Ten signs your validation practice is running twenty-year-old assumptions. If any of these look familiar, you are leaving time, money and inspection posture on the table.
1. Every requirement defaults to a scripted test
CSA has been public since 2022. If your practice still starts with "which scripted tests do we need?", you are burning effort. See CSA services.
2. Your RTM is a spreadsheet that goes stale by lunch
A modern traceability view derives itself — see Live RTM.
3. Risk is a document that never changes what you test
If a "high risk" label does not change the test strategy on that requirement, risk is decorative. AI Risk Assessment makes risk actually flow.
4. Signatures are login-once, not re-authentication-at-signing
§11.200 is explicit. If your platform does not enforce it, it does not meet Part 11. See 21 CFR Part 11.
5. Audit rows are still edited “for cleanup”
An audit trail that the application can silently edit is not an audit trail. See our audit-trail post.
6. Authors can approve their own drafts
Segregation of duties has to be enforced by the workflow — see Human-in-the-Loop reviews.
7. Change controls happen after the change lands
Change control is not a post-hoc form. See Change controls.
8. AI use exists but there’s no governance answer
If someone asks "how is that AI governed?" and there's no working answer, Annex 22 will make this expensive. See AI governance.
9. Every SAP / LIMS / MES release is a validation project
Modern practice release-tests only what changed. See SAP validation, LIMS validation, MES validation.
10. Audit posture is a fire drill, not a state
Continuous audit readiness is a mode you live in, not a project you run every 18 months. See audit readiness.
What to do about it
Pick one system and re-baseline it with the modern operating model. Bring the numbers to leadership. That is how validation modernisation actually happens — one system, one number, one meeting at a time. book a demo.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.
