Validation explained: CQV, IQ, OQ and PQ

What does CQV stand for?

Commissioning, qualification and validation. It is an industry label for the sequence of work that takes a facility, utility or piece of equipment from installation to routine production of medicines.

Commissioning is the engineering work of getting a system started up and working to its design. Qualification is the documented GMP proof that it is suitable. Validation, in its narrower sense, is the proof that the manufacturing process built on top of it works consistently.

Annex 15 itself talks about qualification and validation and does not define commissioning as a stage, so companies set out how commissioning fits in their own procedures. ¹ Good commissioning records can reduce repeat work later, because Annex 15 allows some testing to be relied on where it is justified. ¹

Which rules apply in Ireland?

Irish manufacturers of medicines work to EU GMP, published in EudraLex Volume 4, and Annex 15 is the part that deals with qualification and validation. ^{1 2} The Health Products Regulatory Authority is the Irish regulator. ³

Sites supplying the United States must also meet FDA expectations. The FDA's 2011 guidance on process validation describes three stages: process design, process qualification and continued process verification. ⁴ The vocabulary differs from Annex 15, but the logic is similar: understand the process, prove it, and keep watching it.

Annex 15 also expects a risk-based approach, and ICH Q9 is the international guideline on quality risk management that sits behind it. ⁵ In practice, that means the depth of qualification work should follow the risk to product quality.

What comes before IQ?

The requirements and the design. Annex 15 starts the qualification life cycle with the specification, and says the URS should be a point of reference throughout the validation life cycle. ¹

Annex 15 says that where appropriate and justified, documentation review and some tests could be performed at FAT or other stages without being repeated at IQ or OQ, if it can be shown that transport and installation do not affect the functionality. ¹ Agreeing this early, before the vendor runs its tests, is one of the better ways to avoid duplicated work.

• URS, the user requirements specification. It defines what the equipment, facility, utility or system must do. ¹
• DQ, design qualification. The compliance of the design with GMP is demonstrated and documented, and the requirements in the URS are verified. ¹
• FAT, factory acceptance testing. Before installation, equipment is confirmed to meet the URS or functional specification at the vendor's site, where applicable. ¹
• SAT, site acceptance testing. FAT may be followed by testing at site after the equipment arrives. ¹

What is installation qualification (IQ)?

The documented verification that facilities, systems and equipment, as installed or modified, comply with the approved design and the manufacturer's recommendations. ¹

The plain-language question is simple: is it what we ordered, and is it put in correctly?

• Components, instrumentation, equipment, pipework and services installed correctly against the drawings and specifications. ¹
• Installation verified against pre-defined criteria. ¹
• Supplier operating and working instructions, and maintenance requirements, collected. ¹
• Instruments calibrated. ¹

What is operational qualification (OQ)?

The documented verification that facilities, systems and equipment, as installed or modified, perform as intended throughout the anticipated operating ranges. ¹

OQ normally follows IQ, though depending on the complexity of the equipment the two can be combined as an IOQ. ¹ It should include tests developed from knowledge of the processes, systems and equipment, along with tests that confirm upper and lower operating limits, or worst-case conditions. ¹

Annex 15 says completing OQ should allow standard operating and cleaning procedures, operator training and preventative maintenance requirements to be finalised. ¹ The plain-language question here: does it work across the range we intend to use?

What is performance qualification (PQ)?

The documented verification that systems and equipment can perform effectively and reproducibly based on the approved process method and product specification. ¹

PQ should normally follow successful IQ and OQ, though in some cases it may be run alongside OQ or process validation. ¹ It includes tests using production materials, qualified substitutes or simulated product with equivalent behaviour, under normal operating conditions with worst-case batch sizes. ¹ The plain-language question: does it keep doing the job under real conditions?

How is process validation different?

Qualification is about the equipment and systems, while process validation is about the process run on them. Annex 15 treats qualification of the equipment and utilities involved as a foundation for process validation. ¹

The FDA's stages offer a useful way to see the whole picture. Stage one, process design, builds the understanding. Stage two, process qualification, confirms the process design is capable of reproducible manufacture. Stage three, continued process verification, watches it during routine production. ⁴

Cleaning validation and computerised system validation are related but separate pieces of work, and each has its own sections of guidance. Annex 11 covers computerised systems, and the Commission has consulted on a revision of Annex 11, Chapter 4 and a new Annex 22 on artificial intelligence. ^{2 6} Check the status of that revision if you are planning a new system.

Does it end once the equipment is qualified?

No. Annex 15 says equipment, facilities, utilities and systems should be evaluated at an appropriate frequency to confirm they remain in a state of control. ¹

Where requalification is needed at a set period, that period should be justified and the evaluation criteria defined, and the possibility of small changes over time should be assessed. ¹ Changes go through change control, so a modified system may need some of this work repeated. Keep the records in a state an inspector could follow, because undocumented work is hard to defend.

Where do these projects usually run into trouble?

In our view, most trouble traces back to the early documents and to work done out of order. Watch for the following.

Building the plan around risk and around traceability from requirement to test avoids most of these. A traceability matrix, linking each requirement to the test that proves it, is a simple tool that repays the effort.

• A vague URS, which makes every later test harder to justify.
• Vendor testing that cannot be relied on, because nobody agreed the acceptance criteria or documentation first.
• Protocols written after the schedule was set, leaving no time for review and approval.
• Calibration, drawings or spare parts lists that lag behind the equipment.
• Too many tests with no link to risk, which uses up time without adding assurance.
• Handover to operations left to the end, with procedures and training unfinished.

How can specialist consultants help?

On a defined work package with a clear deliverable. Typical examples are drafting a URS, writing and running IQ, OQ and PQ protocols, or preparing a summary report for a specific system.

We work with life sciences, pharma and MedTech teams on this kind of package, agreed in writing with the scope, price and handover set before work starts. Your own quality unit stays responsible for approving the documents, and for the GMP decisions.

Frequently asked questions

Sources

1. EudraLex Volume 4: Annex 15, Qualification and Validation (2015)
2. European Commission: EudraLex Volume 4
3. Health Products Regulatory Authority
4. FDA: Process Validation, General Principles and Practices (2011)
5. ICH Q9(R1): Quality Risk Management
6. European Commission: Consultation on Chapter 4, Annex 11 and new Annex 22