Documentation & Records (CSA)

When establishing the record, the manufacturer should capture sufficient objective evidence to demonstrate that the software feature, function, or operation was assessed and performs as intended. In general, the record should include the following:

• The intended use of the software feature, function, or operation;
• The determination of risk of the software feature, function, or operation;
• Documentation of the assurance activities conducted, including:
  • Description of the testing conducted based on the assurance activity;
  • Issues found (e.g., deviations, failures) and the disposition;
  • Conclusion statement declaring acceptability of the results;
  • The date of testing/assessment and the name of the person who conducted the testing/assessment;
  • Established review and approval when appropriate (e.g., when necessary, a signature and date of an individual with signatory authority)

Documentation of assurance activities need not include more evidence than necessary to show that the software feature, function, or operation performs as intended for the risk identified. The FDA recommends the record retain sufficient details of the assurance activity to serve as a baseline for improvements or as a reference point if issues occur.  You organization, like many, likely includes hundreds of pages of screen shots and printouts protocol executions.  The Experts at MEDVACON can help change the CSV culture to exclude much of that potentially unnecessary printing in future validation based on the guidelines of CSA.  The CSA guidance provides a table of examples of assurance activities and corresponding records.  It further includes an appendix of examples that outline possible application of the principles in the draft guidance to various software assurance situations cases.  It includes tables of relevant examples for systems such as (1) a Nonconformance System, (2) a Learning Management System, and (3) Business Intelligence Applications.  The tables illustrate identification of features and functions, intended use, risk-based activities, assurance activities, and proper documentation.