine whether additional analysis is appropriate.

Risk Analysis Template

The Risk Analysis Template supports detailed analysis of identified risks. Users document potential failure scenarios, causes, effects, and other configured risk factors needed to understand how a risk could occur and the impact it may have.

The information captured during risk analysis provides the foundation for consistent downstream risk evaluation and helps organizations make more informed mitigation decisions.

Risk Evaluation Template

The Risk Evaluation Template uses the configured risk model and scoring logic to evaluate analyzed risk and determine the appropriate risk outcome or classification. Configured business rules can then map the risk result to the appropriate downstream process condition.

By applying predefined evaluation criteria, the template promotes consistency and reduces reliance on subjective judgment alone. The resulting risk outcome helps determine whether mitigation is required and what downstream actions should be taken.

Risk Control Template

The Risk Control Template documents and verifies that planned mitigation activities have been completed and that appropriate controls have been implemented. It may include confirmation of implemented controls, review of residual risk, and supporting objective evidence.

This template helps demonstrate that risk responses remain effective over time. If risk conditions change or existing controls are no longer adequate, the framework can be updated so that risk remains managed throughout the validation lifecycle.

 

Relationships Between Criticality, Failure Mode, and Risk Assessment

Criticality is assessed first to determine whether a requirement, function, process, or system warrants deeper analysis. If an item is determined to be critical, the risk framework proceeds to failure mode analysis, followed by risk assessment and the associated downstream mitigation and control activities.

Failure mode analysis identifies how the design, function, or process could fail, including the potential causes and effects of that failure. This step provides the context needed to understand the nature of the risk before it is formally evaluated.

Risk assessment is not an independent activity. It builds on the information gathered during criticality assessment and failure mode analysis, using the selected risk model and configured business rules to determine the appropriate response. Based on the outcome, teams can define appropriate risk controls, mitigation activities, or other required responses; evaluate residual risk; and maintain a controlled, traceable approach throughout the validation lifecycle.

ValGenesis iVal™ supports this logical, risk-based progression through configurable templates, automated workflows, integrated risk assessment, and standardized validation processes. This helps organizations evaluate risks consistently, document decisions clearly, and maintain audit-ready traceability across risk, validation, mitigation, and control activities.

Figure 2 illustrates one possible configured workflow connecting criticality, failure mode analysis, risk assessment, and risk control.

 

A Holistic View of Risk

iVal provides a connected, enterprisewide view of risk across validation activities by linking risk identification, risk analysis, risk evaluation, mitigation planning, risk control, traceability, and change impact within a single digital environment.

Integrated risk assessments, automated traceability matrices, and change-impact tracking help ensure that decisions are data-driven and auditable. Real-time dashboards, reports, and configurable workflows enable organizations to evaluate risk outcomes across systems, product lines, and business processes while applying consistent rules, templates, and controls.

 

Automated Risk-Based Trace Matrix Generation

With CSA principles and GAMP 5 Second Edition emphasizing critical thinking, intended use, and risk-based assurance, organizations need traceability that demonstrates control without creating unnecessary documentation.

ValGenesis iVal helps validation teams maintain connections among requirements, risk decisions, testing, evidence, and related records throughout the validation lifecycle.

A current, audit-ready trace matrix provides stakeholders and auditors with a clear view of how requirements are verified, how risks are addressed, and how validation decisions remain justified over time. This helps organizations maintain a controlled, risk-based approach to computer systems validation.

iVal helps maintain traceability from user requirements and functional requirements through test cases, execution evidence, deviations, and associated change records while supporting fit-for-purpose assurance approaches (FDA, 2026a).

 

Agile Validation

iVal supports Agile validation by enabling validation activities to progress in parallel with iterative software development while maintaining control, traceability, and audit readiness. Configurable workflows, integrated risk assessment, automated traceability, and change management capabilities help teams manage evolving requirements without losing visibility into validation status or downstream impacts.

This approach allows organizations to combine Agile practices with the discipline required for GxP validation. By connecting development, validation, and change activities within a controlled digital environment, iVal helps reduce manual effort and supports consistency and lifecycle oversight.

Scope Changes and User Stories

As requirements, user stories, or backlog items change, iVal maintains downstream traceability and makes the resulting change impact visible across related records, tests, and controls. This enables organizations to support iterative development while preserving a controlled validation state.

Rather than managing scope changes through disconnected documents, teams can use connected workflows and traceability to evaluate what changed, what is affected, and whether additional action is required.

Selected backlog items can then drive the development of corresponding requirements, testing, and validation deliverables in a controlled and auditable way.

 

Risk Ranking to Determine the Appropriate Assurance Approach

After the relevant requirements for a sprint, release, or validation activity are approved, iVal can route them for risk assessment using configured scoring logic, risk models, and business rules. The resulting risk ranking helps determine the appropriate assurance approach and expected level of rigor.

This enables organizations to align testing and validation effort with the level of risk rather than applying the same level of effort to every item. By linking requirements, risk rankings, and downstream validation activities within a controlled workflow, iVal supports a more consistent and traceable risk-based assurance process (FDA, 2026a).

 

ValGenesis Technology Features and Benefits

Supports ALCOA+ Principles

ValGenesis iVal supports ALCOA+ principles by providing a controlled digital environment for risk-based validation and Agile ways of working. Figure 4 illustrates a validation business process swim lane that connects requirements, risk assessment, assurance selection, testing, and execution activities within a traceable workflow.

iVal enables validation activities to progress in parallel with Agile software development while maintaining control and oversight. Risk assessment outcomes can be used to determine the appropriate CSA testing approach and route testing activities to designated users through standardized workflows.

iVal provides standardized templates, controlled processes, audit trails, access controls, and consistent risk categorization. These capabilities help organizations support ALCOA+ data integrity principles throughout the validation lifecycle (WHO, 2021).

 

GxP Impact Assessment

GAMP 5 Second Edition recommends applying critical thinking throughout the validation lifecycle. As an initial step, organizations should perform a GxP impact assessment, followed by a detailed functional risk assessment (ISPE, 2022).

Using role-based access controls in ValGenesis iVal that are designed to support applicable 21 CFR Part 11 requirements, authorized users can create GxP impact assessment templates and associated questionnaires. Once approved, the template can be locked to prevent unauthorized changes and reused across the enterprise to support a consistent approach to GxP impact assessments. An organization’s compliance depends on the system’s intended use, validated configuration, technical controls, procedural controls, and ongoing governance.

 

Conclusion

Digital technologies continue to transform how life sciences organizations manage validation activities. At the same time, evolving regulatory expectations emphasize critical thinking, intended use, risk-based assurance, and lifecycle management rather than prescriptive validation practices.

ValGenesis iVal helps organizations operationalize these principles by connecting requirements management, risk assessment, traceability, testing, change management, and validation execution within a controlled digital environment. Through configurable workflows, integrated risk management, automated traceability, and support for Agile development practices, iVal enables teams to align validation effort with risk while maintaining compliance, consistency, and audit readiness.