Validation & Qualification
Validation and qualification is the organisation's ability to establish, with evidence, that the things it relies on actually work: that equipment and utilities perform as specified, that computerised systems do what they claim and nothing else, and that processes deliver quality product consistently. The modern frame is a lifecycle, not an event. FDA's 2011 process validation guidance defines three stages — process design, process qualification, and continued process verification — and EU GMP Annex 15 carries the same lifecycle logic across qualification and validation activities. ASTM E2500 reframes equipment work as risk-based verification of what matters to product quality, and GAMP 5 applies the same proportionality to computerised systems.
What this page does not claim
A capability is something an organization must be able to do; it is not a maturity score and not an assessment domain. The scored domains measure how consistently capabilities are performed, they do not map one-to-one, and nothing on this page rates your organization.
What this capability is
Validation and qualification is the organisation's ability to establish, with evidence, that the things it relies on actually work: that equipment and utilities perform as specified, that computerised systems do what they claim and nothing else, and that processes deliver quality product consistently. The modern frame is a lifecycle, not an event. FDA's 2011 process validation guidance defines three stages — process design, process qualification, and continued process verification — and EU GMP Annex 15 carries the same lifecycle logic across qualification and validation activities. ASTM E2500 reframes equipment work as risk-based verification of what matters to product quality, and GAMP 5 applies the same proportionality to computerised systems.
The capability's discriminating skill is proportionality: directing deep effort at what affects the patient and refusing to spend it on what does not. That requires genuine risk assessment up front — ICH Q9(R1) thinking applied to verification scope — and resisting the two classic corruptions: testing everything identically because the template says so, and testing nothing deeply because the schedule is tight. It also means knowing when the validated state has moved. Qualification evidence ages as equipment drifts and changes accumulate, and a mature capability ties revalidation scope to change control and monitoring data rather than to the calendar alone.
WHY IT MATTERS
- Validation is the evidentiary foundation for every batch released without exhaustively testing it. Release decisions assume the process does what was proven; if the proof is stale or shallow, the assumption is faith.
- The lifecycle approach exists because the old three-batches-and-done model failed: processes proven once drifted unwatched. Continued process verification is the guidance's answer, and organisations that validated once and filed the report are running on evidence that expires silently.
- Risk-based verification is the difference between a validation programme and a documentation programme. ASTM E2500 and GAMP 5 both exist to concentrate effort on what affects quality — and a GAMP category, being a property of an implementation rather than of a product, must be assessed per deployment, never copied from a brochure.
- Unvalidated calculation tools and spreadsheets feeding GMP decisions are a rising inspection theme; every result a decision relies on needs a home in a qualified system.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 27 LINKSValidation and qualification supplies the framework's proof: documented, risk-proportionate evidence that facilities, systems, and processes do what they claim — established across the lifecycle and kept current as they change and drift.
06 · QUALITY MATURITY — VALIDATION & QUALIFICATION, REACTIVE TO ADAPTIVE
Validation is a documentation event: protocols executed to pass, discrepancies during qualification negotiated away, reports filed and never reopened. The validated state and the operating state diverge from day one, and no one measures by how much.
A validation master plan defines scope, approach, and responsibilities, and protocols with acceptance criteria are independently reviewed. Effort is uniform rather than risk-based — everything receives the same depth — and revalidation is triggered by the calendar, not by what actually changed.
Verification scope is set by documented risk assessment: critical aspects get depth, the trivial gets commissioning. Change control and validation are one conversation — every change is assessed for impact on validated status — and continued verification runs on key processes with defined review.
The validated state is managed as a living claim: monitoring data continuously confirms or challenges it, drift triggers scoped requalification before failure, and validation knowledge — what was proven, under what assumptions — is retrievable and reused rather than rediscovered per project.
Validation is integrated with design: quality is built in and verification confirms rather than discovers, new technology is adopted with proportionate confidence instead of maximal paperwork, and the organisation can state, for any process on any day, exactly what its current evidence supports.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 5
Derived from the 5 standards SPEQ maps to this subject, across 5 regulatory bodies: FDA, EMA, ICH, ISPE, ASTM.
RECORDS & OBJECTIVE EVIDENCE
- A validation master plan defining scope, approach, and responsibilities
- Risk assessments setting verification depth per system and process aspect
- Executed qualification protocols with investigated discrepancies
- Process qualification reports meeting predefined acceptance criteria
- Continued-process-verification data with defined periodic review
COMMON INSPECTION FINDINGS
- Equipment, systems, or processes in GxP use without validation evidence
- Qualification discrepancies explained away rather than investigated
- Changes made with no assessment of impact on validated status
- No continued verification — the newest evidence is years old
- Spreadsheets feeding batch decisions with no validation behind them
HOW YOU’D SEE WHERE YOU SIT
- Pick a validated process and ask what continued-verification evidence exists from the last twelve months — trended data with review, or a report from years ago standing in for the present.
- How verification depth was set on a recent project: a documented risk assessment that produced different depths for different aspects, or one template applied to everything.
- Trace a recent equipment change into the validation record: whether impact on validated status was assessed and the requalification scoped to what the change touched.
- The fate of discrepancies during qualification runs: investigated with the same rigour as production deviations, or explained away to protect the schedule.
- Ask where the spreadsheets that feed batch decisions live, and what evidence stands behind them.
Observable behaviours, not a self-rating — what a capability looks like from the outside, the same way SPEQ’s Quality Culture assessment reads behaviour rather than felt safety.
FREQUENTLY ASKED
What is the difference between qualification and validation?
Qualification is proof about things: that a piece of equipment, a utility, or a system is installed as designed and operates as intended — the DQ/IQ/OQ/PQ sequence of EU GMP Annex 15. Validation is proof about outcomes: that a process, method, or procedure consistently produces a result meeting its predetermined requirements. The two nest: qualified equipment is a precondition of a validated process, because a process proven on uncharacterised equipment has proven nothing durable. In practice the boundary blurs — performance qualification and process validation shade into each other — but the direction of proof is the useful distinction: things versus outcomes.
What changed with the lifecycle approach to process validation?
The unit of proof moved from an event to a lifetime. The traditional model validated a process with a fixed campaign of demonstration batches, declared it validated, and stopped looking. FDA's 2011 guidance replaced that with three stages: design the process on scientific understanding, qualify that it can perform reliably at commercial scale, and then verify continuously that it remains in control — with EU GMP Annex 15 carrying the same logic. The practical consequence is that validation never finishes: ongoing monitoring data is now part of the validated state's evidence, and a process without current stage-three data is a claim without a current proof.
How is this capability measured in the maturity assessment?
Through the Validation & Qualification domain, which scores how consistently the organisation establishes and maintains its evidence — whether verification effort follows risk, whether changes are assessed for validation impact, and whether the validated state is monitored rather than assumed. The capability page and the domain do different work: this page defines the function and its reactive-to-adaptive ladder, from validation-as-paperwork to validation integrated with design; the assessment domain locates your organisation on that ladder through scored questions. Read the ladder to understand the destination, then take the assessment to find the gap.
MEASURED THROUGH THE MATURITY ASSESSMENT
This capability is about what you must be able to do. How consistently you do it is what the maturity assessment scores — through the domain below.
Contributes to the FDA QMM practice area Technical Excellence (a SPEQ mapping).
Score your quality system →