Years into CSA, most teams still write CSV documents. Here is why.

Reason one: nobody wants to be first

The most common reason is simple. No quality leader wants to be the one who reduced documentation and then received a finding. The old way may be expensive, but it has a track record. Nobody has ever been criticised for testing too much.

This fear is understandable and mostly misplaced. Inspectors look for evidence that you understood your risks and tested accordingly. A large package full of low-value testing does not show that. A lean package with a clear risk rationale does.

Reason two: the SOPs never changed

Many companies adopted CSA in a presentation and never in a procedure. The validation SOP still requires scripted testing for every requirement. The templates still have mandatory screenshot fields. So even teams that want to work differently cannot, because their own procedures would make it a deviation.

CSA only happens when the procedures allow it. That means rewriting the validation SOP to define how risk is assessed, when unscripted testing is acceptable, and what a lighter record must contain.

Reason three: everything ends up high risk

Teams that do adopt a risk-based approach often find that almost every function gets rated high. Partly out of caution, and partly because the risk method was never calibrated. If every function is high risk, the approach changes nothing.

The fix is to anchor the scale. Write down, with examples from your own systems, what high, medium and low risk look like. A calculation that feeds batch release is high. A report formatting option is low. Then hold people to it, and challenge any assessment where everything lands in the same box.

Reason four: suppliers are not used properly

CSA works best when vendor testing is assessed and relied on. Many companies still re-test standard functions because they never did a proper supplier assessment, so they have nothing to rely on. That doubles the work for no gain in assurance.

Reason five: the incentives reward volume

In some organisations, validation effort is measured in documents produced, and consultancy contracts are priced by deliverable. Neither rewards doing less. If the measure of a validation project is the size of the binder, CSA will struggle.

Better measures are time to go-live, the number of defects found in production, and inspection outcomes. Those reward testing that finds real problems.

How to actually move

Start with one system, ideally one due for an upgrade or periodic review. Rewrite the procedures enough to allow the new approach, assess risk honestly, test hard where it matters and lightly where it does not, and keep a short, clear record of the reasoning.

Then use that system as the worked example. Show it to quality leadership, to internal audit, and, when the time comes, to an inspector. One defended example does more to change a culture than any training course.

CSA is not a loophole. It is the approach regulators have been asking for. The barrier is not the rules. It is the comfort of the old paperwork.

For the practical detail, see the CSV to CSA transition plan.