CPMS Software Validation & Testing Flashcards

What does the term 'software of unknown provenance' (SOUP) refer to in IEC 62304?

Answer: Pre-existing software with no adequate record of its development process

SOUP refers to software already in existence for which there is no adequate record of its development process, requiring special risk-based assessment.

Which approach best describes 'risk-based testing' in medical software validation?

Answer: Allocating more testing effort to functions with higher risk to patient safety

Risk-based testing prioritizes testing effort by allocating more resources to software functions that pose greater risk to patient safety or data integrity.

What is the significance of a software 'Change Control' process in medical device software maintenance?

Answer: It ensures all software changes are documented, evaluated for impact, and validated before implementation

Change control ensures that every software modification is formally documented, assessed for risk and validation impact, and approved before deployment.

In software validation, what does 'protocol deviation' mean?

Answer: Any departure from the documented validation protocol that must be recorded and justified

A protocol deviation is any departure from the approved test protocol that must be documented with justification and evaluated to determine impact on validation results.

Which type of software testing examines code structure, logic, and syntax without executing the program?

Answer: Static analysis

Static analysis reviews source code, logic, and syntax without running the program, identifying defects early in the development lifecycle.

Under 21 CFR Part 820, what is the requirement for software that is part of a finished medical device?

Answer: It must be validated as part of the device design controls process

21 CFR Part 820 requires that software incorporated into a finished medical device be validated as part of the design controls process.