Unscripted Testing Under CSA: What It Is, and How to Evidence It

The three modes, plainly

• Scripted. Steps and expected results written and approved before execution, results recorded against them. Reproducible by anyone. The right choice for high-risk functions and anything you will need to re-run identically.
• Unscripted with a charter. You define an objective and boundaries in advance — "confirm the approval workflow behaves correctly for a user without approver rights" — then a qualified tester explores. Steps are recorded as they happen.
• Ad hoc / error-guessing. An experienced person deliberately tries to break something based on judgement. Useful, lightweight, and only appropriate for low-risk areas.

CSA doesn't replace scripted testing. It stops scripted testing being the default for everything. Which mode applies to which function comes out of your risk assessment, not out of preference.

What evidence to keep when there is no script

This is the whole question, and the answer is fairly short. For each unscripted session, record:

• Who tested, and that they were qualified to.
• What the objective was — the charter, written before the session.
• The system and version tested, and the environment.
• What was actually done — a factual trail of the path taken, not a reconstruction. Screenshots, exported logs, or notes taken during the session.
• What was found, including anything that worked as expected, not only defects.
• The conclusion and who accepted it.

A good test: could a competent colleague read this a year from now and understand what was covered and what the tester concluded? If yes, it is evidence. If it reads "tested OK", it is not.

Where scripted testing is still the answer

• Functions where an undetected error reaches product or patient.
• Calculations and algorithms producing values used in decisions — you need exact expected results.
• Electronic signature and access control behaviour, where you are demonstrating a specific regulatory requirement.
• Anything you will need to re-run identically after a change, which is most of your regression set.
• Data integrity controls — audit trail capture, record immutability.

Note the pattern: script where you need reproducibility or an exact expected result. Explore where you need to find the unexpected. They answer different questions, which is why mature teams use both on the same system.

Common mistakes

Writing the charter afterwards. If the objective is reconstructed after the session, the record is not contemporaneous, and that is a data integrity problem rather than a testing one.

Letting anyone do it. Unscripted testing depends entirely on the tester's competence — they are making judgement calls in real time. Record why the person was qualified.

Only recording failures. If the session notes contain nothing but defects, there is no evidence of coverage.

Using it because scripting is tedious. That is the wrong reason, and it shows. The decision belongs to the risk assessment.

For how this fits the wider move, see moving from CSV to CSA and CSA services.