Quality System Remediation
Software Validation and Device Software (CSV, IEC 62304)
Software shows up twice in a medical device QMS: in the tools you use to make and control product, and in the device itself. We help with both, from risk-based validation of production and quality system software to a device software lifecycle that follows IEC 62304.
What You Receive
- 01Software Inventory and Risk Ranking
- 02Validation Plans and Reports
- 03IEC 62304 Gap Findings
- 04SOUP List and Risk Assessment
- 05Software Traceability Matrix
Every finding is reviewed and approved by a qualified QMS advisor before it reaches you.
What It Is
ISO 13485:2016 requires you to validate computer software used in the quality management system and in production and service provision, before first use and after changes as appropriate, with an approach proportionate to the risk of its use. That reaches your eQMS, ERP, complaint system, automated test equipment, software on production machines and spreadsheets that drive quality decisions. Risk-based computer software assurance thinking keeps effort where it matters: define the intended use, judge what could go wrong if the software failed, and choose a mix of vendor assessment, configuration review and scripted or unscripted testing to match.
Device software follows a different path. IEC 62304 describes a lifecycle for medical device software: a software safety classification based on the harm a software failure could contribute to, a development plan, requirements, architecture, detailed design where the class calls for it, verification, release, maintenance and a problem resolution process. Software of unknown provenance (SOUP), such as third-party libraries and operating systems, has to be identified and its risks assessed. Standalone health software can also bring in IEC 82304-1 for product-level requirements, and IEC 81001-5-1 adds security activities across the software lifecycle.
Electronic records raise a separate question. 21 CFR Part 11 sets FDA's criteria for electronic records and electronic signatures used to meet record-keeping requirements. We review how your systems create, protect and sign records and report gaps against those criteria as findings. Whether a given system meets the regulation depends on its configuration, procedures and use, and that determination stays with your organization.
When You Need It
- Your eQMS, ERP or test software went live without validation records, or the records describe a version you no longer run
- Validation packages are thick with screenshots but never state intended use or risk
- You're building software as a medical device, or firmware for an electromedical device, and need an IEC 62304 lifecycle
- Development records live in issue trackers and repositories with no link to design controls or risk management
- You rely on third-party libraries or operating systems and have no SOUP list or risk assessment
- A reviewer, notified body or customer has asked for your software lifecycle and security documentation
What We Do
- 01
Inventory Software and Intended Uses
We list the software used in production and the quality system, write the intended use of each, and rank it by the risk a failure would pose to product quality, safety or records.
- 02
Size Validation to Risk
For each system we choose assurance activities that fit the risk: vendor assessment, configuration review, scripted or unscripted testing. Each record states intended use, risk, what was tested and the conclusion.
- 03
Assess the Device Software Lifecycle
An AI-assisted first pass maps your development records against an IEC 62304 lifecycle, and an advisor reviews the result: safety classification, plans, requirements, architecture, verification, SOUP and problem resolution.
- 04
Connect Software to Design Controls and Risk
We trace software requirements to system requirements, to risk controls in your ISO 14971 file and to verification, so the software documentation holds together as part of the design history.
- 05
Set Up Maintenance and Security Processes
We help you establish software maintenance, problem resolution and change control after release, plus security activities across the lifecycle with IEC 81001-5-1 as the reference.
Deliverables
Software Inventory and Risk Ranking
Every production and quality system application, its intended use, risk and validation status.
Validation Plans and Reports
Risk-based plans and reports for production and quality system software, each stating intended use, approach and conclusion.
IEC 62304 Gap Findings
Advisor-reviewed findings against the software lifecycle, with sources, severity and owners.
SOUP List and Risk Assessment
Each third-party component, what you need from it, its known anomalies and the risk it brings.
Software Traceability Matrix
Software requirements traced to architecture, risk controls and verification.
How the Platform Helps
Exports From the Tools You Already Use
Upload exports from issue trackers, test tools and the eQMS you already use. Originals are kept with a SHA-256 fingerprint, so you can show exactly what was reviewed.
Findings Sorted by Severity
Gaps in validation records and the software lifecycle land in one action plan with owners, due dates and evidence requirements.
Validation Evidence Reviewed by an Advisor
Submit validation reports as evidence. An advisor accepts them or requests a revision, and each resubmission states what changed.
Audits and Inspections It Prepares You For
FDA Baseline Surveillance Inspection
FDA's comprehensive surveillance inspection of your quality system under Compliance Program 7382.850.
EU Notified Body Audit (Including Unannounced Audits)
Conformity assessment, surveillance and unannounced audits by an EU notified body under the MDR or IVDR.
ISO 13485 Certification Audit (Stage 1 and Stage 2)
The Stage 1 and Stage 2 audits a certification body runs before granting ISO 13485 certification.
Remote and Hybrid Audits
Audits and regulatory assessments run partly or fully through video, screen sharing and electronic records.
Standards and Regulations in Scope
- IEC 62304Medical Device Software Lifecycle Processes
- IEC 82304-1Safety of Health Software Products
- IEC 81001-5-1Security Activities in the Health Software Lifecycle
- ISO 14971Risk Management for Medical Devices
- IEC 62366-1Usability Engineering for Medical Devices
- 21 CFR Part 11Electronic Records and Electronic Signatures
- ISO 13485Quality Management Systems for Medical Devices
Questions About This Service
Which software do we have to validate?
Software used in the quality management system and in production and service provision, with effort proportionate to risk. That usually includes your eQMS, complaint and CAPA systems, ERP functions that control product, automated test and inspection software, and spreadsheets used for quality decisions. The intended use and risk of each decide how much validation it needs.
How is computer software assurance different from computer system validation?
It's a shift in emphasis rather than a different goal. Computer software assurance concentrates effort on functions whose failure could affect product quality or safety, accepts unscripted testing and vendor evidence where risk is low, and keeps documentation to what demonstrates confidence. The aim is unchanged: show the software works for its intended use.
How does IEC 62304 software safety classification work?
Each software system is classified by the severity of harm a software failure could contribute to, taking into account risk controls outside the software. The class decides which lifecycle activities and documentation are expected, so getting it right early avoids both overbuilding and gaps.
What is SOUP?
Software of unknown provenance: software you didn't develop under your own lifecycle, such as open-source libraries, operating systems and commercial components. IEC 62304 expects you to identify it, specify what you need from it and assess the risks it brings, including its known anomalies.
Do you assess our systems against 21 CFR Part 11?
We review how your electronic records and signatures are created, protected and controlled, and report gaps against Part 11's criteria as findings. Whether a system meets the regulation depends on its configuration, procedures and use, and that determination stays with your organization.
Do you cover cybersecurity?
We help set up security activities across the software lifecycle, with IEC 81001-5-1 as the reference, and connect them to risk management and post-market processes. Cybersecurity content for a specific premarket submission is scoped case by case.
Request an Assessment
Discuss Software Validation and Device Software With an Advisor
Tell us about your devices, your documents and your timeline, and an advisor will scope the work with you. Please don't send confidential documents yet: secure upload is set up after onboarding.
