CSV validation services for GxP systems, from URS to signed VSR.
URS, FRA, DS, IQ/OQ/PQ protocols and reports, RTM and Validation Summary Report — end-to-end, GAMP 5 Second Edition aligned, with 21 CFR Part 11 evidence baked into the delivery. Optionally accelerated with GxP Copilot to compress the cycle from months to weeks.
Computer system validation produces documented evidence that a GxP system performs its intended function reproducibly, with every test traceable to a numbered requirement. Under GAMP 5 it runs from the validation plan through requirements, risk assessment and IQ/OQ/PQ to a summary report. A system stays validated only while change control and periodic review keep it there.
Outcomes you can expect
- Inspection-ready validation package
- Live RTM with coverage verdict
- Real Part 11 e-signatures and tamper-evident audit
Computer System Validation (CSV) is delivered by our validation & compliance services practice. Where it saves time, the team uses our products: GxP Copilot for validation lifecycle work and TraceDraft for clinical documentation.
Explore related capabilities: Computer Software Assurance (CSA), AI Validation Services (Annex 22), FDA 21 CFR Part 11 Compliance, EU Annex 11 & Annex 22 Compliance.
What Computer System Validation Is — and What It Is Not
Computer System Validation is the documented process of establishing evidence that a computerised system consistently does what it is designed to do in a manner that is reproducible, traceable, and defensible to a regulatory inspector. Under GAMP 5 Second Edition, CSV applies to GxP-critical systems — those whose failure would directly impact product quality, patient safety, or data integrity. It is not a one-time activity: a validated system must remain in a validated state through every change, through every vendor update, and until it is formally retired.
The confusion between CSV and IT governance or general quality assurance is common and costly. An IT security audit confirms the system is configured securely. A quality audit confirms it is operated correctly. CSV provides something different: documented, risk-based evidence that the system performs its intended function under representative conditions, with every test result linked to a specific requirement, and every deviation formally investigated and resolved. That linkage — requirement to test to result — is what makes a validation package defensible under 21 CFR Part 11, EU GMP Annex 11, and GAMP 5.
The V-Model Lifecycle: From URS to VSR
The GAMP 5 V-model structures the CSV lifecycle into defined phases that mirror requirements on one side with verification on the other. The left arm descends from the User Requirement Specification through Functional Specification and Design Specification — defining what the system must do, how it will do it, and how it will be built. The right arm ascends from IQ through OQ and PQ — verifying that the system was built as designed, operates as specified, and performs in the actual operational environment. Each right-arm phase closes the corresponding left-arm specification.
The Validation Summary Report sits at the top: it is the document that summarises the entire validation lifecycle, confirms that all requirements have been tested, all deviations resolved, and the system is approved for GxP use. The Validation Master Plan establishes the strategy, scope, and responsibilities at the outset. Every controlled deliverable — from the URS to the VSR — is version-controlled, reviewed, and signed with Part 11-compliant electronic signatures. Our practice delivers all 26 GAMP 5 Second Edition controlled deliverables, scaled to the system's risk category.
Risk-Based Approach: GAMP 5 Categories and CSA Alignment
GAMP 5's software category model — Category 1 (infrastructure), Category 3 (non-configured), Category 4 (configured), Category 5 (custom) — determines the depth of the validation effort. A Category 4 LIMS requires different documentation depth than a Category 5 bespoke manufacturing control system. Applying the same uniform protocol template across both categories wastes resource on the former and under-documents the latter. FDA's Computer Software Assurance guidance, finalised in September 2025, reinforces this principle: the depth of testing should follow the risk, not a procedural default.
Our CSV engagements begin with GAMP 5 categorisation and a functional risk assessment that scores each system requirement against severity, probability, and detectability. High-risk requirements receive scripted test cases with full execution records. Medium-risk requirements may receive exploratory or unscripted testing with session documentation. Low-risk requirements may leverage supplier-generated evidence where the vendor's own testing programme satisfies the requirement. The result is a lean, risk-proportionate validation package that withstands inspection precisely because every test decision has a documented rationale.
IQ, OQ, and PQ: What Each Phase Must Demonstrate
Installation Qualification confirms the system was installed as designed: the correct software version, the approved configuration, the compliant infrastructure. OQ verifies the system functions according to its specification under controlled conditions — every functional requirement tested against defined acceptance criteria, with deviations formally resolved before advancement. PQ demonstrates the system performs in the actual operational context with real users, real data volumes, and real business processes. Each phase produces a signed protocol and report before the next phase begins.
A common audit finding is that OQ and PQ were executed in a development environment rather than the validated production environment, or that PQ user scenarios were artificially simplified compared to the actual operational use. Our execution practice targets these failure modes: we execute in the validated environment, use representative data volumes, and include the role-specific user scenarios that FDA and EMA inspectors look for when they verify that PQ actually proves operational fitness rather than just repeating OQ with different credentials.
21 CFR Part 11 and EU Annex 11: The Electronic Records Foundation
A validated system in a GxP environment must also comply with the electronic records and electronic signatures requirements of 21 CFR Part 11 and EU GMP Annex 11. These are not separate compliance exercises — they are embedded in the validation package. The audit trail must be secure, computer-generated, and timestamped. Electronic signatures must include the signer's name, the date and time, and the meaning of the signature. Authors cannot approve their own work. Signed records must be frozen.
Our CSV packages include a dedicated Part 11 assessment for each system, identifying the specific configuration settings required to meet each Part 11 and Annex 11 requirement, and OQ test scripts that specifically verify the electronic records controls. A validated system that does not meet Part 11 requirements is not in a validated state — it has satisfied the functional specification but not the regulatory standard. We treat Part 11 compliance as integral to the validation, not as a separate checklist appended at the end.
GxP Copilot: Compressing the Validation Cycle
The traditional CSV lifecycle — from VMP authoring through VSR sign-off — typically runs 12 to 18 months for a complex system. The document volume is the constraint, not the thinking: validation engineers spend the majority of their time authoring structured deliverables that follow predictable templates rather than exercising regulatory judgement. GxP Copilot takes on most of the authoring by drafting the GAMP 5 deliverable set from a structured system description, leaving the validation engineer to review, refine, and decide.
With GxP Copilot, the first complete draft validation package can be produced in days rather than weeks, because the drafting is done for you. The live Requirements Traceability Matrix is maintained automatically — every change to a requirement or test case is immediately reflected in coverage analysis. Electronic signatures are built in, meeting Part 11 requirements without additional tooling. The effect on cycle time depends on the estate: how much of it is configured commercial software, how mature the templates are, and how quickly approvers turn work around. We do not publish a single figure, because one number across those variables would mislead. This is what CSA was designed to enable.
Maintaining Validated Status: Change Control and Periodic Review
Validation is not a project — it is a lifecycle commitment. Every change to a validated system — a software update, a configuration change, a new user role, a modified business process — must be assessed for its impact on the validated state and, where the impact is significant, formally re-validated before the change goes live in production. The change control process for validated systems must be documented, reviewed by QA, and approved before implementation. This is where most organisations' validation programmes decay: the initial validation is solid, but change management is inconsistent.
Periodic review — the systematic assessment of whether a validated system remains in a validated state — is an Annex 11 and GAMP 5 requirement that is frequently underperformed. A periodic review is not a re-validation; it is a structured assessment of the system's change history, operating performance, incident record, and alignment with current regulatory expectations. Our validation managed services programme provides the periodic review cadence, the change control support, and the revalidation execution that keeps your estate in a continuously validated state throughout its operational life.
Sources
Primary documents referred to on this page, from their official publishers.
- 21 CFR Part 11: Electronic Records; Electronic Signatures · eCFR (US)
- Computer Software Assurance for Production and Quality Management System Software (final guidance, February 2026) · US FDA
- EudraLex Volume 4: EU Good Manufacturing Practice guidelines · European Commission
- EU GMP Annex 11: Computerised Systems (current version) · European Commission
- ISPE GAMP 5 Guide, Second Edition · ISPE
See it on your own system.
Bring a URS or a system. We show you the validation package it produces.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan and scope