Skip to content
Hybrid GraphRAG Wiki & Architecture

Computer System Validation (CSV & CSA)

Overview (/validation)

The Computer System Validation (CSV/CSA) module governs the complete qualification lifecycle of enterprise software systems in accordance with ISPE GAMP 5 Second Edition and FDA Computer Software Assurance (CSA) guidance.

Computer System Validation Platform Interface

Core Functional Areas

1. Validation Operations Dashboard (/dashboard)

  • Executive V-Model metrics:
    • Total Regulated Requirements across all computerized systems
    • Traceability Coverage percentage (Passing tests versus total requirements)
    • Test Execution Breakdown: Pass, Fail, Deviated, Unrun
    • Open Validation Deviations count
    • Executed 21 CFR Part 11 Electronic Signatures count
  • Regulated Systems under governance: Electronic Batch Record (EBR), Chromatography Data System (CDS), Laboratory Information Management System (LIMS), Veeva Vault QMS, and Bioreactor Controller.

2. Requirements Traceability Matrix (RTM / V-Model Explorer) (/rtm)

  • Bi-directional ledger linking: System -> User Requirements (URS) -> Functional Specification (FS) -> Design Specification (DS) -> Test Protocol (IQ/OQ/PQ) -> Status -> Linked Deviation
  • Multi-attribute filtering by system code and qualification status.
  • Interactive Test Protocol Execution Modal:
    • Allows validation engineers to record actual test observations contemporaneous with execution.
    • Mark outcome as Passed, Failed, or Deviated.
    • Automatically records the engineer’s identity, role, timestamp, and creates an immutable 21 CFR Part 11 audit record in PostgreSQL.
  • Single-click CSV and JSON exports for regulatory inspection binders.

3. FDA CSA Risk & Critical Thinking Assessment Hub (/csa)

  • Interactive GAMP 5 & CSA Risk Calculator:
    • Assesses impact on: Patient Safety, Product Quality, and Data Integrity (Direct Impact, Indirect Impact, No Impact).
    • Evaluates Software Complexity (Category 3 Standard COTS, Category 4 Configured, Category 5 Custom).
    • Prescribes required assurance rigor: Rigorous Scripted Testing, Unscripted Challenge Scenarios, or Vendor Audit Leveraging.
  • FMEA Risk Register:
    • Failure Mode and Effects Analysis matrix displaying Severity ($S$), Occurrence ($O$), Detection ($D$), and calculated Risk Priority Numbers ($RPN = S \times O \times D$).
  • AI Risk Assessment Runner: Invokes RiskAssessmentAgent to autonomously analyze system features and generate structured risk files.

4. Qualification Protocols (IQ / OQ / PQ) (/protocols)

  • Protocol catalog categorized by Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).
  • Automated protocol assurance auditor powered by ValidationTestingAgent, evaluating acceptance criteria against Part 11 and Annex 11 standards.

5. Validation Summary Report (VSR) Generator (/vsr)

  • Direct integration with backend orchestrator (POST /api/orchestrator/vsr).
  • Synthesizes comprehensive, audit-ready Validation Summary Reports combining:
    • Executive Summary & System Boundary Definition
    • Traceability and Qualification Summaries (IQ/OQ/PQ)
    • Critical Thinking Risk Review
    • Data Integrity & ALCOA+ Audit Review
    • Specialist Agent Multi-Disciplinary Consensus
    • Release Recommendations
  • Integrated 21 CFR Part 11 digital signature sign-off with SHA-256 cryptographic manifest stamping.

Operational Use Case Scenario Workflows

The CSV/CSA Module governs computerized systems through the entire V-Model lifecycle, ensuring defensible compliance under FDA CSA and ISPE GAMP 5 Second Edition.

Scenario 1: V-Model Requirements Traceability Matrix Gap Remediation

sequenceDiagram
    autonumber
    actor CSV as CSV Engineer
    participant UI as Validation Console (/rtm)
    participant Agent as RequirementsTraceabilityAgent
    participant Memgraph as LPG Graph Engine
    participant PG as PostgreSQL RTM Ledger


    CSV->>UI: Filters RTM by "Coverage: Missing Tests"
    UI->>Memgraph: Traverses requirements without [:VERIFIED_BY] edges
    Memgraph-->>UI: Returns orphan requirements (URS-CDS-042, URS-CDS-043)
    CSV->>UI: Clicks "Remediate Gaps with Traceability Agent"
    UI->>Agent: Dispatches orphan requirement specs
    Agent->>Agent: Generates Functional Specs & OQ test scripts
    Agent->>PG: Commits new test protocol records
    Agent->>Memgraph: Creates [:VERIFIED_BY] graph edges
    UI-->>CSV: Updates RTM coverage indicator to 100%

1. Context & Operational Pre-conditions

  • Regulated System: Chromatography Data System (CDS).
  • Pre-Validation Audit: Prior to executing Operational Qualification, the CSV Engineer must ensure every User Requirement Specification (URS) maps to at least one test protocol.

2. Traceability Gap Detection

  1. CSV Engineer navigates to /validation -> Requirements Traceability Matrix (RTM).
  2. Applies filter Coverage: Missing Tests.
  3. System flags 2 orphan requirements:
    • URS-CDS-042: System must enforce dual authorization for peak baseline manual reintegration.
    • URS-CDS-043: System must record chromatogram raw file checksums prior to export.

3. Agent-Assisted Protocol Drafting

  1. The engineer clicks Auto-Remediate Gaps.
  2. The RequirementsTraceabilityAgent analyzes the requirements:
    • Generates Functional Specification FS-CDS-042 and FS-CDS-043.
    • Creates Operational Qualification test scripts OQ-CDS-042 (Manual Reintegration Challenge) and OQ-CDS-043 (Raw Data Checksum Verification).
  3. Writes new protocols into PostgreSQL and links them in Memgraph: 
    MATCH (u:Requirement {req_id: "URS-CDS-042"}), (p:Protocol {code: "OQ-CDS-042"})
    MERGE (u)-[:VERIFIED_BY]->(p)
  4. The RTM coverage KPI updates to 100%, clearing the pre-execution release gate.

Scenario 2: Contemporaneous Test Protocol Execution and Deviation Logging

1. Context & Operational Pre-conditions

  • Protocol: OQ-EBR-012: Audit Trail Immutability Verification.
  • Tester Role: CSV Validation Specialist.
  • Requirement: 21 CFR § 11.10(e) audit trail immutability verification.

2. Execution Workflow

  1. In /validation -> Qualification Protocols, the engineer opens OQ-EBR-012.
  2. Launches Interactive Test Protocol Execution Modal.
  3. Step 1: Execute test command attempting direct SQL update to audit_trail_events.
  4. Observed Result: Database trigger prevent_audit_records_tampering() actively aborted the query with error code 57014.
  5. Tester enters actual result notes, selects Status: Passed.
  6. Executes 21 CFR Part 11 digital signature with password challenge. The execution is permanently timestamped and committed to the database.

Scenario 3: FDA CSA Critical Thinking Risk Assessment & Test Rigor Determination

1. Context & Operational Pre-conditions

  • System Feature: Automated barcode scanning for warehouse inventory movement in DeltaV MES.
  • Assessment Goal: Determine whether scripted testing, unscripted challenge testing, or vendor documentation leveraging is appropriate.

2. Interactive Risk Calculator Execution

  1. Navigate to /validation -> FDA CSA Risk & Critical Thinking Hub.
  2. Select System MES, Feature Barcode Inventory Scanning.
  3. Evaluate Risk Factors:
    • Direct Impact on Patient Safety?: No Impact.
    • Direct Impact on Product Quality?: Indirect Impact (tracks raw materials, but does not alter chemical formulation).
    • Direct Impact on Data Integrity?: Direct Impact (inventory lot genealogy).
    • Software Category: ISPE GAMP 5 Category 3 (Standard COTS hardware scanner interface).
  4. System invokes RiskAssessmentAgent:
    • Computes FMEA Risk Priority Number: Severity=2, Occurrence=2, Detection=2 ($RPN = 8$).
    • Recommends Assurance Approach: Unscripted Exploratory Testing for standard scanning operations, and Limited Scripted Testing for boundary error conditions (e.g. damaged barcode, network disconnect).
  5. Exports risk evaluation into the validation plan dossier.

Scenario 4: End-to-End Validation Summary Report (VSR) Generation & Release Sign-Off

1. Context & Operational Pre-conditions

  • Regulated System: Laboratory Information Management System (LIMS v5.0).
  • Status: All IQ, OQ, and PQ test protocols executed; all validation deviations resolved.

2. Generation & Multi-Agent Synthesis

  1. Navigate to /validation -> Validation Summary Report (VSR) Generator.
  2. Select System LIMS v5.0.
  3. Click Synthesize Audit-Ready VSR.
  4. The LeadCsvOrchestrator aggregates data from all databases:
    • RTM traceability statistics from PostgreSQL.
    • Risk matrix from the CSA registry.
    • ALCOA+ audit trail integrity verification.
    • Sub-agent consensus recommendations.
  5. Renders complete, publication-ready multi-page VSR in the document preview panel.

3. Formal Sign-Off

  1. Validation Lead, System Owner, and QA Director open the electronic signature modal sequentially.
  2. Each enters credentials and attaches legally binding Part 11 signatures.
  3. System stamps the document with a SHA-256 cryptographic manifest and updates system operational status to Validated / Released for Production.