Welcome To Today’s Webinar

Thanks for joining us!

We’ll get started in a few minutes

Today’s Topic:

Draft Guidance on Computer Software Assurance for Production 

and Quality System Software

October 27, 2022
Computer Software Assurance for 

Production and Quality System Software

Draft Guidance

Francisco Vicenty

Program Manager, Case for Quality

Compliance and Quality Staff

Office of Product Evaluation and Quality

Center for Devices and Radiological Health

U.S. Food and Drug Administration
Draft Guidance

• Computer Software Assurance for Production 

and Quality System Software

– www.fda.gov/regulatory-information/search-fda-guidancedocuments/computer-software-assurance-production-and-qualitysystem-software

3
Learning Objectives

• Identify and describe scope and purpose of draft 

guidance

• Describe computer software assurance (CSA) as a riskbased approach to establish confidence in 

automation used for medical device production or 

quality systems

• Describe risk-based assurance activities that may be 

applied to establish CSA

4
Background

• FDA recognizes advances in manufacturing 

technologies have the potential to allow 

manufacturers to:

– reduce sources of error

– optimize resources, and

– reduce patient risk

5
Background

• FDA recognizes these technologies have the potential 

to provide significant benefits for enhancing medical 

device quality, availability, and safety

• Medical device manufacturers have expressed a 

desire for greater clarity regarding software validation 

for computers and automated data processing systems 

used as part of production or quality system

6
Draft Guidance

Purpose and Scope

7
Purpose of Draft Guidance

• Provide recommendations on computer software assurance (CSA) 

for computers and automated data processing systems used as part 

of medical device production or the quality system

• Describe CSA as a risk-based approach to establish confidence in 

automation used for production or quality systems

• Describe various methods and testing activities that may be applied 

to establish CSA and provide objective evidence to fulfill regulatory 

requirements

8
Scope of Draft Guidance

• Computers or automated data 

processing systems used as part of 

production or the quality system where 

21 CFR 820.70(i) applies

• Includes, but not limited to:

– Design

– Development

– Manufacturing

– Quality System

9

Not in Scope:

• Software as a Medical 

Device (SaMD)

• Software in a Medical 

Device (SiMD)
Computer Software Assurance (CSA)

10
What is CSA?

• Risk-based approach for establishing and maintaining

confidence that software is fit for its intended use

• Establishes and maintains that software used in

production or quality system is in a state of control

throughout its lifecycle (“validated state”)

• Effort and record should be “right-sized” to the risk

11
CSA Approach

12

Identify Intended Use

Determine whether 

software is intended for 

use as part of 

production/quality 

system. 

Determine Risk-Based Approach

Determine level of risk if 

software were to fail to 

perform as intended.

Determine Appropriate Assurance Activities

Identify assurance 

activities commensurate 

with risk. 

Establish Appropriate 

Record

Capture sufficient 

evidence to 

demonstrate that 

software was assessed 

and performs as 

intended. 
Intended Use

13

Identify Intended Use

Determine whether 

software is intended for 

use as part of 

production/quality 

system (QS). 

Is it: 

• Used directly as part 

of production/QS?

• Used to support

production/QS?

• Not used as part of 

production/QS? 

• Software intended to be used directly as part of production or QS

• Production processes, inspection, testing, or collection and 

processing of production data

• Quality system processes, collecting or processing quality 

system data, or maintaining a quality record established 

under the Quality System regulation

• Software intended to be used to support production or QS

• Development tools that test or monitor software systems, 

or automate testing activities

• General record-keeping that is not part of the quality record

21 CFR 820.70(i) Applies

Lower 

Risk
Risk-Based Approach

14

Determine Risk-Based Approach

Determine level of risk if 

software were to fail to 

perform as intended: 

• High Process Risk

• Not High Process Risk 

FDA is primarily concerned 

with review and assurance for 

software that is high process 

risk because a failure also 

poses a medical device risk. 

• Failure to perform as 

intended may result in a 

quality problem that 

foreseeably compromises 

safety (that is, increased 

medical device risk)

• Example:

Software that maintains 

process parameters that 

affect physical properties 

that are essential to device 

safety or quality

High Process Risk Not High Process Risk

• Failure to perform as 

intended either: 

o would not result in a 

quality problem OR 

o may result in a quality 

problem that does not 

foreseeably lead to 

compromised safety

• Example: 

Software that collects and 

records data for monitoring 

and review purposes that 

don’t directly impact 

production/process 

performance
Assurance Activities

15

Determine Appropriate Assurance Activities

Identify assurance activities 

commensurate with risk. 

• High Process Risk 

level of assurance 

commensurate with 

medical device risk

• Not High Process Risk 

 level of assurance 

commensurate with 

process risk 

• Activities, people, and established 

processes that provide control in 

production

• Purchasing controls

• Process controls

• Data collected by the software for 

monitoring or detecting 

issues/anomalies

• Computer system validation tools 

• Iterative/continuous testing 

throughout the software lifecycle

Leverage

• Unscripted Testing

• Ad-hoc testing

• Error-guessing

• Exploratory 

testing

• Scripted testing

• Limited scripted 

testing

• Robust scripted 

testing

Testing methods
Records

16

Establish the Appropriate Record

Capture sufficient 

evidence to 

demonstrate that 

software was assessed 

and performs as 

intended. 

• intended use of software feature, function, or operation;

• determination of risk of software feature, function, or operation; 

• documentation of assurance activities conducted, including: 

• description of testing conducted based on assurance activity; 

• issues found (examples: deviations, failures) and disposition; 

• conclusion statement declaring acceptability of results; 

• date of testing/assessment and name of person who 

conducted testing/assessment;

• established review and approval when appropriate (examples: 

when necessary, a signature and date of an individual with 

signatory authority)

Record should include: 
Electronic Records Requirements

17
Electronic Records 

Requirements

• FDA’s Guidance, “Guidance for Industry, Part 11, 

Electronic Records; Electronic Signatures – Scope 

and Application,” describes narrow 

interpretation of scope of 21 CFR Part 11

• Agency intends to exercise enforcement 

discretion regarding specific Part 11 

requirements for validation of computerized 

systems*

• We invite comments or questions regarding the 

application of Part 11 requirements to systems in 

scope of 21 CFR 820.70(i)

18

*21 CFR 11.10(a) and corresponding 

requirements in 21 CFR 11.30.
Summary

• Computer software assurance (CSA) is a risk-based approach to 

establish confidence in the automation used for production or 

quality systems

• The CSA approach features four steps:

1. Identify intended use

2. Determine risk-based approach

3. Determine appropriate assurance activities

4. Establish appropriate record

• We invite you to provide comments and ask questions about this 

draft guidance 19
Providing Comment on

Draft Guidances

20
A Note about Draft Guidances

• You may comment on any guidance at any time

– see 21 CFR 10.115(g)(5)

• Please submit comments on draft guidance before 

closure date

– to ensure that FDA considers your comment on a draft 

guidance before we work on final guidance

21
Submit Comments to Dockets by:

November 14, 2022

• Draft Guidance: Computer Software Assurance for 

Production and Quality System Software

• Docket: FDA-2022-D-0795

(www.regulations.gov/docket/FDA-2022-D-0795)

• Draft Guidance

22
Resources

Slide 

Number

Cited Resource URL

3 CSA Draft Guidance www.fda.gov/regulatory-information/search-fda-guidancedocuments/computer-software-assurance-production-andquality-system-software

18 Part 11, Electronic Records; 

Electronic Signatures – Scope and 

Application

www.fda.gov/regulatory-information/search-fda-guidancedocuments/part-11-electronic-records-electronic-signaturesscope-and-application

22 Comment Docket www.regulations.gov/docket/FDA-2022-D-0795

23
24
Additional Panelists

Center for Devices and Radiological Health

U.S. Food and Drug Administration

Ian Ostermiller

Policy Advisor

Office of Policy

Mary Wen

Regulatory Policy Analyst

Office of Product Evaluation and Quality
Let’s Take Your Questions

• To Ask a Question:

1. Raise your hand in Zoom

2. Moderator will announce your name and invite you to ask your question

3. Unmute yourself when prompted in Zoom to ask your question

• When Asking a Question:

• Ask one question only

• Keep question short

• No questions about specific submissions

• After Question is Answered:

• Mute yourself and lower your hand

• If you have more questions - raise your hand again
Thanks for Joining Today!

• Presentation and Transcript will 

be available at CDRH Learn

• www.fda.gov/Training/CDRHLearn

• Additional questions about 

today’s webinar

• Email: DICE@fda.hhs.gov

• Upcoming Webinars

• www.fda.gov/CDRHWebinar