Get ready for your CSV interview with 25 simple questions and answers on GAMP 5, IQ OQ PQ, Part 11, CSA and data integrity. Easy words, real examples.
Walking into a CSV interview can feel scary, especially if you are new to pharma or medical devices. The good news is that interviewers ask the same kind of questions again and again. If you know the basics and can explain them in plain words, you are already ahead of most people.
This guide gives you 25 questions with short answers you can say out loud. It also covers the newer topics, like the FDA’s Computer Software Assurance (CSA) guidance and the second edition of GAMP 5, because interviewers ask about them more and more.
What Is Computer System Validation? A Quick Look
Computer System Validation, or CSV, means proving with written proof that a computer system does what it should do, every single time. Companies that make medicines, vaccines and medical devices must do it. If their software gives a wrong result, a patient could get hurt.
Most CSV work follows five steps. Keep this picture in your head, because it helps you answer many questions.
Basic CSV Interview Questions
Q1. What is Computer System Validation?
CSV is the process of showing, with documents and test results, that a system works as intended and keeps working that way. A simple line you can use: “Say what you will do, do it, and prove it.”
Q2. Why do we need CSV?
There are three main reasons:
- Patient safety. A bug in a dosing or batch release system can cause real harm.
- Product quality. Wrong data can lead to a bad batch reaching the market.
- Data integrity. Regulators want to trust the records your systems create.
Also, inspectors from the FDA, EMA or MHRA can issue warnings if a system was not validated.
Q3. What does GxP mean?
GxP stands for “good practice” rules. The x changes with the area: GMP for manufacturing, GLP for labs, GCP for clinical trials and GDP for distribution.
Q4. Which systems need validation?
Any system that can affect patient safety, product quality or GxP data. Common examples are LIMS, MES, QMS, ERP systems used for batch release, chromatography data systems, SCADA and lab instruments with software. A plain tool used only for email or office work usually does not need it.
Q5. What is the difference between verification and validation?
Verification asks, “Did we build it right?” It checks the system against the written specifications. Validation asks, “Did we build the right thing?” It checks that the system meets what the users really need.
Q6. Explain the CSV life cycle.
- Plan the work (Validation Master Plan, validation plan, risk assessment).
- Write the requirements and specifications.
- Build or configure the system.
- Test it (IQ, OQ, PQ) and record the results.
- Write the validation summary report and release the system.
- Keep it controlled with change control, reviews and backups until it is retired.
CSV Documents and Testing Questions
Q7. What is a Validation Master Plan (VMP)?
The VMP is a top-level document. It tells everyone which systems are in scope, who is responsible, what rules will be followed and how validation will be done across the site or company.
Q8. What are URS, FS and DS?
These are the main specification documents. The table below shows what each one does.
| Short name | Full name | What it tells you |
| URS | User Requirement Specification | What the users need the system to do |
| FS | Functional Specification | How the system will meet each need |
| DS | Design Specification | Technical details: settings, database, hardware |
| RA | Risk Assessment | Which functions carry the highest risk |
| TM | Traceability Matrix | Links each requirement to its tests |
| VSR | Validation Summary Report | Final result and a clear go or no-go decision |
Q9. What is a traceability matrix?
It is a table that links every requirement to the specification and the test that covers it. If a requirement has no test, the matrix shows a gap right away. Auditors love this document because it proves nothing was missed.
Q10. What are DQ, IQ, OQ and PQ?
These are the qualification steps. Each one proves a different thing, and each one matches a plan on the left side of the V-model shown below.
| Step | Name | What you check |
| DQ | Design Qualification | The chosen design and vendor fit the requirements |
| IQ | Installation Qualification | The system is installed correctly with the right versions and settings |
| OQ | Operational Qualification | Each function works across its full range, including error cases |
| PQ | Performance Qualification | The system works in real daily use, with real users and real data |
Q11. What makes a good test script?
A good script has a clear step, an expected result, space for the actual result, a pass or fail mark, the tester’s name and date, and proof such as a screenshot. Anyone should be able to run it and get the same answer.
Q12. What do you do when a test fails?
Stop, write it down as a deviation, find the cause, fix it (through change control if needed), then run the test again. Never erase the failed result or change it quietly. The failure and the fix both stay in the record.
Q13. What is UAT?
User Acceptance Testing is done by the people who will use the system. They follow real work steps and check that the system meets the URS before it goes live.
Q14. What is the difference between FAT and SAT?
FAT is the Factory Acceptance Test, done at the vendor’s site before shipping. SAT is the Site Acceptance Test, done at your site after delivery. Good FAT results can sometimes reduce the testing needed at SAT.
Regulation and Data Integrity Questions
Q15. What is 21 CFR Part 11?
It is the US FDA rule for electronic records and electronic signatures. It says they must be as trustworthy as paper records and handwritten signatures. Key points are secure logins, audit trails, controlled access and signatures linked to the person who signed.
Q16. What is EU Annex 11?
Annex 11 is the European GMP rule for computerised systems. It is similar to Part 11 but puts more weight on risk management, supplier checks, data backup and the full life cycle of the system.
Q17. What is ALCOA+?
It is a simple rule set for good data. Data must be:
- Attributable (who did it and when)
- Legible (readable)
- Contemporaneous (recorded at the time)
- Original (or a true copy)
- Accurate
- Plus complete, consistent, enduring and available (the “+”)
Q18. What is an audit trail?
An audit trail is a secure, time-stamped log that records who created, changed or deleted data, what changed, when, and why. Users must not be able to switch it off or edit it. Someone independent should review it regularly.
Q19. What is needed for a valid electronic signature?
The signature must be unique to one person, use at least two identity parts (like user ID and password) and show the signer’s printed name, the date and time, and the meaning of the signature, such as “reviewed” or “approved”. It must also stay linked to its record.
GAMP 5, Risk and CSA Questions
Q20. What is GAMP 5?
GAMP 5 is a guide from ISPE that explains how to validate computerised systems using a risk-based method. It is not a law, but regulators and companies widely follow it. The first edition came out in 2008. The second edition was published in July 2022 and adds help on agile projects, cloud systems and critical thinking.
The classic software categories are still a common interview topic:
| Category | Type | Example |
| 1 | Infrastructure software | Operating system, database engine |
| 3 | Non-configured product | Software used as it comes, with no changes |
| 4 | Configured product | LIMS or QMS set up with workflows and rules |
| 5 | Custom software | An application written just for your company |
Tip: The second edition changed how software is grouped, so say that you would follow your own company procedure. That shows you understand it is guidance, not a fixed rule.
Q21. What is a risk-based approach?
You spend more effort on functions that can hurt patients or data, and less on low-risk functions. For example, a calculation that sets a drug dose gets deep testing. The colour of a screen button does not.
Q22. What is CSA, and how is it different from CSV?
CSA means Computer Software Assurance. The FDA published its final guidance on 24 September 2025. It replaces Section 6 of the older “General Principles of Software Validation” guidance. It was written for production and quality system software at medical device makers, but many drug companies use the same thinking, and GAMP 5 second edition supports it. It does not change the law. It changes how you show compliance.
| Topic | Traditional CSV | CSA |
| Main focus | Writing documents | Thinking and real assurance |
| Testing effort | Often the same for all features | Based on risk, high risk gets more |
| Test method | Mostly scripted tests | Scripted, unscripted and exploratory |
| Evidence | Many screenshots and signatures | Enough proof, often a short record |
| Vendor work | Often repeated | Reuse good vendor testing |
Q23. What is change control and when do you revalidate?
Change control is the formal way to request, review, approve, test and record any change to a validated system. You assess the impact first. A small patch may need only a quick check. A big upgrade or new feature may need new OQ or PQ tests.
Q24. How do you validate a cloud or SaaS system?
You cannot test the vendor’s servers, so you check the vendor instead. Review their audit reports and quality system, sign a quality agreement, and test your own setup and your own use of the system. Then watch every vendor release through change control, since SaaS updates arrive often.
Real-Life Scenario Questions
Q25. An old system was never validated. What would you do?
I would first do a risk assessment to see how much the system affects quality and data. Then I would do a gap check against current needs, write the missing requirements, test the high-risk functions and fix any gaps. While that is going on, I would add extra controls such as manual checks. Finally I would write a report and bring the system under change control.
Another favourite: “Two people share one login. What is the problem?” Answer: you can no longer say who did what, so the data fails the “attributable” rule. Each person needs a personal account.
Tips to Answer Well in Your CSV Interview
- Tell the story in order: plan, specify, test, report, maintain. It keeps your answers clear.
- Use a real example from work or a training project, even a small one.
- Learn the short names (URS, IQ, OQ, VSR) and say the full name the first time.
- If you do not know something, say how you would find the answer, such as checking the SOP. Honesty beats guessing.
- Keep each answer to about 30 to 60 seconds.
- Read the job post. If it mentions cloud, QA or labs, practise questions for that area.
CSV Interview FAQ
Is CSV a good career in 2026?
Yes. Pharma, biotech and device companies keep adding digital tools, and every regulated system needs someone who understands validation. Skills in cloud, data integrity and CSA are especially in demand
Do I need coding skills for a CSV job?
Not for most roles. You need to read specifications, write clear test steps and understand how a system works. Basic SQL or scripting helps for automation, but it is not a must.
Is CSV the same as CSA?
No. CSV is the long-used way of validating systems, with a lot of documents. CSA is a newer, risk-focused way that asks for less paperwork and more critical thinking. Both aim to show the system is fit for use.
How long does it take to validate a system?
It depends on size and risk. A simple off-the-shelf tool may take a few weeks. A large custom system can take many months.
What should a beginner study first?
Start with the life cycle, the document names, IQ, OQ, PQ, Part 11 and ALCOA+. Then read the free summaries of GAMP 5 and the FDA’s CSA guidance.
Which certificate helps for CSV roles?
No single certificate is required. Short courses on GAMP 5, data integrity and GMP basics are useful, and they show employers you took the time to learn.
Final Thoughts
CSV looks big at first, but it comes down to one idea: show proof that your system can be trusted. Learn the life cycle, know your documents, understand Part 11 and data integrity, and be ready to explain how risk decides your effort. Practise saying the answers above out loud, add one real example to each, and you will sound like someone who has done the work. Good luck with your interview.
