{"id":10155,"date":"2023-07-12T12:50:10","date_gmt":"2023-07-12T10:50:10","guid":{"rendered":"https:\/\/q-finity.de\/?post_type=encyclopedia&p=10155"},"modified":"2026-07-18T12:35:25","modified_gmt":"2026-07-18T10:35:25","slug":"computer-software-assurance-csa","status":"publish","type":"encyclopedia","link":"https:\/\/q-finity.de\/en\/glossar\/computer-software-assurance-csa\/","title":{"rendered":"Computer Software Assurance (CSA)"},"content":{"rendered":"

Computer<\/a> Software Assurance is the FDA’s risk-based approach for establishing and maintaining confidence that software is fit for its Intended Use<\/a> – in the guidance’s own wording, the Intended Use of the software as part of production or the quality management system, explicitly distinguished from the intended use of the medical device itself. The effort follows the Least Burdensome<\/a> principle: no more validation burden than needed to address the risk. (QFINITY working convention: we place the Intended Use at the process level – the system is fit for purpose for it; see the entries Intended Use and Fit for Purpose<\/a>.) For high process risk, more rigor comes into consideration – such as scripted or hybrid testing; for lower process risk, unscripted methods such as scenario testing, error guessing, or exploratory testing are often sufficient. The guidance makes this mapping explicitly non-exclusive: chosen is whatever demonstrates fitness most effectively – unscripted testing can be the better choice even at high risk, and the level of detail and evidence per test case follows the risk. The basis for the CSA approach is a thorough understanding of the process and the function, and of the associated risks to the patient or the product. The CSA approach can be applied across the entire lifecycle of computerized systems, including software development, as long as the risks are understood and documented.
\nThe CSA principles should be applied to all computer systems involved in the manufacture of a medical device or in the associated quality systems (e.g., ERP, LIMS, etc.). Software that is itself part of a medical device is expressly excluded.
\nThe key steps of the CSA approach are:<\/p>\n