Validation
Validation is the family of exercises that turn "we believe this works" into documented, repeatable evidence. Process performance qualification — Stage 2 of FDA's lifecycle guidance, mirrored by EU GMP Annex 15 — demonstrates that the commercial process, run at scale with qualified equipment and trained personnel, reproducibly delivers quality; the number of runs is justified by risk and prior knowledge rather than recited as three. Around it cluster the specialised validations: cleaning validation demonstrating carryover below health-based limits; sterilisation validation under ISO 17665 for moist heat and ISO 11135 for ethylene oxide, where lethality is delivered by the cycle and cannot be tested into the product; and aseptic process simulation — media fills, in the tradition PDA Technical Report 22 codifies — standing in for sterility assurance where no terminal step exists.
What this page does not claim
Phases are an organising device, not a regulatory mandate — real programmes overlap them, and a medical device, a food product and a small-molecule drug traverse them differently. Each page says where the differences bite.
What happens in this phase
Validation is the family of exercises that turn "we believe this works" into documented, repeatable evidence. Process performance qualification — Stage 2 of FDA's lifecycle guidance, mirrored by EU GMP Annex 15 — demonstrates that the commercial process, run at scale with qualified equipment and trained personnel, reproducibly delivers quality; the number of runs is justified by risk and prior knowledge rather than recited as three. Around it cluster the specialised validations: cleaning validation demonstrating carryover below health-based limits; sterilisation validation under ISO 17665 for moist heat and ISO 11135 for ethylene oxide, where lethality is delivered by the cycle and cannot be tested into the product; and aseptic process simulation — media fills, in the tradition PDA Technical Report 22 codifies — standing in for sterility assurance where no terminal step exists.
Computerised systems run their own validation stream under GAMP 5, 21 CFR Part 11, and EU GMP Annex 11: risk-based lifecycle activities scaled to system category and impact, supplier leverage where justified, and the specific controls — audit trails, access, electronic signatures — verified directly. For software used in medical-device production and quality systems, FDA's Computer Software Assurance guidance formalises a lighter-touch, risk-driven testing posture; its stated scope is exactly that — device production and quality-system software — though its philosophy of assurance effort proportionate to risk echoes what GAMP 5 already teaches across all industries. Analytical method validation, largely completed in the laboratory stream, feeds every other validation: no protocol's acceptance criteria mean anything unless the measuring stick was validated first.
The phase's deliverable is the validated state: a defined, documented condition in which processes, systems, and methods operate — and the obligation to maintain it, which the continued process verification of Stage 3 and periodic review will carry through the commercial phase. Quality owns the honesty of the exercise: protocols approved before execution, acceptance criteria set before results exist, deviations during validation investigated rather than absorbed, and reports that state what was demonstrated rather than what was hoped. Validation performed as ceremony — protocols written to pass, discrepancies rationalised after the fact — is worse than absent, because it manufactures false confidence and a paper trail that proves the firm knew better.
- Qualified facilities, utilities, and equipment, formally released from commissioning and qualification.
- An approved validation master plan and protocols with pre-set acceptance criteria traced to the control strategy.
- Validated analytical methods for every attribute the protocols will measure.
- Trained personnel and approved master production records for the process as it will actually run.
- Process performance qualification complete, with the justified number of runs meeting acceptance criteria and deviations resolved.
- Cleaning, sterilisation, and aseptic-process validations complete for the operations that require them.
- Computerised systems validated and released, with Part 11 / Annex 11 controls verified in the operating configuration.
- Approved validation reports establishing the validated state and defining what continued process verification will monitor.
- Readiness for commercial disposition: the quality system prepared to release product on the validated basis.
SPEQ synthesis. Phase boundaries and gate criteria are an organising device for planning and review, not a regulatory mandate. Real programmes overlap phases and re-enter them; treat these as the questions worth answering, not a compliance checklist.
- Approve protocols and acceptance criteria before execution, and refuse retrospective criteria without exception.
- Adjudicate deviations during validation — investigated and dispositioned, never absorbed into a passing narrative.
- Approve validation reports and the formal declaration of the validated state.
- Own the linkage into continued process verification: what will be trended, at what frequency, against what limits.
- Hold the change-control boundary: from validation onward, the process, systems, and methods change only under assessment.
- The validation master plan and its status record
- Process performance qualification protocols and reports
- Cleaning validation protocols and reports with health-based exposure limits
- Sterilisation and aseptic-process-simulation validation packages
- Computerised system validation packages with Part 11 / Annex 11 verification evidence
- The continued-process-verification plan handed into commercial manufacture
- Acceptance criteria adjusted after results exist — the single most corrosive validation behaviour, and one an audit trail makes visible.
- PPQ batches run under special conditions — best operators, hand-picked materials, engineering supervision — validating a process that will never run that way again.
- Cleaning validation resting on outdated limits rather than health-based exposure limits, or sampling the easy surfaces rather than the worst case.
- Media fills designed to pass: interventions under-represented, durations truncated, so the simulation stops simulating.
- Computerised-system validation as documentation theatre — thick binders, while the audit trail, access model, and data flows go unverified in the operating configuration.
Derived from the 8 standards SPEQ maps to this phase, across 5 regulatory bodies: FDA, EMA, ISPE, PDA, ISO.
FREQUENTLY ASKED
Is three batches still the rule for process validation?
No — and it never was a rule so much as a habit. FDA's 2011 lifecycle guidance replaced the fixed-number mindset with a justified one: the number of process performance qualification runs should rest on the process's complexity, the depth of Stage 1 understanding, and prior knowledge, with the rationale documented. EU GMP Annex 15 takes the same position. Three remains a common outcome because it is often defensible, but "we ran three because everyone runs three" is not a justification, and for well-understood or continuously monitored processes both more and fewer have been appropriate.
Why can't sterility just be tested at the end?
Because the test cannot carry the claim. A sterility test samples a tiny fraction of a batch, and at the assurance levels sterilisation must deliver, contamination rates far above the acceptable limit would still pass sampling most of the time. So the logic inverts: for terminal sterilisation under ISO 17665 or ISO 11135, validated cycles demonstrate delivered lethality, and routine control confirms the cycle ran as validated. For aseptic processing, where no terminal kill exists, media fills simulate the process — including its worst-case interventions — to demonstrate that the operation itself does not introduce contamination.
Where does FDA's Computer Software Assurance guidance actually apply?
To computers and automated data-processing systems used in medical-device production or as part of the device quality system — that is its stated scope. Within it, CSA formalises assurance effort proportionate to risk: critical thinking about intended use, then the least burdensome testing that establishes confidence, with unscripted approaches acceptable where risk is low. Its philosophy resonates far beyond devices, and GAMP 5's second edition teaches the same risk-based posture for all GxP systems — but citing CSA as the governing standard for a clinical database or a pharmacovigilance system misstates its remit.