Understands what validating a computerised system establishes and what it does not — that effort is proportionate to risk, that a supplier can be leveraged but cannot validate your intended use, and that an audit trail exists so a record can be reconstructed rather than merely logged.

WHAT IT LOOKS LIKE · 5

• Scopes validation effort to the system’s risk and to what the supplier has already demonstrated, and records that reasoning.
• Tests what the system must do for the process, not every function the software has.
• Configures and verifies the controls that make records trustworthy — unique accounts, role separation, an audit trail that cannot be disabled by users.
• Assesses each change, patch and upgrade against the validated state instead of treating go-live as the end.
• Keeps the requirement, the test and the result traceable in both directions, so an untested requirement is visible.

HOW IT IS DEMONSTRATED AT WORK

A reviewer would trace a requirement through to its test and its evidence, then back, and look for a requirement that was deliberately not tested with the reason recorded. They would check whether the audit trail was verified as configured rather than assumed, and whether periodic review has actually happened since go-live. A system validated once and never reviewed is a validated state with a date on it.

WHERE IT IS COMMONLY WEAK

Two failures dominate. The first is testing the software instead of the use: exhaustive function scripts and no verification of the business process the system is there to run. The second is the audit trail taken on trust — the supplier says it exists, nobody checks whether it is switched on, whether administrators can amend it, or whether anyone has ever read it. Shared accounts survive for the same reason: they are convenient and invisible until an event needs attributing.

WHAT TEACHES IT · 2

• CAREER PATHWAYComputer System Validation — career pathway
• TOPICData Integrity (ALCOA+)

WHAT EXERCISES IT · 0

Nothing exercises this yet. 10 scenarios are published and none is linked to this entry — we would rather say so than point you at the closest one.