Best Practices for FDA Computer System Audit Preparation in 2026

For those of us who have worked around FDA-regulated computer systems for many years, the conversation around validation has changed quite a bit. Years ago, the focus was often on whether a validation package existed and whether the required documents were in place. That still matters, but it is no longer enough. Today, FDA investigators are far more interested in whether the system is actually controlled, whether the records it generates can be trusted, and whether the company can explain the decisions behind its validation approach.

This is especially important for medical device companies as they operate under the QMSR environment and continue to manage expectations around 21 CFR Part 11, data integrity, audit trails, vendor oversight, and risk-based software assurance. Many organizations still have legacy systems that were validated under older CSV models. The documentation may exist, but the system may have changed, the process may have changed, the vendor may have released updates, or the way users interact with the system may no longer match the original validation assumptions.
These are the gaps that often surface during an audit. A system may be considered “validated,” but the risk assessment may not support the actual use of the system. Testing may not reflect the critical functions that affect product quality or patient safety. Audit trails may be turned on, but review practices may be inconsistent. A SaaS vendor may be managing frequent updates, but the company may not have a clear process for assessing the impact of those changes. These issues are rarely theoretical. They are the kinds of practical weaknesses that can make an inspection much harder to defend.

This webinar will help medical device companies take a realistic look at FDA computer system audit readiness. The session will connect traditional CSV expectations with FDA’s Computer Software Assurance approach, GAMP®5 2nd Edition principles, 21 CFR Part 11, data integrity, SDLC documentation, QMSR-related inspection expectations, and vendor oversight. Rather than treating validation as a one-time documentation exercise, the program will focus on how companies can build and maintain defensible control over systems used in FDA-regulated activities.
Attendees will learn how to identify GxP systems, evaluate risk, document validation activities, maintain systems in a validated state, and prepare the policies, procedures, and supporting evidence needed for an FDA inspection. The session will also address practical areas that frequently create audit exposure, including weak change control, incomplete audit trail practices, unclear vendor responsibilities, outdated validation packages, and systems that have drifted away from their original validated state.

The goal is to help attendees understand what FDA computer system audit readiness really means in today’s medical device environment: not just having documents available, but being able to show that computerized systems are fit for intended use, properly controlled, and capable of supporting data integrity, product quality, and patient safety throughout the system life cycle.

• Learn how to identify “GxP” Systems
• Discuss the Computer System Validation (CSV) approach based on FDA requirements
• Understand Computer Software Assurance (CSA), the latest draft guidance from FDA on validation
• Learn how CSA aligns with GAMP®5, 2nd Edition, both in using critical thinking and following simplified approaches for documenting validation activities
• Learn how to transition (step-by-step) seamlessly from CSV to CSA
• Learn about the importance of audit trails in assuring Part 11 and data integrity compliance
• Understand current trends in FDA compliance and enforcement focused on medical device companies
• Discuss the best practices for documenting computer system validation efforts, including requirements, design, development, testing and operational maintenance procedures
• Understand how to maintain a system in a validated state through the system’s entire life cycle
• Learn about the policies and procedures needed to support your validation process and ongoing maintenance of your systems in a validated state
• Understand the need to include an assessment of a computer system’s size, complexity, business criticality, GAMP®5 category and risk, should it fail, to develop a cohesive and comprehensive validation rationale
• Understand the latest guidance from FDA on Quality Management System Regulation and what that means for the medical device industry; in particular, we’ll discuss the changes to  the quality inspection approach
• Learn how to best prepare for an FDA inspection or audit of a GxP computer system
• Understand the importance of performing a thorough vendor audit to ensure oversight to the products and services they deliver
• Finally, understand the industry best practices that will enable you to optimize your approach to validation and compliance, based on risk assessment, to ensure data integrity is maintained throughout the entire data life cycle for FDA-regulated systems in the medical device industry
• Q&A

• FDA Computer System Audit Readiness Evidence Map for Medical Device GxP Systems
• CSV-to-CSA Risk-Based Validation Decision Workbook

• CSV Managers/Computer System Validation Specialists
• Computer Software Assurance Professionals/Quality Assurance Managers
• Quality Systems Managers/Regulatory Affairs Managers
• Compliance Managers/Data Integrity Officers
• 21 CFR Part 11 Compliance Specialists/Validation Engineers
• Software Validation Engineers/Quality Engineers
• Manufacturing Systems Managers/Laboratory Systems Managers
• IT Compliance Managers/GxP IT Managers
• IT Quality Managers/Document Control Managers
• Change Control Managers/Audit Trail Review Personnel
• Internal Auditors/Supplier Quality Managers
• Vendor Qualification Managers/Medical Device Quality Leaders
• Medical Device Regulatory Compliance Professionals
• Clinical Quality Professionals
• Operations Managers responsible for FDA-regulated systems

Carolyn Troiano has more than 35 years of experience in computer system validation in the tobacco, pharmaceutical, medical device and other FDA-regulated industries. She has worked directly, or on a consulting basis, for many of the larger pharmaceutical and tobacco companies in the US and Europe. She is currently building an FDA computer system validation compliance strategy at a vapor company. Carolyn has participated in industry conferences, and is currently active in the Association of Information Technology Professionals (AITP), and Project Management Institute (PMI) chapters in the Richmond, VA area. Carolyn also volunteers for the PMI’s Educational Fund as a project management instructor for non-profit organizations.