GAMP 5 · FDA CSA · 21 CFR Part 11 · Annex 11
CSV / CSA software that keeps risk, requirements and test evidence in one validation file.
Requirements traceability, test evidence, change impact and periodic review in one place. Your QA approves the validation; IQ/OQ support is available on Enterprise plans.
GAMP 5 Category-Aware Lifecycle
Live Requirements Traceability
Risk-based test strategy (CSA)
Electronic Test Execution
Full product detailCommon problems, what's included, why teams choose it, and where commercial meets regulated.
You're shopping because the last CSV project took nine months and the traceability matrix was out of date the day it was signed.
URS, FS, configuration spec and test scripts live in four Word files that reference each other by page number
Traceability matrix is an Excel export that goes stale the moment a requirement changes
Every change control triggers a full re-execution because impact isn't traceable
Periodic review is a calendar reminder nobody owns
The auditor asks for evidence a specific requirement was tested — and it takes two days
CSV / CSA, run as one linked validation file.
GAMP 5 Category-Aware Lifecycle
Each system can be recorded with the category your team assigns (Category 1 infrastructure, 3 non-configured, 4 configured, 5 custom) and your team records the category it assessed and decides the deliverables and depth of testing.
Live Requirements Traceability
URS → functional/config spec → risk → test case → test run → defect. The matrix is a live query, not a spreadsheet. Change a requirement and every downstream artefact turns yellow until re-linked.
Risk-based test strategy (CSA)
ICH Q9-aligned risk assessment on each requirement — patient safety, product quality, data integrity impact — drives whether the test is unscripted/ad-hoc, scripted, or scripted with independent review. Aligned to FDA CSA guidance (final, February 2026).
Electronic Test Execution
Testers execute scripts on-device with screenshot capture, actual-result entry and defect linkage. Deviations open in-line, tester and reviewer signatures per Part 11 §11.50 — no paper scan-back.
Change Control + Impact Analysis
Every change references the requirements, risks and tests it touches. Impact analysis is a query, not a meeting.
Periodic Review as a Workflow
Not a calendar reminder that gets snoozed.
What changes the day this goes live.
- Traceability is a live query — the auditor sees it in real time
- Change controls have proper impact analysis instead of full re-execution
- Periodic review actually happens on cadence
- CSA-aligned risk-based testing replaces protect-everything paperwork
The frameworks a validation lead owns.
21 CFR Part 11
§11.10(e) audit trail, §11.10(f) operational checks, §11.10(g) authority checks, §11.50 / §11.70 signature manifestation and binding — all native, all reviewable.
EU GMP Annex 11
Risk management, validation, data integrity, e-signatures, printed-copy criteria, incident management, business continuity — software controls that support your Annex 11 approach; validation and procedures remain yours.
CSV / CSA software, answered.
Does V5 support the FDA CSA guidance?
Yes. The risk assessment engine drives the CSA decision tree — is the software feature high or not-high risk, and does the intended use directly or indirectly affect product quality? — and the test method (unscripted, scripted, scripted with independent review) is proposed accordingly with the rationale captured. FDA's current final guidance, "Computer Software Assurance for Production and Quality Management System Software" (February 2026), supersedes the September 2025 version; it is nonbinding and does not replace validation or Part 11 obligations.
How does V5 handle GAMP 5 categorisation?
A Category 3 non-configured system won't demand a full custom-development trail; a Category 5 will.
Is the traceability matrix a real report?
It's a live query, not an export. Requirements, risks, specifications, test cases, test runs, defects and change controls are linked objects. You can render the classic matrix as a PDF for the binder, but the source of truth is the graph — so it can't go stale.
Can V5 validate itself?
No software can validate itself. V5 supplies the product controls and records; you decide intended use, validation approach, approval and release.
Capabilities vary by plan and setup. Confirm specifics with our team before relying on them.
Run CSV / CSA on one linked validation file.
Free trial. Real GAMP 5, real CSA risk-based testing, real live traceability.