What is the scoop on FDA’s CSA?

FDA’s CDRH is planning on releasing a guidance on Computer Software Assurance (CSA) for Manufacturing, Operations, and Quality System Software in 2020 (applies to non-product CSV only). Currently, it is on their “A” list. There has been a lot of "industry chatter” about this particular guidance related to computer validation. The reason is that FDA has not updated their guidances on computer validation for about two decades (“cloud” did not really exist then!). Everyone is eager to know what their current position is when it comes to computer validation. So much has changed in the last two decades and we still don’t know what FDA’s current thinking is when it comes to the “cloud”. FDA has surely managed to keep us behind a “dark cloud”!

" “the medtech industry’s high focus on meeting regulatory requirements versus adopting best quality practices has the potential to increase risk to patients. This compliance-centric approach has resulted in quality issues and has hampered innovation in manufacturing and product development practices. Additionally, this single-mindedness has led to low rates of investment in automation and digital technologies.”"  -- Francisco (Cisco) Vicenty, Case for Quality at FDA’s CDRH

What are key takeaways?

To begin with, they are getting rid of the word “validation” and replacing it with “assurance”.

The idea here is that the industry needs to use smarter techniques to ensure software assurance is high. They want us to borrow a page or two from the high tech software industry.

They are encouraging the use of automation, not only in automating various processes but also in their validation.

FDA is very openly asking the industry why are you so “paper” heavy! Use automation to drive higher software quality.

They are questioning why the industry is not focused on methods and activities that enhance software assurance. FDA is stating that the industry is bog down in paper while not improving software quality.

FDA is asking us to incorporate “critical thinking” to increase software assurance. They are literally want the industry to turn things upside down when it comes to validation (see Figure below).

FDA is even encouraging the industry to use risk based techniques much more than they do now. They have gone to the extent of advising the industry to use Unscripted Exploratory Testing, Unscripted Error Guessing and Unscripted Adhoc Testing - of course based on a risk based analysis.

It is very clear that FDA is openly nudging the industry to adopt varying degrees of testing based on risk. They are questioning if the current one size fits all paper heavy process brings any value at all.

How do I know if my validation program is in sync with FDA’s CSA?

Let us take a short quiz.

Do you review the Release Notes for every new release and then try to decipher the cryptic notes by the vendor?

Do you selectively run regression tests and not the complete suite of tests with every release or patch?

Do you manually execute your tests?

Do you measure the impact of your validation on increasing software quality?

If your answer is 1-YES, 2-YES, 3-YES and 4-NO, your program is stuck in the past.

What are the best practices to be in sync with FDA CSA?

Embrace a “no paper” approach to validation soaked in automation. This is possible only if you adopt a sensible test automation framework which not only saves time but can increase your software assurance by a factor of 10X or more. With this, you can run your entire regression suite in minutes on a continuous basis.

Build your test cases into the coding environment so that there is a direct traceability between the test scenarios and the test automation code (for example the Gherkins framework).

Adopt a pipeline based test deployment framework with built-in approvals. Such a framework can easily plug into your DevOps and provide all the audit trails to track every step in every run.

Analyze the historical run data to see what the software validation scores are with every release.