Computer System Validation

CSV consulting for life sciences. Clear evidence through to approval.

For pharma, biotech, medical technology and laboratories. We work with your team to define the scope, plan testing and hand over the evidence your quality team needs for approval.

Book a free initial consultation 15 minutes · by phone

Define the scope
Test what matters
Hand over the evidence

Scope of services

What does CSV consulting for life sciences deliver?

CSV consulting helps you validate a computerised system from its intended use through to approval. We define requirements and risks with your business, IT and quality teams, draw up a test plan and document the results. You decide on approval under your quality process.

See how we work

Earlier project work · HMS Analytical Software

Integrating CSV into an existing quality management system

Elisabeth Kohm describes Daniel Herrmann’s contribution in a previous role, from the initial assessment to staff training.

Read the HMS Analytical Software case study

01 Foundations

What does Computer System Validation mean in Pharma & Biotech?

Computer System Validation (CSV) documents whether a computerised system is fit for its intended use in a GxP-regulated process. We work with your team to define the intended use, assess risks and plan the evidence needed for release.

We use GAMP 5 as a methodological reference and assess which requirements apply to the specific use, including EU GMP Annex 11 or 21 CFR Part 11 where relevant. We identify which records, audit trails or electronic signatures are relevant to your process.

02 Trigger situations

When do you need an external CSV consultant?

In-house QA and IT teams in Pharma, Biotech and MedTech run at capacity. When timeline or audit pressure rises and the validated state starts to wobble, external support pays off.

A new system is going live

You need to know which tests and evidence are still open before you can release the system.

Our methodology

An audit or inspection is announced

You need to know which records are already available and which gaps your team should prioritise before the date.

Audit readiness

Validation backlog from past projects

Incomplete OQ/IQ/PQ documents or open change controls from earlier rollouts.

Vendor change or cloud migration

New responsibility boundaries between vendor and customer require clean validation concepts.

System validation

Staff gap in internal QA / IT

Key roles are unfilled, day-to-day validation work piles up.

Talk to us

Deep-dive · LP4

Want your compliance reviewed?

GAMP 5 audit strategy: risk-based scope, Annex 11 + 21 CFR Part 11 mapping, audit dossier, all on the dedicated landing page.

See GAMP 5 audit strategy

03 Our methodology

Our IVE methodology, Integrated Validation Execution.

With Integrated Validation Execution, we bring project management and validation together. Your team can see who owns each task and what still needs to happen before release.

Together we agree what needs to be decided, tested and documented before go-live.

Integrated · Cross-stream integration

No new framework, we slot into yours.

We don't bring an external framework your team would have to learn. We integrate into your existing structures and close the gaps between IT, QA and business. Stakeholder alignment, interface clarification and cross-stream coordination end the friction between departments.

The result: less friction, a relieved team, and a system that works in practice. Everyone speaks the same language.

Validation · Quality assurance

Plan evidence according to system risk.

We align the validation strategy with the intended use and risk of the system. Your team helps define the tests, data integrity checks and records needed for release.

Your team can trace test results and deviations back to the underlying requirements.

Execution · Delivery & project management

Plans only get you to slides, we get you to go-live.

A validation plan that's only documented but not operationally delivered won't bring you to go-live. We deliver it, and run the project steering at the same time. Validation management and project leadership sit in one responsibility. We coordinate test execution, data migration, user training and cutover as a cross-stream effort. Critical points are addressed early, before they threaten the project timeline.

You see which tasks are complete and which decisions are still open before release.

04 CSA transformation

From document-heavy CSV to risk-based software assurance.

The FDA issued a revised final Computer Software Assurance guidance in February 2026. It supersedes the September 2025 version and aligns the document with the amended 21 CFR Part 820 Quality Management System Regulation (QMSR). Its direct scope remains computers and automated data processing systems used in medical-device production or quality management systems. For other Pharma GxP contexts, its risk-based methods can inform a GAMP-5-aligned CSV approach, but the FDA scope must not be extended by wording alone.

Define applicability and portfolio

Classify systems by intended use, regulatory context and process impact. Separate direct FDA CSA scope from other GxP systems that continue under their applicable CSV framework.

Build the risk model

Connect reasonably foreseeable failures to patient safety, product quality and data integrity. The risk decision determines assurance depth, not a fixed document count.

Select assurance activities and records

Use scripted or unscripted testing, supplier evidence, monitoring and other activities in proportion to risk. Keep objective evidence that makes the decisions reproducible.

Pilot, govern and scale

Prove the method on one suitable system, then update procedures, templates, reviewer competence, metrics and change controls before portfolio-wide rollout.

CSV and CSA: CSA does not remove the obligation to demonstrate fitness for intended use. The non-binding guidance recommends how assurance effort and records are justified within its scope; binding obligations arise from the applicable regulations. The four phases above are our implementation model, not a verbatim FDA checklist.

Primary source: FDA, revised final Computer Software Assurance guidance, February 2026

05 Systems & platforms

Validated systems & platforms we work with

We assess the intended use of your system and its role in GxP-relevant processes. We work with systems used in pharma, biotech and medical technology, from ERP platforms to cloud and SaaS systems.

Which system are you validating? Arrange your free initial consultation

06 What sets us apart

Boutique — not a consultant pool.

Large consultancies follow pyramid models: senior pitches the project, junior teams deliver it. In GxP-regulated projects that creates risk, when audit pressure rises, the experience that won the contract is no longer in the room.

Big consultancies

Sales and delivery sit on different teams, audit experience leaves the project after kick-off.

Our boutique model

Sales and delivery from the same senior team, audit experience present from day 1.

We work differently. Senior consultants sit on the project from the first workshop to go-live. No junior pool, no rotating staff, no knowledge gap between sales and delivery. You talk to the people who validate — not to the ones who last ran a validation project five years ago.

Our industry focus is just as deliberate: we work for life sciences companies in pharma, biotech and medical technology, as well as laboratories. No banks, no automotive, no generic IT projects. That focus isn't accidental, it's a prerequisite. GxP compliance consulting isn't something you pick up on the side.

07 FAQ

Common questions about CSV consulting.

Timeline How long does a typical CSV validation take?

The timeline depends on system scope, interfaces, data migration and existing evidence. In the initial consultation, we review your starting point and target date. Once the scope is clear, we plan testing, approvals and milestones together.

Pricing What does CSV consulting cost?

Pricing depends on system scope, tasks and input from your team. When we take on delivery through IT GxP Consulting, we agree a fixed price per system and document the assumptions before the project starts. A day rate can be agreed for targeted advice.

Scope Do you also handle ongoing validation maintenance?

Yes. Periodic reviews, change-control support and re-qualifications are part of our scope, also on a retainer basis for systems we didn't originally validate.

CSA What is the difference between CSV and CSA?

CSV is the overarching demonstration that a computerised system is fit for its intended GxP use. The final FDA CSA guidance describes a risk-based assurance approach for software used in medical-device production and quality management systems: effort, test method and records follow functional risk. CSA does not remove the fitness demonstration and does not automatically apply to every Pharma GxP context.

CSA How do you transition from CSV to CSA?

First classify applicability and the system portfolio. Then connect foreseeable failures to patient safety, product quality and data integrity, select risk-appropriate assurance activities and records, and pilot the method on a suitable system. Based on the pilot, scale procedures, templates, roles, reviewer competence, metrics and change controls.

Cloud Do you work with cloud systems?

Yes. For cloud systems such as Veeva Vault or SAP RISE, we establish what evidence the vendor provides and which tasks remain with your team. We also account for planned updates in the validation strategy.

Deep-dive: Cloud and SaaS validation →

Audit What happens if an audit is announced on short notice?

We first review the audit date, available evidence and open issues. We then confirm when we can start and which gaps we can help address before the audit.

More on our audit-preparation approach →

Geography Which countries do you work in?

DACH region as our primary base, EU-wide on a project basis. English-language validation documentation for FDA audits is standard.

The next step takes 15 minutes.

In the free initial consultation, we discuss your system, target date and the support you need.

Arrange your free initial consultation

15 minutes · by phone · free and without obligation