Computer software assurance (CSA)

Computer software assurance is the FDA's risk-based approach to establishing confidence that software is fit for its intended use, instead of testing every feature with the same script.

The guidance distinguishes software that is part of a device from software used in production or the quality system. For the latter, the effort follows the risk of a failure. High-process-risk features get direct test evidence. Lower-risk features may rely on other assurance such as vendor evidence plus a focused check. Unscripted testing, exploratory testing and continuous monitoring can be appropriate evidence when you record what you did and what you found.

CSA does not mean 'no documentation'. It means the documentation matches the risk. An auditor will still ask for intended use, for the decision about how much assurance was enough, and for the result. A vendor validation packet copied into your file without a look at your configuration is not assurance.

Treat HAVGATE as quality-system software. Write the intended use (audits, CAPA, documents, training, suppliers), identify the features whose failure would affect product quality or regulatory records, and test those. Use the IQ/OQ package where your plan calls for it.