Cleaning validation — CIP, SIP and proving the residue is gone

Shared equipment is the economic reality of pharmaceutical manufacture — the same vessel, the same lines, the same filler, one product after another. Cleaning validation is the evidence that the previous product is not in the next one, and it is one of the most reliably cited areas in a GMP inspection because it is one of the easiest to do badly.

Clean in place

CIP cleans the equipment without dismantling it, by circulating solutions through the system in a programmed sequence. Dismantling is avoided not for convenience but because reassembly is itself a contamination risk and because nobody can take a welded loop apart.

A typical sequence runs: pre-rinse with water to flush the bulk product out before anything is dosed; alkaline wash, usually caustic, to attack organic and protein residue; intermediate rinse; sometimes an acid wash to deal with inorganic scale and to neutralise; final rinse with purified water or WFI depending on what the equipment does next; then drain and, if required, dry.

Everything in hygienic piping is in service of this. A dead leg is a place the CIP flow does not reach, a rough surface is residue the flow does not lift, and a low point is cleaning solution that stays behind to contaminate the next batch.

SIP — sterilisation in place — is the separate step that follows where the equipment has to be sterile as well as clean. Clean first, sterilise second; steam does not clean, and sterilising a dirty surface leaves sterile residue. The physics of that cycle is in clean steam and sterilisation.

What has to be gone

Four things are being removed, and they need separate thought.

The previous active ingredient — the one everyone concentrates on.

The cleaning agents themselves. Caustic and acid are chemical contamination in their own right, which is why the final rinse has an acceptance criterion and why rinse conductivity is monitored.

Bioburden and endotoxin. A clean surface that is wet is a growing surface, which is why drying and clean hold time matter.

Degradants. Caustic at temperature does not just dissolve the active, it reacts with it. The residue you are looking for may not be the molecule you started with — and an analytical method specific to the parent compound will not see it.

Setting the limit

This is where the subject has genuinely moved, and where a lot of older material is now out of date.

The old criteria were arithmetic conveniences. The carryover was limited to some fraction of a therapeutic dose — typically a thousandth — or to 10 ppm of the residue in the next product, with the stricter of the two applying. Neither had any toxicological basis; they were simply defensible-sounding numbers.

The current approach sets the limit from the compound’s own toxicology. A permitted daily exposure (PDE), also called an acceptable daily exposure, is derived by a qualified toxicologist from the available data — the dose at which no adverse effect is observed, divided by a set of adjustment factors covering species differences, individual variation, study duration and severity.

The EMA guideline on shared facilities established this, and EU GMP Annex 15 reflects it: health-based limits are the expectation.

A visually clean requirement sits alongside the analytical limit, not instead of it. It catches the gross failure nobody swabbed for. But note the asymmetry: a visibly dirty surface is a definite failure, while a visibly clean surface proves very little, because residue at many times its limit is invisible.

Worst case and the matrix

Validating every product against every other product on a multi-product train is combinatorially hopeless. So a matrix approach is used, and its validity rests entirely on the worst case being correctly chosen.

Hardest to clean — poor solubility in the cleaning medium, high viscosity, a tendency to adhere or to dry hard. Established by laboratory coupon work rather than by opinion.

Most hazardous to carry over — the lowest PDE.

Worst-case locations are chosen the same way: the places the flow reaches least and the residue clings most. Weirs, agitator shaft seals, the back of baffles, outlet valve bodies, flexible hose connections, gaskets. The sampling plan is the documented argument for why those locations represent the equipment.

Sampling — and the number that makes it mean something

Swab sampling is direct. A wetted swab is wiped over a defined area, in a defined pattern, and extracted for analysis. It tests the specific location you chose, which is its whole value.

Rinse sampling collects the final rinse and analyses it. It reaches every surface the rinse touched, including places no swab can go, and it averages over all of them — so a local deposit is diluted into invisibility.

They answer different questions and the normal practice is both.

Analytical methods are specific where the active is being measured — HPLC typically — and non-specific where the question is total residue, which is what TOC does. TOC is attractive for rinse samples because it catches cleaning agent, degradant and active together, and it is blind to anything without carbon.

Hold times, and keeping it valid

Dirty hold time — how long equipment may stand between use and cleaning — is validated, because residue that has dried and aged is a different cleaning problem from fresh residue.

Clean hold time — how long clean equipment may stand before use — is validated too, because a vessel does not stay clean indefinitely, and the failure mode here is microbiological rather than chemical.

Both get limits in the procedure, and both are the sort of parameter that quietly drifts in practice when a plant gets busy.

Continued verification is the end state. Annex 15 expects cleaning to be monitored on an ongoing basis rather than validated once and forgotten: parameters trended, periodic sampling, and a formal review triggered by any change to products, equipment, cleaning agents or cycle. Which puts it in exactly the same family as the qualification lifecycle.

What to take away

• CIP is time, temperature, concentration and flow, all four validated, monitored and recorded — and coverage is what makes flow real in a vessel.
• Clean then sterilise. SIP does not clean, and sterile residue is still residue.
• Four things have to go — active, cleaning agent, bioburden and endotoxin, and degradants that your specific method may not even see.
• Limits are health-based now. A PDE from toxicology, not a thousandth of a dose or 10 ppm.
• The limit depends on the next product, its smallest batch and largest daily dose, and on a real shared surface area figure.
• Visually clean is necessary, not sufficient. Dirty proves failure; clean proves almost nothing.
• A matrix is only as good as its worst case — hardest to clean and most toxic, which are often two different products — and it has to be reopened when the product list changes.
• Swab and rinse answer different questions, and a swab result without a recovery factor is uninterpretable.
• Hold times both ways are validated parameters, and cleaning is verified continuously rather than once.