1What risk-based validation means.
Risk-based validation scales the scope and depth of validation to what a failure could harm. In EU GMP it is the stated basis. Annex 11 asks for risk management throughout the lifecycle, “taking into account patient safety, data integrity and product quality”, with decisions on “the extent of validation and data integrity controls” based on “a justified and documented risk assessment”. Manufacturers should be able to justify their standards, protocols, acceptance criteria, procedures and records from that assessment.¹ Annex 15 applies the same rule to facilities, equipment, utilities and processes, and asks that the way risk assessments support qualification and validation be clearly documented.²
ICH Q9(R1), adopted by ICH on 18 January 2023, is published in EudraLex Volume 4 Part III and came into effect in the EU on 26 July 2023.³⁴⁵ It gives two principles. The evaluation of risk to quality should be based on scientific knowledge and link to protecting the patient, and “the level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk”.³ For computer systems, ICH Q9(R1) lists determining the extent of validation among the uses of risk management: identifying critical performance parameters, selecting requirements and design, code review, “the extent of testing and test methods” and the reliability of electronic records and signatures.³
In the US, FDA’s data integrity guidance for drugs says the extent of validation “should be commensurate with the risk posed by the automated system”.⁶ Its 2003 Part 11 guidance recommends basing the validation approach on “a justified and documented risk assessment”, and notes that validation would not be important for a word processor used only to write SOPs.⁷
2How to decide how much testing a system needs.
FDA’s Computer Software Assurance guidance, final on 3 February 2026, sets out the most detailed method. It is written for software used in medical device production and quality management systems.⁸
- Decide whether the function is in scope. Software used directly in production or the quality system, or to support it, needs validation. Software for general business processes, such as email or accounting, generally does not.
- Assess each feature, function or operation. Identify reasonably foreseeable failures and decide whether a failure would be a “high process risk”: one that may result in a quality problem that foreseeably compromises safety. Maintaining process parameters essential to safety, or deciding product acceptability with limited human review, generally is. Collecting data for monitoring, routing CAPAs or managing change control generally is not.
- Count the other controls. Downstream inspection or testing, process monitoring, vendor work assessed through purchasing controls and the software’s own monitoring can reduce the assurance needed.
- Choose assurance activities to match the risk, as in the table below.
- Record it: the intended use, the result of the risk analysis, the testing done, the issues found, a conclusion on acceptability, who did it and when, and approval where appropriate. The record “need not include more evidence than necessary”.
| Risk | Assurance activities FDA describes | Record |
|---|---|---|
| High process risk | More rigour, such as scripted testing or a hybrid of scripted and unscripted testing, scaled as appropriate | Test objectives, step-by-step cases and expected results; the result of each case, issues, conclusion, who and when; independent review of the plan where appropriate |
| Not high process risk | Unscripted testing, such as scenario testing, error guessing or exploratory testing, or a suitable combination | Summary of what was tested, issues found, conclusion, who and when |
| Supporting software, such as development and test tools | Vendor evaluation, installation and configuration may be enough | Intended use, risk result and the vendor evaluation, validation, installation or configuration records relied on |
FDA adds that these pairings are not exclusive. Unscripted testing may suit some high process risk functions better, and automated scripted tests may be the efficient choice for lower-risk ones.⁸
3What EU GMP expects the testing to cover.
Annex 11 asks for evidence of appropriate test methods and test scenarios, considering “system (process) parameter limits, data limits and error handling”, and for automated testing tools and test environments to have documented assessments of their adequacy. The need to audit a supplier is itself based on a risk assessment.¹
The 2025 draft revision of Annex 11 would base the scope and extent of qualification and validation on a risk assessment of individual requirements. It would ask for increased focus on functions that keep work within GMP and protect data integrity: access privileges, release of products and results, calculations, audit trails, error handling, alarms and warnings, boundary and negative testing, reports and interfaces, and restore from backup. It would also expect approved test scripts detailed enough to repeat.⁹
4What risk-based does not mean.
Lower risk means less evidence, not none. ICH Q9(R1) says resource constraints “should not be used to justify the use of lower levels of formality”, that risk scores should rest on evidence, science and knowledge, and that risk management should not be used to justify a practice that would otherwise be unacceptable.³ FDA describes CSA as least burdensome, “where the burden of validation is no more than necessary to address the risk”, and still expects a record showing each function was assessed and performs as intended.⁸
Risk assessments are not one-off either. Annex 15 asks for them to be repeated as knowledge grows during the project or in commercial production, and for quality risk management to be used to evaluate planned changes and plan the validation, verification or requalification they need.²
5How it runs in Seal.
In Seal, assurance starts from intended use and function-level risk. The computer system assurance blueprint connects each function’s intended behaviour, failure modes, detectability, impact and safeguards, and the classification sets the depth and independence of the assurance work rather than a fixed document set. Scripted, automated and exploratory tests are recorded against the version under test.
For each later change, the validation and AI assurance guide describes an impact assessment that sets the scope, reuses relevant evidence with a documented rationale and verifies the affected functions again, with the selected tests run when the change is prepared for review. The quality risk management blueprint links a risk file to the controls as they are configured and tested.
References
- 1EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, revision 1, in operation from 30 June 2011, sections 1, 3.2, 4.1 and 4.7. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 2EudraLex Volume 4, Annex 15: Qualification and Validation, European Commission, in operation from 1 October 2015, General, sections 1.7 and 11.4. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ 2015- 10_ annex15_ 0. pdf (read 6 November 2026) - 3ICH Q9(R1), Quality Risk Management, ICH, adopted 18 January 2023, sections 1, 3 and 5.1 and Annex II.4. https:/
/ database. ich. org/ sites/ default/ files/ ICH_ Q9%28R1%29_ Guideline_ Step4_ 2023_ 0126_ 0. pdf (read 6 November 2026) - 4EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 5ICH guideline Q9 (R1) on quality risk management, EMA/
CHMP/ ICH/ 24235/ 2006, EMA, 3 February 2023, as linked from EudraLex Volume 4 Part III. https:/ / health. ec. europa. eu/ document/ download/ d77ad692- 97ae- 4a5f- acfa- e853193ef6aa_ en?filename=mp_ ich_ q9guideline- ra_ en. pdf (read 6 November 2026) - 6Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018, question 3. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 7Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, FDA, August 2003, section III.C.1. https:/
/ www. fda. gov/ media/ 75414/ download (read 6 November 2026) - 8Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, 3 February 2026, section V. https:/
/ www. fda. gov/ media/ 188844/ download (read 6 November 2026) - 9Annex 11: Computerised Systems, draft for consultation, European Commission and PIC/S, July 2025, section 9. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026)
AQuestions and answers
What is the difference between scripted and unscripted testing?
In scripted testing the test cases are written down in advance and executed manually or by an automated tool, with the level of detail set by the risk. In unscripted testing the tester’s actions are not prescribed step by step; FDA’s examples are scenario testing, error guessing and exploratory testing. Both need a record of what was tested, the issues found and the conclusion.
Can unscripted testing be used for high-risk functions?
FDA’s CSA guidance says it may be better suited even for some high process risk functions, though it suggests considering more rigour there, such as scripted or hybrid testing. For EU GMP, the draft revision of Annex 11 would expect qualification and validation to follow approved test scripts described in enough detail to be repeated.
Does FDA’s CSA guidance apply to drug manufacturers?
Its scope is software used in medical device production and quality management systems; it was prepared by FDA’s device and biologics centres in consultation with the drugs centre. Drug manufacturers work under the CGMP regulations, and FDA’s data integrity guidance asks that the extent of validation be commensurate with the risk posed by the automated system.
Can supplier testing reduce our own testing?
Yes, once it has been assessed. FDA says manufacturers can start from the vendor’s development practices and validation work, and that for some lower-risk functions this may be all that is needed. Annex 11 asks for suppliers to be assessed, with any audit based on risk, and the manufacturer still decides what assurance is enough.
Do we need a risk assessment template or matrix?
No particular tool is required. ICH Q9(R1) treats formality as a continuum and lists tools such as FMEA, fault tree analysis, HACCP and risk ranking and filtering. FDA’s CSA guidance sorts functions into high process risk and not high process risk, and allows finer grades such as moderate or low. What matters is a documented, justified conclusion for each function.
Does every software update need full revalidation?
No. Annex 15 asks for quality risk management to evaluate each planned change and plan the validation or verification it needs, and Annex 11 asks for changes to be controlled under a defined procedure. The assessment decides which functions to test again and why the remaining evidence still holds.