Home / Approach
One lifecycle, sized to the risk
Every engagement follows one assurance lifecycle. That keeps our work consistent whether we're assessing a single system change, building a CSA program from scratch, modernizing CSV procedures, or bringing an AI tool into regulated use.
Intended use
Define what the system, feature or AI tool does in your process, who relies on it, and which outputs feed GxP records or decisions. Risk is classified by how a system is used, not by what it's called.
- Intended use statement
- GxP impact assessment
Risk assessment
Assess risk at the level of features and functions, not just whole systems. A LIMS isn't uniformly high-risk; the function that calculates a reportable result is.
- Function-level risk assessment
- Documented rationale
Assurance planning
Map each risk level to the right activities: scripted testing for high risk, unscripted or scenario-based testing for medium, vendor evidence and configuration checks for low.
- Assurance plan
- Lean traceability
- Acceptance criteria set in advance
Testing
Rigor where it matters. Critical functions get thorough testing; the rest gets lighter activities, with every result recorded. For AI, that includes reference sets, adversarial inputs and hallucination stress tests.
- Executed test records with evidence
- Deviation handling
Reporting
A concise conclusion on whether the system is fit for its intended use, and the residual risk, so QA can make and defend the release decision.
- Assurance Summary Report
Periodic review
A system assured once and never looked at again won't stay in a controlled state. Periodic review and defined re-assurance triggers, including vendor model updates for AI, keep it there.
- Periodic review
- Re-assurance triggers
What we believe
Use before product
The same software can carry very different risk in two different processes.
Rigor where it matters
CSA doesn't mean less testing. It means testing in the right places.
Defensible by design
Every decision can be explained to an inspector.
Capability that stays
Procedures and skills your team can run without us.
We're practitioners. We focus on deliverables your teams will actually use, written in plain language and sized to the risk.
Map your next project to the lifecycle
We'll show you where the effort should go for your system.