FDA CSA guidance (revised February 2026) recognizes risk-appropriate assurance methods, including scenario-based testing — but it is not a licence to test informally. Unscripted or exploratory testing in pharma still requires documented objectives, risk rationale, and traceable findings. What changes under CSA is the format, not the requirement for evidence.
Scripted vs Unscripted: What Actually Differs
Scripted testing follows pre-written step-by-step protocols — every action and expected result defined before execution. Unscripted testing is guided by objectives and risk areas, with the tester exercising the system freely within that scope. Both produce documented evidence. The difference is how tightly the path is defined upfront.
| Dimension | Scripted Testing | Unscripted / Exploratory Testing |
|---|---|---|
| Format | Step-by-step protocol with expected results per step | Objective-driven — tester determines path during execution |
| Documentation | Pre-written script + execution record | Objective, scope, findings, and outcome recorded during/after |
| Best for | High-risk systems, critical functions, Cat 5 custom software | Low-to-medium risk, configured commercial software (Cat 3 & 4) |
| RTM traceability | Each step links to a requirement | Test session links to requirements and risk areas |
| FDA CSA stance | Always acceptable | Acceptable with documented rationale — risk must justify the approach |
When Unscripted Testing Is Appropriate
Low risk, vendor-validated base. Unscripted exploration of installed configuration is appropriate. Vendor evidence covers the platform.
Unscripted testing suits lower-risk configured workflows. Critical functions affecting product quality still require scripted test coverage.
Full scripted testing required. No vendor evidence to lean on, and higher risk demands full traceability per function.
The risk assessment driving your GAMP 5 classification must explicitly justify the unscripted approach. If the rationale isn't documented, an inspector has no basis to accept the testing as adequate — regardless of what was actually found.
How to Document Unscripted Testing for GxP Compliance
Unscripted doesn't mean undocumented. Every exploratory test session must produce a record that is attributable, retrievable, and linked back to requirements.
- ✓Testing objective. What function or risk area was targeted — and why this approach was chosen over scripted testing.
- ✓Risk rationale. The risk rationale justifying the less-scripted approach — including GAMP 5 classification where your programme uses it — should be documented and retrievable.
- ✓Tester credentials and date. Who performed the testing, their role, and when — must be uniquely attributable under 21 CFR Part 11.
- ✓What was explored. Areas exercised during the session, including any unexpected behaviour observed — positive and negative findings both recorded.
- ✓Outcome and RTM link. Pass, fail, or observation — linked back to the requirements or risk areas the session was designed to address.
GoVal and Unscripted Testing
GoVal supports both scripted and unscripted testing in one platform. Exploratory test sessions are captured in structured templates — objective, scope, findings, outcome — with Part 11-compliant audit trail and automatic RTM linkage. The approach is inspection-ready by design.
Frequently Asked Questions
What is unscripted testing in pharma? +
When is unscripted testing acceptable in GxP validation? +
How do you document unscripted testing for FDA compliance? +
Is unscripted testing the same as exploratory testing? +
How does GoVal support unscripted testing documentation? +
Manage scripted and unscripted testing in one platform
GoVal supports CSA-aligned testing approaches with Part 11-compliant records and automatic RTM linkage — out of the box.