QA/RA Consulting, Auditing & Training
In this article:
How the US FDA defines process validation
Difference between verification and validation
Relationship between design validation and process validation
Which production processes require validation?
Basic steps in process validation
Process validation plans and protocols for IQ, OQ, and PQ
Forming your process validation team
It all starts with a process validation plan
Example of a validation master plan (VMP) checklist
Writing process validation protocols
Content of validation protocols
Format of a basic process validation protocol
Understanding IQ, OQ, and PQ for manufacturing processes
What is installation qualification (IQ)?
What is operational qualification (OQ)?
What is performance qualification (PQ)?
When to revalidate a process
Does your medical device process require revalidation?
Software used in medical device production
Before introducing a new medical device onto the market, manufacturers should have a high degree of certainty that their manufacturing processes have the proper controls in place to produce products that are safe and meet specified user, technical, and regulatory requirements. The US FDA and ISO 13485 require device makers to verify that their products meet documented design specifications, and this may be accomplished through post-production inspection or testing. This is otherwise known as “verifying” product quality and, if you choose this route, you’ll need to test every single device you produce.
But what if testing every product is impractical, would never reveal all variations, or the testing itself destroys the product?
That’s where process validation comes into play. Process validation fulfills an important quality assurance need by subjecting a process to such intense scrutiny that the output of the process is extremely likely to consistently meet established production quality specifications. The key word here is process, because it does not mean validating the device itself.
The US FDA Quality System Regulation defines process validation as follows: “Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.” In section 820.75, FDA goes on to say:
(a) Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures. The validation activities and results, including the date and signature of the individual(s) approving the validation and where appropriate the major equipment validated, shall be documented.
Similarly, ISO 13485:2016 says, “The organization shall validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement.”
Neither FDA nor ISO 13485 provide much instruction on medical device process validation and instead defer to the GHTF SG3/N99-10 guidance published by the GHTF (now the IMDRF) that was released in 2004.
It is important to note that process validation links to other sections of the QMS, including design controls, purchasing controls, personnel, and production/process controls.
Design validation focuses on the device itself and involves creating evidence that it meets user needs and intended uses. Process validation, as the name implies, focuses on the production of the device. Process validation demonstrates that, when a process is operated within specified limits, it will consistently produce product complying with established specifications and requirements. Most companies follow FDA requirements for design control 820.30 and ISO 13485 standard clause 7.3, and then perform validation during the final stage(s) of the product and process development sequence. However, planning begins with the initial design control process implemented by R&D. This helps to identify device quality characteristics and process variables.
Note: Design and development planning is usually a project management type of activity, and design validation in many companies is a cevaluation activity.
Validation should be performed on any new processes that are being implemented, existing processes that need to be qualified on a regular basis, and existing processes that have been modified, expanded (volume or scope), experienced a downward trend in performance, or seen an increase in customer complaints. According to guidance published by the GHTF (as noted above, now the IMDRF), the following are common examples of processes that should be validated:
In addition, process validation is needed if the following conditions exist:
By contrast, there are some processes for which product verification is adequate, such as manual cutting processes, visual inspection of printed circuit boards, and testing of wiring harnesses. In these cases, the output of a process can be verified with high reliability and accuracy. But even with these processes, we need to understand the sources of variation and control them.
The basic principles of process validation must:
To ensure that a manufacturing process will consistently meet certain parameters, you must follow a systematic series of steps, such as those shown below. Some of these steps may be combined, but we have broken them out separately for clarity.
Process validation isn’t something to do alone in a cubicle. You’ll want to get input from experts who know the product and process inside and out. Typically, your cross-functional team will include members from quality assurance, engineering, risk management, clinical evaluation, postmarket surveillance, and manufacturing. Team members should be qualified/competent in:
There are many ways to conduct process validation, but given the huge variation in production volumes and manufacturing complexity, you won’t find many suggestions on how to go about it in FDA regulations or ISO 13485. That being said, this guidance document from 2004 is still the go-to source for medical device process validation. Even the FDA website will refer you to this guidance document.
Once you have formed your validation team, now what? The next step is to create a detailed process validation plan (PVP). The PVP is not an FDA requirement, but it is recommended in GHTF guidance and is always one of the first documents a regulator asks to see. It’s extremely important. Among other things, the process validation plan identifies:
Your PVP should contain the following elements:
Plans can be created for a variety of reasons. Individual validation plans can be used to support the planning of more complex projects, such as new manufacturing lines or transferring production to another vendor.
Your master validation plan will tie together all elements of your facility, from utilities to measuring tools. Within that master validation plan, you’ll identify equipment and processes that will require more detailed protocols. The master validation plan also provides information that is useful for managing schedules, risk, resources, cost estimation, and ongoing activities. Perhaps more important, creating a plan forces you to think about the interrelationships among processes, tools, equipment, and so on.
Your process validation plan provides a general framework for where you want to be, but your protocols are the actual maps on how to get there. Protocols are critical because they help determine if rules or procedures are done correctly and prevent crucial steps from being overlooked. They specify instructions or guidelines on how you plan to carry out a comprehensive study to investigate consistent operation of a new system or new equipment or procedure. Typically, protocols include significant background information. They explain the rationale for an objective of the study, give a full description of the procedures to be followed, set out parameters to be measured, describe how results will be analyzed, and provide predetermined acceptance criteria for reaching conclusions. Protocols determine:
You need to determine the best documentation strategy for your project. A complex piece of equipment like a filling line or a CMC will likely need a process validation plan that identifies the need for separate IQ, OQ, and PQ protocols. A simpler process/equipment such as a pH meter or balance may have a strategy that combines IQ, OQ, and PQ into a single plan/report.
It is important to reiterate that in order to write an effective protocol you need to fully understand the exact product requirements. That’s because your protocols will also establish your criteria for acceptance or rejection and outline the specific documentation you need. Remember, both the US FDA and ISO 13485 require you to document the results of your process validation activities, and this includes writing a clear, simple conclusion!
There are three types of validation protocols (IQ, OQ, PQ) and we will talk more about those later. But first let’s discuss the contents of a protocol. The details of what should be included in your process validation protocol can be found in Here’s what the guidance suggests:
A well-written protocol will outline the correct rules, policies, and procedures to be followed during process validation. As seen below, it includes facilities, equipment, methods, and training. It also identifies process inputs and limits and shows all the necessary steps for successful completion of the process validation project. This outline below is by no means a complete list of everything that should go into your protocol, but it gives you a sense of the detail required. We strongly suggest that you study the GTHF process validation guidance or consider this training class for a deep dive into the subject. Shown below is the basic framework for a protocol:
The goal of process validation is to produce a stable medical device manufacturing process that offers consistent performance. Variation is minimal and predictable. Your process validation plan (PVP) will provide the framework for executing three important phases in the validation process:
IQ can be executed by the facilities, engineering, production, or operations groups. The basic idea is to ensure that everything is installed properly. During this qualification phase, the installation of equipment, piping, services, and instrumentation will be checked against engineering drawings, piping and instrument diagrams (P&ID), and functional specifications developed during the project planning stage. During the project planning stage, all system elements, service conduits, and gauges are identified, and a documented record is prepared showing that all installed equipment satisfies your requirements. At various stages during IQ, you will need to review, check, report, and authorize protocols, documentation, procedures, equipment, specifications, and acceptance criteria for test results.
IQ touches on many tangible and intangible aspects related to installation, including:
There should be an SOP, checklist, or some other documented process that defines the standard installation procedure for each type of system or deliverable being installed. This is required for any equipment used in the manufacturing process. IQ verifies and documents that key aspects of an installation meet approved requirements. These requirements may come from:
The US FDA outlines the key areas of IQ in 21 CFR 820.70(g):
Aside from being a regulatory imperative, installation qualification offers some tangible benefits to the company. For instance, IQ can reduce the risk that workers did not install equipment according to the procedure. It can also reduce the chance that a potentially serious blunder will be overlooked. Examples include having no backup for components damaged or destroyed during installation, purchasing/coding software that won’t work with installed equipment, or installing equipment with voltage or amperage requirements outside the range of your existing electrical supply.
In addition to IQ, you may perform design qualification. DQ proves that the design or selection of the equipment meets your requirements. It documents that that equipment considerations were included in design controls and the equipment requirements were identified prior to purchasing. Think of DQ as the bridge from design to manufacturing. This is an important element in planning for product realization and resources required by ISO 13485:2016 (7.1 and 6.3).
After you have performed IQ and checked all aspects of installation, the next step is to perform operational qualification (OQ). This is where you challenge your parameters to make sure your process will result in a product that meets requirements. OQ is associated with equipment performance to ensure that the functions of machines, measuring devices, utilities, and manufacturing areas perform as intended throughout all anticipated operating ranges in the selected environment. This is typically accomplished by identifying important process variables and providing evidence that even if you produce devices at limits of those parameters they will still meet specs. The OQ process does the following:
It also includes the procedures required to verify specific dynamic attributes of the new or modified process throughout its operating range, which may include worst-case conditions.
Generally, you will start the OQ process according to plan and let it reach standard operating conditions. You will then monitor the operating parameters to ensure that the process start-up occurs as expected. Once the process is stable, you can send product through and test the final product. You can then adjust the operating conditions to test the limits of the key inputs.
While the OQ is being conducted, you’ll want to perform several other checks to ensure they are operating with specified ranges. These include process controls, voltage and amperage levels, computer and software systems, environmental conditions (e.g., temperature, humidity, air quality, etc.), safety, alarms and interlocks, automation features, activity triggers, and timing. This is also an opportunity to check correct use of procedures by operating personnel.
Lack of proper operational qualification can result in many problems. These might include a process that does not start up correctly or, once stabilized, produces a product that does not meet your specifications. Items that have passed the IQ can falter in operation.
The completion of a satisfactory OQ should permit a formal release of the performance qualification (PQ) process. That release should take the form of a written authorization from your validation team and management.
With OQ successfully completed, you can move on to conduct PQ – the final stage in the validation process. By now all the bugs should have been worked out during IQ and OQ so that the PQ should (hopefully) proceed smoothly. During this phase you will generate evidence that your process will consistently produce an acceptable product under normal operating conditions over the long term. PQ is performed on the manufacturing process as a whole. Components of the system or process are typically not tested individually.
Performance qualification should also include testing the system against its operational capacity but not exceeding it. It is important at this stage to ensure that all operational test data conforms with predetermined acceptance criteria from the previous qualifications.
The absence of process qualification can cause many problems, including a process that will not stabilize, or a process that is stable but produces products that meet specifications only intermittently. Thus, a robust process qualification protocol is important. Here are some elements that should be included in your PQ protocol:
Upon successful completion of the PQ, the process validation project will be complete and the new or modified process can be placed into routine production. Your performance qualification report should include statements on whether or not the PQ protocol was followed in its entirety and reasons for any deviations. You will also want to reference all data gathered during the PQ, prepare a summary of conclusions drawn, state whether the expected results were achieved, and specify any follow-up activities you plan to correct deviations.
The following checklist for the PQ portion of process validation combines both the FDA QSR and GHTF guidance:
The completion of a satisfactory PQ should permit a formal release of the process for full production. The release should take the form of written authorizations and approvals from the process validation team and management. The validation team then prepares a final report on the entire process validation project and presents it to management.
To maintain optimal performance, operations management needs to monitor key measures, review work methods and procedures, and take action when problems occur. In doing so, it will become necessary to partially or fully revalidate a process. Section 820.75(c) US FDA QSR requires you to consider revalidating a process under the following conditions: “When changes or process deviations occur, the manufacturer shall review and evaluate the process and perform revalidation where appropriate. These activities shall be documented.”
Potential triggers for process revalidation can include changes to specifications, methods, procedures, software, designs, key components, batch scaling, location changes, equipment changes, and more, such as:
However, process revalidation is not only event-driven; it can also be triggered by the passage of time. Periodic revalidation is not required but you may, for example, determine that a specific process should be subject to a full or partial revalidation every 2 or 3 years, even if everything is running smoothly. This may be determined largely based on the critical nature of the process. An example could be sterilization. This revalidation timeframe needs to be defined in your validation report or your validation master plan.
When you buy a new car you don’t expect it to run smoothly forever. Likewise, despite your diligence and best efforts, glitches will occur and process refinements will be made. Even new or modified processes falter after implementation. Thus, it’s important to remember that process validation is never complete for long. Process performance must be monitored and maintained over time to ensure consistent performance, and full or partial revalidation of IQ, OQ, and PQ is simply part of the ongoing cycle. Revalidation requirements should always be considered an integral aspect of an original validation approval.
The decision on whether to revalidate is one based on risk, as shown in the table below. It can be a perplexing decision for many medical device QA professionals because the determination of risk and impact is somewhat subjective. One of the inputs to a decision to revalidate might be a potential impact to a critical process parameter that might bring about a change in product quality or create a new risk. Another input would be a change to a standard that applies to the process.
A partial revalidation may be to simply repeat the PQ section whereby you are running in production mode but with more sampling. In any case, having a robust risk evaluation process is critical. Partial revalidations need to have a clear justification documenting the reasons a partial or no revalidation was deemed to be appropriate.
| LOW IMPACT | HIGH IMPACT |
HIGH RISK | Partial revalidation | Full revalidation |
LOW RISK | No revalidation | Partial revalidation |
Keep in mind that if you have software that is used in the production of your device, you need to validate (and revalidate) this as well. ISO/TR 80002-2:2017 states that validation must be performed on “software used in production and service provision, and software used for the monitoring and measurement of requirements, as required by ISO 13485:2016: 7.5.6 and 7.6.”
Likewise, TIR36 published by AAMI), says “software used to automate device design, testing, component acceptance, manufacturing, labeling, packaging, distribution, and complaint handling or to automate any other aspect of the quality system, as defined by the Quality System Regulation (21 CFR 820).”
The issue of validating software used in the production of medical devices is an important and complex topic that we will cover in a future article.
We have only scratched the surface of what there is to know about medical device process validation. If you enjoyed this article medical device process validation training class.
US OfficeWashington DC
EU OfficeCork, Ireland
UNITED STATES
1055 Thomas Jefferson St. NW
Suite 304
Washington, DC 20007
Phone: 1.800.472.6477
EUROPE
4 Emmet House, Barrack Square
Ballincollig
Cork, Ireland
Phone: +353 21 212 8530