We use and therefore handle SAS and WinNonlin very differently when it comes to validtion.
SAS is treated like a platform, much like MS Excel. You need to know that the system itself installs correctly, doesn’t interfere with anything else, data transfers work (in and out), etc.: i.e. an IQ and a basic PQ (the latter in reality is a user acceptance test). The OQ really lies within the operations you program into them – SAS routines, Excel macros – these either need a thorough testing or 100% OQ checking or somewhere in between. Our statisticians who use SAS have their own internal validation and cross checking procedures that IT have nothing to do with but QA may be interested (if the work is for regulatory purposes).
WinNonLin is another matter. Thankfully (and like SAS) WNL is fairly ubiquitous in Pharma and the confidence of its widespread use, active user forum, etc. can leverage the amount of validation work required. IQ of course, but then you need to consider the standard non-linear PK functionality and the calculation of the output such as AUC, t1/2, etc, etc under various input conditions (lin, log-lin, etc) from various dosing conditions (IV, oral, etc). Those you intend to use should all be tested under OQ and/or UAT. If you have a number of data sets that you have used under another validated system or you can find published in a paper, then you can use these as a comparison in the testing.
I hope that helps and best of luck.