Qualification and validation — DQ, IQ, OQ, PQ and the record that proves it

Everything else in a pharmaceutical plant produces a result. Qualification produces the evidence that the result can be relied on — and in a regulated industry, a process that works but cannot be shown to work is a process that cannot be used.

The principle underneath it is simple and it is worth stating plainly: quality cannot be tested into a product. Testing a sample of a batch tells you about the sample. Confidence in the batch comes from knowing the equipment, the facility and the process were under control while it was made.

The documents that come before the testing

The user requirement specification (URS) is written first, before anything is bought, and it says what the equipment must do for this process — capacities, ranges, accuracies, materials of contact, cleanability, the data it must record, the regulations it must satisfy.

The validation master plan sits above the individual protocols and sets out the scope, the approach, the responsibilities, the sequence and the acceptance philosophy. ICH Q9 supplies the risk management framework that decides where effort is concentrated — because qualifying everything to the same depth wastes effort on what does not matter and dilutes attention from what does.

ASTM E2500 is worth knowing as the alternative shape of the same argument. Rather than a fixed sequence of protocols, it takes a science- and risk-based verification approach built on critical quality attributes and critical process parameters, leaning on good engineering practice and vendor documentation where they are sound. EU GMP Annex 15 accommodates this, and a modern project often runs a hybrid.

The four stages

Design qualification

DQ verifies that the proposed design satisfies the URS — on paper, before the order is placed. It is the cheapest stage to do well and the most expensive to skip, because a design shortfall discovered at OQ is a shortfall in installed steel.

Installation qualification

IQ verifies that what arrived is what was specified and that it was installed correctly. Static, documentary, no performance:

Equipment identity — model, serial number, drawings as-built.
Materials of construction verified against certificates, which for hygienic work means the 316L documentation, the finish records and the weld log.
Utilities connected and correct — power, compressed air, steam, water.
Instruments present, identified and calibrated, with certificates traceable to national standards.
Documentation handover — manuals, spares, maintenance requirements, software version.

Operational qualification

OQ challenges the equipment across its operating range, normally without product. Setpoints, ranges, alarms, interlocks, failure responses, security and access control, and the limits rather than only the middle.

Performance qualification

PQ runs the actual process, with the actual material, under production conditions, and demonstrates the output is consistently acceptable. Process validation in the wider sense is the same claim at the process rather than equipment level.

Three batches is a convention, not a rule

The practice of validating on three consecutive successful batches is deeply established and appears in no major regulation as a number.

What the guidance actually asks for is enough batches to demonstrate consistency, and how many that is depends on how variable the process is. For a well-characterised, tightly controlled process three may be ample. For a variable one, three successful batches is three data points and tells you very little — and defending the number of three for its own sake is a weak position to be in.

Current thinking goes further and treats validation as a lifecycle: process design, qualification, then continued process verification — ongoing monitoring and trending that confirms the process stays in control long after the three batches were signed off.

Qualifying the facility, not only the equipment

The same four stages apply to the plant itself, and the sequence matters because each layer depends on the one before.

Cleanrooms and HVAC — airflow, filter integrity, classification at rest and in operation, pressure cascades, recovery time.

Water systems — qualified in phases over an extended period, because the question is not whether the water is compliant today but whether the system reliably produces compliant water through seasonal variation, through sanitisation cycles, and at every point of use.

Sterilisation — cycle development, heat distribution and penetration, biological challenge, each load pattern.

Cleaning — coverage, cycle parameters, residue limits, recovery, hold times.

Computerised systems — qualified against GAMP 5 categories, with 21 CFR Part 11 or Annex 11 requirements on electronic records and signatures: audit trails, access control, data retention, electronic signature integrity.

An open ring binder of protocol pages lying on a stainless steel bench with a pen beside it, a handheld digital thermometer and a printed calibration certificate alongside. Behind and out of focus, a stainless steel skid of hygienic pipework, valves and vertical columns with a control panel on its end frame. — The instrument, its calibration certificate and the protocol page are one object in practice. A reading taken on an uncalibrated instrument is not evidence of anything at all.

Deviations, and why a perfect protocol looks wrong

Things go wrong during execution. An instrument reads out of tolerance, a step cannot be performed as written, a result falls outside its criterion.

A protocol executed with no deviations invites suspicion

Experienced inspectors do not read a flawless execution record as evidence of a flawless project. They read it as evidence that deviations were not being recorded.

What is actually being assessed is the handling: was it written down when it happened, was the cause investigated, was the effect on the conclusion assessed, was the protocol amended through a controlled route if it needed to be, and is the conclusion still supported by the data that exists?

The failure mode to avoid is the quiet one — an out-of-tolerance result corrected without record, a step performed differently from the written instruction, a protocol signed as complete with a section left blank. Each of those turns a qualification document into a liability rather than evidence.

Data integrity

A qualification record is only worth what its credibility is worth, and the attributes that establish that are the ALCOA set — attributable, legible, contemporaneous, original, accurate — commonly extended with complete, consistent, enduring and available.

Two of them do most of the work in practice. Attributable means every entry identifies who made it. Contemporaneous means it was made at the time of the activity, not written up afterwards from a notebook — because a record assembled later is a recollection, and a recollection is not evidence.

Keeping the validated state

Qualification is a statement about a configuration at a point in time. Two things keep it true.

Change control. Any change to equipment, facility, utility, process, material or software is assessed before it is made, for its effect on the validated state and for what requalification it triggers. A change made without that assessment does not merely risk a problem — it means the installed system is no longer the system the evidence describes.

Periodic review and ongoing monitoring. Systems are reviewed on a cycle against their change history, deviations, calibration record and maintenance record, and continued process verification trends the process between reviews. The purpose is to catch the slow drift that no single event would have flagged.

What to take away

Quality cannot be tested in. The evidence of control is what makes the product reliable, and qualification produces that evidence.
The URS governs everything. Every criterion traces to it; qualifying against the vendor’s specification proves the wrong thing.
DQ on paper, IQ static against documents, OQ across the range, PQ with the real process.
Test the limits at OQ. An untested range is a range you cannot operate in.
Three batches is a convention. What is required is enough to demonstrate consistency, which depends on the process.
Validation is a lifecycle, ending in continued process verification rather than in a signature.
Record deviations honestly. The handling is what is assessed, and a protocol with none at all reads as a record-keeping failure.
Attributable and contemporaneous are what make a record evidence at all.
Change control is what keeps the validated state true, backed by periodic review.