The FDA’s shift from Computer System Validation (CSV) to Computer Software Assurance (CSA) is often described as a move from “test everything” to “test what matters.”
For clinical laboratories and blood banks, that is both liberating and unsettling. We work in environments where patient safety is non-negotiable, yet our validation processes have been shaped by decades of rigid requirements, exhaustive documentation and an expectation that nearly every function should be tested in the same way.
CSA invites us to think differently. It encourages critical thinking, risk-based decision-making and the use of modern tools and methods. But there is an important caution for laboratories adopting this approach:
Risk-based does not mean risk-free.
The CSV Legacy: Compliance by Volume
For years, CSV was associated with exhaustive testing and thick binders of supporting evidence. Features were often tested and documented in much the same way, regardless of their clinical importance or likelihood of failure.
The result was predictable.
Testing became a bottleneck that delayed go-live.
Laboratory staff were buried in spreadsheets, screenshots and sign-offs.
Medical directors and other approvers were asked to sign summary documents with limited visibility into actual test coverage, failures or unresolved issues.
This was frequently compliance by volume rather than compliance by value. A large amount of documentation could demonstrate that work had been performed, but it did not necessarily show that the laboratory had focused its validation effort on the areas presenting the greatest risk.
CSA’s Promise and Its Risk
The intent behind CSA is sound. Organizations should concentrate their validation effort on functions that affect product quality, data integrity and patient safety. They should reduce unnecessary testing and documentation, make appropriate use of vendor materials and adopt tools that improve traceability and oversight.
The danger lies in overcorrecting.
CSA should not become a justification for eliminating testing simply to save time. Without clear risk assessments, clinical review and a defensible rationale for what was and was not tested, a laboratory may fall short of both regulatory expectations and its responsibility to protect patients.
The goal is not to do less testing indiscriminately. It is to apply the right level of testing to each function based on the risk that function presents.
The Missing Link: Structured Risk Assessment
Many laboratories are not performing a structured risk assessment before deciding what to test. Without that discipline, “risk-based” can quickly become another way of saying, “We tested what we had time to test.” A defensible risk assessment considers both the severity of a potential failure and the likelihood that the failure will occur without being detected.
Severity
Severity describes the potential impact on patient safety, product quality or data integrity if a function fails.
High-severity functions include:
Blood unit compatibility checks
Autoverification rules involving critical or clinically significant results
Instrument-to-middleware and middleware-to-LIS result transmission
Calculations that alter the value ultimately reported to the clinician and patient, specimen or result-routing logic
Clinical laboratories are already familiar with evaluating severity. We routinely consider the consequences of incorrect results, delayed results and failures involving patient identification or blood product selection.
Likelihood
Likelihood estimates how probable it is that a failure will occur and remain undetected before affecting production use.
Historical performance should be considered. Has this function, interface or a similar configuration failed before?
System complexity also matters. A workflow involving multiple applications, interfaces, rules or transformation points generally presents more opportunities for failure. Vendor and product maturity can help inform the assessment, but they should not be considered in isolation. A well-established product may still present significant risk when it is heavily configured, connected to multiple systems or used in a new clinical workflow.
Change frequency is another factor. Functions that are modified frequently through upgrades, new builds or local configuration changes generally require closer attention.
Detectability must also be considered. Would an error be caught by another safeguard, routine quality control or immediate user review, or could it reach the patient record unnoticed?
A function with serious clinical consequences but multiple reliable safeguards may have a lower overall risk than one with the same severity and little chance of detection.
Turning Risk into a Testing Strategy
A simple starting point is:
Risk Priority = Severity × Likelihood
The resulting risk priority can guide the type and depth of assurance activity required.
High-risk functions generally require highly structured, scripted testing with defined expected outcomes, complete evidence capture and formal clinical review.
Medium-risk functions may require basic scripted or unscripted testing, depending on their complexity, with sufficient documentation to demonstrate the result.
Low-risk functions may be addressed through vendor evidence review, configuration verification, exploratory testing or another less formal assurance method.
These categories should not be treated as automatic rules. They provide a framework for applying critical thinking consistently and documenting why a particular approach was selected.
Risk Assessment Flowchart
Use the flowchart to guide decisions about the appropriate level of testing and evidence for each function. The most important step is not simply assigning a risk category. It is documenting the rationale behind the decision.
That explanation should make clear why the selected level of testing was appropriate, what evidence was considered and who reviewed or approved the decision. This is what makes the process defensible and inspection-ready.
Evidence Still Matters
CSA changes how assurance activities may be selected and performed. It does not eliminate the need for evidence.
Regardless of the testing method used, laboratories should still be able to demonstrate:
What was evaluated
Who performed the evaluation
What passed, failed or required further investigation
How identified issues were resolved and retested
Who reviewed and approved the outcome
In blood bank and diagnostic workflows, these records are not administrative formalities. They provide evidence that systems responsible for blood compatibility, diagnostic result calculation, instrument data transmission and clinical result routing are functioning safely and effectively.
A Cultural Shift, Not Just a Process Shift
The greatest challenge for laboratories may not be revising an SOP or configuring a new validation platform. It may be changing the mindset created by decades of traditional CSV.
Teams must become comfortable deciding what does not require extensive scripted testing and explaining why. At the same time, they must resist pressure to classify functions as low risk simply because project timelines are tight or resources are limited.
A successful CSA approach requires laboratories to concentrate their validation effort where patient and product risk are highest, involve the appropriate clinical experts and use processes that make each decision traceable, reviewable and defensible.
It also requires trust. Testers, project managers, quality teams and medical directors need enough visibility into the risk assessment and testing evidence to understand how the laboratory reached its conclusion.
Tools That Support Both Speed and Safety
Modern validation platforms can help laboratories operationalize CSA principles without sacrificing evidence or oversight.
A platform such as Cymetryc centralizes test planning, execution, issue management, clinical review and approval. Real-time dashboards allow project and clinical leaders to see testing progress, open issues and pending approvals without waiting for manually prepared status reports.
More importantly, the testing record is created as the work is performed. Evidence, results, failures, retesting and approvals remain connected to the relevant test case, allowing inspection-ready reports to be generated without reconstructing the validation history after the project is complete.
This is where CSA and modern validation technology work particularly well together. The laboratory can reduce unnecessary testing while improving the completeness, visibility and defensibility of the testing that matters most.
References Worth Reviewing
FDA, Computer Software Assurance for Production and Quality System Software, September 2022
ISPE GAMP 5, Second Edition, including guidance on critical thinking and risk-based testing
CLSI AUTO08, Managing and Validating Laboratory Information Systems
AABB Technical Manual guidance related to information systems and validation
Closing Thought
CSA gives laboratories an opportunity to make validation faster, smarter and more meaningful. It allows teams to move away from testing every function with the same intensity and toward a process that directs attention to the areas of greatest clinical and operational risk.
But in clinical laboratories and blood banks, risk-based assurance must never become risk-free assurance.
The right balance reduces unnecessary work while preserving the evidence, clinical judgment and oversight needed to protect regulatory compliance and, most importantly, patient safety.
