Software assurance your QA lead can sign with confidence.
Attestra helps life sciences teams show that their computerized systems, including AI, are fit for intended use, with assurance effort proportional to risk to patient safety, product quality and data integrity.
Practitioner-led, with 15+ years of GxP IT quality and computerized-system validation experience across the pharmaceutical, biopharmaceutical and personal care industries.
Assurance that protects patients, not paperwork.
Traditional validation often documents low-risk functions as heavily as critical ones. The result is stacks of scripted evidence that are rarely read again, while the real risks to data integrity and product quality can go unexamined.
We help QA, IT and validation teams put assurance effort where it actually protects patients and data, and adopt new technology, AI included, with confidence instead of fear or shortcuts.
What we do
Two consulting practices on one assurance lifecycle.
Computer Software Assurance
Build a risk-based assurance program from scratch, move existing CSV procedures to CSA, or assure a single system change.
- CSA program build, SOPs and templates
- Assurance plans, risk assessments and traceability
- IQ / OQ / PQ, summary reports and periodic review
AI in GxP
Bring AI and LLM tools into regulated work so they hold up as GxP computerized systems, using GAMP 5 Appendix D11.
- Intended use and risk classification
- Audit trail, human review and e-signatures
- Assurance testing and model governance
Valoryn, in development
We're building software on the same lifecycle our consultants use, to support risk-based planning, traceability and reporting. It is not yet commercially available.
Who we work with
QA, IT and validation teams in pharmaceutical, biopharmaceutical, personal care and other regulated life sciences organizations.
Building a first program
Where it hurtsAn audit finding, a new system or a first inspection, and no assurance program to stand on.
How we helpPolicy, system inventory, risk method, SOPs and templates, built in the order that works.
Moving from CSV to CSA
Where it hurtsProcedures that script every step, long validation cycles, and evidence nobody reads.
How we helpRedesigned SOPs, templates, change control and training around risk-based thinking.
Adopting AI
Where it hurtsAI tools arriving faster than Quality can assess them, with or without controls.
How we helpIntended-use decisions, risk classification, testing and governance that hold up as GxP.
What we believe
One assurance lifecycle
Every engagement follows the same six steps, whether it's a single system change, a CSA program built from scratch, or an AI tool coming into regulated use.
- Intended useWhat the system does and who relies on it
- Risk assessmentFunction-level risk and rationale
- Assurance planThe right activities for each risk level
- TestingScripted where risk warrants, unscripted where not
- Summary reportA clear fitness-for-use conclusion
- Periodic reviewKeeping systems in a controlled state
The frameworks our work is built around
These are the regulations and guidance documents we design deliverables against. They describe how we work; they are not certifications held by Attestra.
- FDA Computer Software Assurance guidance
- GAMP 5, Second Edition
- GAMP 5 Appendix D11 (AI/ML)
- 21 CFR Part 11
- EU GMP Annex 11
- ALCOA+ data integrity
Insights
Practical notes for the QA, IT and validation people who do the work.
Your First CSA Program: What to Build First
Program charter, policy, system inventory, risk method, SOPs, then IQ/OQ/PQ templates, and why starting with templates usually backfires.
When Does an AI Tool Become a GxP Computerized System?
A practical test based on intended use and what the AI influences.
Audit Trail Review That Actually Finds Things
Risk-based audit trail review: what to look at, how often, and how to document it.
Let's talk
Tell us about a new CSA program, a system change, a CSV-to-CSA transition or an AI initiative.