CSV / CSA software with risk-based evidence and live traceability as one validation file.
FDA's Computer Software Assurance draft guidance (Sept 2022) and GAMP 5 Second Edition both say the same thing: prove the software works for its intended use, don't paper the walls. V5 replaces the URS/FS/DS/IQ/OQ/PQ binder plus the traceability spreadsheet with one linked file — requirements, risks, tests, defects and periodic review — that a validation auditor can walk in an hour.
You're shopping because the last CSV project took nine months and the traceability matrix was out of date the day it was signed.
URS, FS, configuration spec and test scripts live in four Word files that reference each other by page number
Traceability matrix is an Excel export that goes stale the moment a requirement changes
IQ/OQ/PQ scripts are executed on paper then scanned back in for the binder
Every change control triggers a full re-execution because impact isn't traceable
Periodic review is a calendar reminder nobody owns
The auditor asks for evidence a specific requirement was tested — and it takes two days
CSV / CSA, run as one linked validation file.
GAMP 5 category-aware lifecycle
Each system is classified (Category 1 infrastructure, 3 non-configured, 4 configured, 5 custom) and the required deliverables and depth of testing flex automatically — no more Category 4 systems getting Category 5 paperwork.
Live requirements traceability
URS → functional/config spec → risk → test case → test run → defect. The matrix is a live query, not a spreadsheet. Change a requirement and every downstream artefact turns yellow until re-linked.
Risk-based test strategy (CSA)
ICH Q9-aligned risk assessment on each requirement — patient safety, product quality, data integrity impact — drives whether the test is unscripted/ad-hoc, scripted, or scripted with independent review. Aligned to FDA CSA draft guidance.
Electronic test execution
Testers execute scripts on-device with screenshot capture, actual-result entry and defect linkage. Deviations open in-line, tester and reviewer signatures per Part 11 §11.50 — no paper scan-back.
Change control + impact analysis
Every change references the requirements, risks and tests it touches. Impact analysis is a query, not a meeting. Regression scope is proposed automatically and signed off by the system owner.
Periodic review as a workflow
Per-system cadence (annual/biennial/risk-based), inputs auto-collected (incidents, changes, access review, backup evidence, DR test), reviewer signs off, or opens actions. Not a calendar reminder that gets snoozed.
What changes the day this goes live.
- Validation projects run 40–60% faster because deliverables are linked, not copy-pasted
- Traceability is a live query — the auditor sees it in real time
- Change controls have proper impact analysis instead of full re-execution
- Periodic review actually happens on cadence
- CSA-aligned risk-based testing replaces protect-everything paperwork
The frameworks a validation lead owns.
21 CFR Part 11
§11.10(e) audit trail, §11.10(f) operational checks, §11.10(g) authority checks, §11.50 / §11.70 signature manifestation and binding — all native, all reviewable.
EU GMP Annex 11
Risk management, validation, data integrity, e-signatures, printed-copy criteria, incident management, business continuity — covered out of the box.
GAMP 5 Second Edition
Category 4 configured product with documented critical thinking. CSA-aligned test evidence delivered with onboarding — not a six-month after-the-fact project.
CSV / CSA software, answered.
Does V5 support the FDA CSA draft guidance?
Yes. The risk assessment engine drives the CSA decision tree — is the software feature high or not-high risk, and does the intended use directly or indirectly affect product quality? — and the test method (unscripted, scripted, scripted with independent review) is proposed accordingly with the rationale captured. When FDA finalises CSA, the mapping updates in place.
How does V5 handle GAMP 5 categorisation?
Each system record carries its GAMP category, and the required lifecycle deliverables and expected depth of testing adjust automatically. A Category 3 non-configured system won't demand a full custom-development trail; a Category 5 will. All defensible against the GAMP 5 Second Edition (2022) framework.
Is the traceability matrix a real report?
It's a live query, not an export. Requirements, risks, specifications, test cases, test runs, defects and change controls are linked objects. You can render the classic matrix as a PDF for the binder, but the source of truth is the graph — so it can't go stale.
Can V5 validate itself?
Yes. V5 ships with a validation pack (URS, config specs, risk assessment, test scripts and evidence) executed in your tenant during onboarding. The Category 4 documentation aligns with GAMP 5 Second Edition and the resulting evidence is stored in V5 like any other validated system.
Run CSV / CSA on one linked validation file.
Free trial. Real GAMP 5, real CSA risk-based testing, real live traceability.