Failure to adequately establish and maintain procedures for software validation and to perform risk analysis, where appropriate, as required by 21 CFR 820.30(g). For example: a. Design validation of device software was not performed for some versions of the software and is inadequate for other versions. Specifically, your firm has not conducted validation of your [redacted] Software after changes to the software’s functionality have been made from your first distribution of Version [redacted] through your current Version [redacted]. Also your firm’s most current software validation of the [redacted] Software [redacted] Platform is inadequate in that the validation that was conducted for Version [redacted] consisted primarily of functional testing (black-box testing) and lacks other elements of software validation including structural testing (white-box testing).
View the original warning letter.