"Can I ask you a question? Define validation."

...Nothing like that being the first thing out of a client's mouth when I walk into the room for what was supposed to be a meet-and-greet. What I said at the time was "making sure that a system fulfills the requirements set forth by FDA." The client, being who he was, of course responded "Do you really believe that?" to which I said that if I didn't, I was in the wrong job.

I do still believe it, but I wish I'd thought to give a more complete answer. Fundamentally, my job is to make sure that the computerized systems we use comply with FDA regulations. That having been said, in terms of computerized systems, pretty much all you have to deal with as far as FDA regulations go is 21 CFR Part 11 and predicate rules. (HIPAA needs to be considered as well, but that doesn't so much figure into our clinical trials because we don't store PHI.) Predicate rules for computerized systems can be summed up by two points:

(1) If you didn't document it, it didn't happen.
(2) Do what you say you're going to do.

That, plus the requirements set forth by 21 CFR Part 11, form the basis of what I do. It's deceptively simple; you wouldn't think it would be as difficult to document policies and procedures and a plan that complies with those policies and procedures, execute to that plan, and document the execution as it seems to be.