Hi there,
would like some information regarding required validation of an off-the-shelf eCRF software, here is the scenario:

The contracted CRO provides Data Management services and they use an EDC system called Clincapture, this is a cloud system so there is no required installation of the product just username and password to access.
The CRO has audited their software supplier and have checked the source code validation package and deemed it suitable as an approved vendor.
Since this is an EDC system database screens need to be built as per protocol as well as necessary validation checks within the database. Currently the CRO has not performed any sort of validation/user interface check prior to study specific screens built on the basis that their software supplier had performed software validation and since they are not coding any specific to the study database that should be sufficient. Also prior to database is live the CRO and Sponsor perform UAT on the database and therefore they claim it is sufficient validation of the database.

However I think that a user interface test should have been performed upon purchase of the product to verify that the product complies to the description and functionalities required, and that they performed correctly. Is this correct? or really there is no regulatory requirement for this validation test?

Please advise, Thanks