The validated state is the condition in which documented evidence continues to support the conclusion that a system is fit for its intended use and remains under appropriate control.
A validated state is established when required validation or assurance activities have been completed, acceptance criteria have been met, material issues have been addressed, and applicable release requirements have been satisfied. Organizations may document this conclusion through a Validation Summary Report or another approved release mechanism.
Validated-state maintenance relies on an integrated set of controls that may include change management, configuration management, incident and problem management, supplier oversight, security and access management, backup and recovery, training, periodic review, and risk-based revalidation or additional assurance.
Change management should evaluate applicable changes and determine their potential effect on intended use, risks, controls, and validation evidence. Where advance supplier information is available, assessment should be performed prospectively; otherwise, the organization should apply its defined process for evaluating the change and its impact.
For cloud platforms, supplier releases may challenge the validated state on a schedule outside the customer’s control. Technology can support continuous assurance by identifying changes, presenting them for risk and impact assessment, maintaining traceability, and updating associated documentation, with appropriate expert review and approval.
Frequently Asked Questions
How does a system lose its validated state?
The validated state may be called into question by unassessed changes, significant incidents, ineffective controls, unsupported configurations, unresolved deviations, missing required reviews, or evidence that the system no longer performs as intended.
How do you demonstrate the validated state in an audit?
Provide the approved baseline validation or assurance evidence together with records showing how applicable changes, incidents, access, supplier activities, periodic reviews, and revalidation or additional assurance have been managed throughout operation.
Is the validated state permanent once achieved?
No. It must be maintained through the applicable life-cycle controls. The passage of time alone does not determine status; the organization should be able to demonstrate that the system remains fit for intended use and that relevant changes, incidents, risks, and controls have been appropriately managed.
What restores the validated state after a gap is discovered?
Use a documented recovery process to define the gap, assess accumulated changes and risks, determine whether controls remain effective, perform targeted remediation and assurance activities, and approve a supported conclusion regarding fitness for intended use.