CRO Testing Guide

Define custom tests to validate clinical trial infrastructure for FDA compliance

Overview

Contract Research Organizations (CROs) spend months validating clinical trial infrastructure. OpenFactory enables CROs to define executable tests that validate:

  • FDA 21 CFR Part 11 compliance (audit trails, electronic signatures, time synchronization)
  • Data integrity and security controls
  • Integration with EDC systems, central labs, and safety databases
  • System hardening and access controls
  • Data format validation (HL7, DICOM, CDISC SDTM/ADaM)

Instead of manually validating each system, define tests once and run them automatically on every build. This reduces validation time from months to minutes.

Available Assertion Types

Assertion TypeDescriptionUse Case
service_runningVerify a systemd service is runningNTP sync, audit logging, EDC connectors
service_enabledVerify a service starts at bootCritical services like auditd
package_installedVerify software is installedPostgreSQL, 2FA libraries, DICOM tools
file_existsVerify a file or directory existsConfig files, audit logs, encryption keys
file_containsVerify file contains specific textConfiguration validation
file_permissionsVerify file permissionsSecurity hardening, log access controls
user_existsVerify a user account existsService accounts, operator accounts
user_in_groupVerify user is in a groupAccess control validation
user_passwordVerify user password is set correctlyDefault credentials validation
port_listeningVerify a port is listeningDatabase, web services, HL7 receivers
network_reachableVerify network connectivityCentral lab connectivity, EDC access
http_respondsVerify HTTP endpoint respondsWeb services, REST APIs
command_succeedsVerify command exits with code 0Custom validation scripts
command_outputVerify command output matchesData validation, format checks
GUI & Display Testing
gui_application_opensLaunch GUI application and verify window appearsEDC client startup, imaging viewers, CTMS interfaces
gui_window_visibleCheck if window with specific title is visibleVerify EDC login screen, confirm dialogs, error modals
gui_execute_commandExecute command in terminal and capture screenshotVisual regression testing, UI state validation
gui_application_processVerify application process is runningEnsure EDC client remains active, detect crashes
gui_screenshot_matchesVisual regression testing with baseline comparisonDetect UI changes in EDC forms, verify layouts
gui_click_elementClick UI elements at coordinatesNavigate menus, interact with custom controls
gui_form_fillAutomated form field population and submissionTest eCRF data entry workflows
gui_text_visibleOCR-based text detection on screenVerify error messages, form labels, dialog text

Visual Validation & Screenshot Comparison

Beyond command-line testing, OpenFactory captures real VNC screenshots during test execution to validate visual interfaces. This is critical for CROs validating GUI-based clinical trial systems like EDC clients, CTMS interfaces, and medical imaging viewers.

Current Capabilities: Screenshot Capture

Every GUI assertion automatically captures a VNC screenshot alongside command output. This provides:

  • Visual proof of execution: Screenshots show exactly what was on screen during the test
  • Audit trail for FDA compliance: Timestamped visual evidence of system behavior
  • Debug assistance: See visual errors (dialog boxes, error messages, UI state)
  • Documentation: Screenshots stored with structured metadata for archival and future comparison

Screenshot + Metadata Format

Each screenshot is stored with structured metadata to enable future visual comparison. The system captures two files per assertion:

assertion-123.png

Screenshot captured via VNC during test execution

assertion-123.json

Metadata: match areas, tags, assertion details, command output

{
  "area": [
    {"xpos": 100, "ypos": 50, "width": 300, "height": 200, "type": "match", "match": 95}
  ],
  "tags": ["edc-login", "passed"],
  "properties": {
    "description": "EDC login screen displays",
    "stdout": "Login form rendered successfully"
  }
}

Automated Screenshot Comparison

OpenFactory now supports automated comparison of screenshots against reference images, detecting visual regressions automatically:

gui_screenshot_matches Assertion

Compares captured screenshots to reference images, failing if visual differences exceed threshold:

{
  "type": "gui_screenshot_matches",
  "description": "EDC form layout matches approved design",
  "params": {
    "reference_id": "edc-form-v3.2-approved",
    "threshold": 0.95,
    "ignore_regions": [[10, 10, 200, 30]],
    "match_area": [0, 0, 1920, 1080],
    "save_as_reference": false
  }
}

Use case: Detect when a software update inadvertently changes EDC form layouts, button positions, or required field indicators — all visual regressions that could invalidate a validated system.

Area-Based Matching

Define regions of interest (form fields, buttons, headers) with per-area match thresholds. Ignore dynamic content like timestamps or session IDs.

Pixel-Level Comparison

Perceptual image hashing detects visual changes while tolerating minor rendering differences (anti-aliasing, fonts, subtle color shifts).

Reference Library

Maintain approved reference screenshots for each validated screen. Update library when intentional design changes are made and re-validated.

Visual Regression CI

Automatically detect unintended visual changes in EDC systems, imaging viewers, or dashboards before deploying to production sites.

Clinical Trial Use Cases

EDC Form Validation

Verify that electronic Case Report Forms (eCRFs) display correctly after software updates:

  • Required field indicators (*) are visible
  • Date pickers use correct format (DD-MMM-YYYY)
  • Dropdown options match protocol specifications
  • Edit checks display appropriate error messages

Medical Imaging Viewer UI

Validate DICOM viewer interface for radiology endpoints:

  • Measurement tools display calibrated scale
  • Window/level presets render correctly (lung, bone, soft tissue)
  • Annotation overlays are visible and editable
  • Multi-frame sequences load in correct order

Safety Database Interface

Verify adverse event reporting forms and MedDRA coding interfaces:

  • SAE forms display all required fields per ICH E2B
  • MedDRA autocomplete suggests correct preferred terms
  • Seriousness criteria checkboxes are visible and functional
  • CIOMS form preview matches regulatory template

Why Visual Validation Matters for FDA Compliance

FDA 21 CFR Part 11 requires that computerized systems be validated to ensure accuracy, reliability, and consistent intended performance. Visual validation provides:

  • Audit Trail: Timestamped screenshots prove that system interfaces displayed correctly during validation testing (required for IQ/OQ/PQ documentation)
  • Change Control: Automated visual regression testing detects when software updates inadvertently modify validated interfaces
  • Protocol Compliance: Screenshots verify that EDC forms match protocol-specified data collection requirements
  • Inspection Readiness: Visual proof reduces reliance on manual documentation and human attestation during FDA inspections

Real-World Examples

Central Lab Data Collection

A central lab needs to receive HL7 messages from clinical sites, validate message format, and store results in a database. This example validates the entire data pipeline:

{
  "name": "central-lab-receiver",
  "base_image": "debian-bookworm",
  "features": ["ssh", "headless", "gxp", "audit-logging"],
  "packages": ["postgresql", "python3-hl7", "python3-psycopg2"],
  "test_config": {
    "custom_tests": [
      {
        "description": "Verify HL7 message queue is operational",
        "category": "data-collection",
        "assertions": [
          {
            "type": "service_running",
            "description": "HL7 listener service is running",
            "params": {"service": "hl7-receiver"}
          },
          {
            "type": "port_listening",
            "description": "HL7 port 2575 is listening",
            "params": {"port": "2575"}
          },
          {
            "type": "command_output",
            "description": "Parse sample HL7 message",
            "params": {
              "command": "python3 /opt/scripts/validate_hl7.py /opt/test-data/sample_lab.hl7",
              "expected_output": "VALID"
            }
          }
        ]
      },
      {
        "description": "Verify database is configured for lab results",
        "category": "data-storage",
        "assertions": [
          {
            "type": "service_running",
            "description": "PostgreSQL is running",
            "params": {"service": "postgresql"}
          },
          {
            "type": "command_succeeds",
            "description": "Lab results table exists",
            "params": {
              "command": "psql -U labuser -d labdb -c '\\dt lab_results'"
            }
          }
        ]
      },
      {
        "description": "Verify GxP compliance - audit trails",
        "category": "compliance",
        "assertions": [
          {
            "type": "service_running",
            "description": "Audit daemon is running",
            "params": {"service": "auditd"}
          },
          {
            "type": "file_exists",
            "description": "Audit log exists",
            "params": {"path": "/var/log/audit/audit.log"}
          },
          {
            "type": "file_permissions",
            "description": "Audit log is read-only",
            "params": {"path": "/var/log/audit/audit.log", "mode": "0600"}
          }
        ]
      }
    ]
  }
}

Site Coordinator EDC Workstation

A locked-down workstation for site coordinators to access Electronic Data Capture (EDC) systems. This validates browser restrictions, 2FA, time sync, and encryption:

{
  "name": "site-edc-workstation",
  "base_image": "ubuntu-24.04",
  "features": ["desktop", "gxp", "audit-logging"],
  "packages": ["chromium-browser", "libpam-google-authenticator", "cryptsetup"],
  "test_config": {
    "custom_tests": [
      {
        "description": "Verify EDC access is restricted to approved sites",
        "category": "security",
        "assertions": [
          {
            "type": "package_installed",
            "description": "2FA authentication library installed",
            "params": {"package": "libpam-google-authenticator"}
          },
          {
            "type": "command_output",
            "description": "Browser whitelisting configured",
            "params": {
              "command": "grep 'trial.imedidata.com' /etc/chromium/policies/managed/url_allowlist.json",
              "expected_output": "trial.imedidata.com"
            }
          },
          {
            "type": "command_succeeds",
            "description": "USB storage is disabled",
            "params": {
              "command": "lsmod | grep -v usb_storage"
            }
          }
        ]
      },
      {
        "description": "Verify 21 CFR Part 11 compliance - time sync",
        "category": "compliance",
        "assertions": [
          {
            "type": "service_running",
            "description": "Time sync service is running",
            "params": {"service": "chrony"}
          },
          {
            "type": "command_output",
            "description": "Time is synchronized",
            "params": {
              "command": "chronyc tracking | grep 'System time'",
              "expected_output": "0.0"
            }
          }
        ]
      },
      {
        "description": "Verify disk encryption is enabled",
        "category": "security",
        "assertions": [
          {
            "type": "file_exists",
            "description": "Encrypted home directory",
            "params": {"path": "/dev/mapper/crypt-home"}
          },
          {
            "type": "package_installed",
            "description": "Full disk encryption tools",
            "params": {"package": "cryptsetup"}
          }
        ]
      }
    ]
  }
}

Safety Database Workstation

A workstation for safety physicians to review serious adverse events (SAEs) and generate CIOMS forms. This validates database access, MedDRA tables, and reporting tools:

{
  "name": "safety-database-station",
  "base_image": "debian-bookworm",
  "features": ["desktop", "gxp", "audit-logging"],
  "packages": ["postgresql-client", "libreoffice", "python3-reportlab"],
  "test_config": {
    "custom_tests": [
      {
        "description": "Verify MedDRA dictionary is loaded",
        "category": "data-validation",
        "assertions": [
          {
            "type": "command_succeeds",
            "description": "MedDRA LLT table exists",
            "params": {
              "command": "psql -h safety-db -U safetyuser -d safetydb -c '\\dt meddra_llt'"
            }
          },
          {
            "type": "command_output",
            "description": "MedDRA version is 26.1",
            "params": {
              "command": "psql -h safety-db -U safetyuser -d safetydb -c 'SELECT version FROM meddra_version'",
              "expected_output": "26.1"
            }
          }
        ]
      },
      {
        "description": "Verify CIOMS form generation",
        "category": "reporting",
        "assertions": [
          {
            "type": "command_succeeds",
            "description": "Generate CIOMS I form from test SAE",
            "params": {
              "command": "python3 /opt/safety/generate_cioms.py --sae-id TEST001 --output /tmp/test.pdf"
            }
          },
          {
            "type": "file_exists",
            "description": "CIOMS form PDF created",
            "params": {"path": "/tmp/test.pdf"}
          }
        ]
      },
      {
        "description": "Verify electronic signature validation",
        "category": "compliance",
        "assertions": [
          {
            "type": "package_installed",
            "description": "Digital signature library",
            "params": {"package": "python3-cryptography"}
          },
          {
            "type": "command_succeeds",
            "description": "Sign test document",
            "params": {
              "command": "python3 /opt/safety/sign_document.py /tmp/test.pdf /tmp/test.signed.pdf"
            }
          }
        ]
      }
    ]
  }
}

Biostatistics Workstation

A workstation for biostatisticians to perform CDISC SDTM/ADaM validation and statistical analysis:

{
  "name": "biostat-workstation",
  "base_image": "ubuntu-24.04",
  "features": ["desktop", "gxp"],
  "packages": ["r-base", "python3-pandas", "python3-numpy"],
  "test_config": {
    "custom_tests": [
      {
        "description": "Verify CDISC validation tools are installed",
        "category": "data-validation",
        "assertions": [
          {
            "type": "command_succeeds",
            "description": "R SDTM validator package",
            "params": {
              "command": "Rscript -e 'library(sdtm.oak)'"
            }
          },
          {
            "type": "command_output",
            "description": "Validate sample SDTM dataset",
            "params": {
              "command": "python3 /opt/cdisc/validate_sdtm.py /opt/test-data/dm.xpt",
              "expected_output": "PASS"
            }
          }
        ]
      },
      {
        "description": "Verify statistical software is configured",
        "category": "analysis",
        "assertions": [
          {
            "type": "command_succeeds",
            "description": "R can load test dataset",
            "params": {
              "command": "Rscript -e 'library(haven); read_sas("/opt/test-data/adsl.sas7bdat")'"
            }
          },
          {
            "type": "package_installed",
            "description": "SciPy for Python analysis",
            "params": {"package": "python3-scipy"}
          }
        ]
      }
    ]
  }
}

DICOM Imaging Workstation (Radiology)

A workstation for radiologists to review medical images (CT, MRI, X-ray) with DICOM viewers. This validates GUI application startup, DICOM network connectivity, and image rendering:

{
  "name": "dicom-imaging-station",
  "base_image": "ubuntu-24.04",
  "features": ["desktop", "gxp"],
  "packages": ["dcmtk", "weasis", "orthanc"],
  "test_config": {
    "custom_tests": [
      {
        "description": "Verify DICOM viewer launches and displays images",
        "category": "gui-validation",
        "assertions": [
          {
            "type": "gui_application_opens",
            "description": "Weasis DICOM viewer launches",
            "params": {
              "command": "weasis",
              "window_title": "Weasis",
              "timeout": 10
            }
          },
          {
            "type": "gui_window_visible",
            "description": "DICOM viewer main window visible",
            "params": {
              "window_title": "Weasis Medical Viewer"
            }
          },
          {
            "type": "gui_application_process",
            "description": "Weasis process is running",
            "params": {
              "process_name": "weasis"
            }
          }
        ]
      },
      {
        "description": "Verify DICOM network services (PACS connectivity)",
        "category": "network",
        "assertions": [
          {
            "type": "service_running",
            "description": "Orthanc DICOM server running",
            "params": {"service": "orthanc"}
          },
          {
            "type": "port_listening",
            "description": "DICOM C-STORE port 4242 listening",
            "params": {"port": "4242"}
          },
          {
            "type": "command_succeeds",
            "description": "Query PACS for test study",
            "params": {
              "command": "dcmqrscp -q -c AE_TITLE@localhost:4242 -k StudyInstanceUID=1.2.3.4"
            }
          }
        ]
      },
      {
        "description": "Verify image rendering with screenshot validation",
        "category": "visual-validation",
        "assertions": [
          {
            "type": "gui_execute_command",
            "description": "Load test DICOM image and capture screenshot",
            "params": {
              "command": "weasis /opt/test-data/chest-xray.dcm",
              "wait_seconds": 5
            }
          }
        ]
      }
    ]
  }
}

Screenshot Capture in Action

When gui_execute_command runs, OpenFactory:

  1. Executes the command via guest agent (gets stdout/exit code)
  2. Simultaneously captures a VNC screenshot of the desktop
  3. Stores both as a screenshot + metadata pair (PNG + JSON)
  4. Displays in HTML test report for visual verification

This provides visual proof that the DICOM image rendered correctly, which is critical for FDA validation of imaging systems used in clinical trials.

Test Composability

Instead of creating 50 pre-baked system variants, create one base image and compose different test suites for specific workflows:

Base Image: GxP Workstation

  • Ubuntu 24.04 + desktop
  • GxP features (audit logging, time sync, encryption)
  • Common tools (PostgreSQL client, Python, R)

Test Suite: Central Lab

  • HL7 message validation
  • Database schema checks
  • Audit trail verification

Test Suite: EDC Workstation

  • Browser whitelisting
  • 2FA configuration
  • USB blocking

Test Suite: Safety Database

  • MedDRA dictionary validation
  • CIOMS form generation
  • Electronic signatures

Test Suite: Biostatistics

  • CDISC SDTM/ADaM validation
  • R/Python statistical libraries
  • SAS dataset compatibility

Each test suite validates different aspects of the same base system, reducing duplication and maintenance overhead. When you update the base image, all test suites automatically validate the new build.

Upcoming Assertion Types

These assertion types are in development and will be available in future releases.

database_query

Execute SQL queries and validate results

Example: Verify MedDRA tables, CDISC domains

data_format

Validate HL7, DICOM, CDISC format compliance

Example: Verify HL7 v2.5 message structure

api_responds

Test REST API endpoints with auth

Example: EDC API connectivity checks

file_age

Verify data freshness and log rotation

Example: Ensure audit logs are recent

signature_valid

Validate electronic signatures (21 CFR Part 11)

Example: Verify signed CIOMS forms

certificate_valid

Verify SSL/TLS certificates and expiry

Example: Check EDC site certificates

Get Started

Ready to validate your clinical trial infrastructure?

Contact us to discuss your CRO testing requirements and see how OpenFactory can reduce validation time from months to minutes.