01
Manufacturing strategy & operating model
The role this site plays in the network and how it is set up to play it: technology choice, campaign versus dedicated operation, shift and organisational model, and the performance expectations that follow.
Operating-model decisions determine which risks the site carries permanently. A campaign model concentrates changeover and cross-contamination risk; a dedicated one concentrates capacity risk. Neither is wrong, but the control burden differs and must be chosen deliberately.
HOW IT FAILS
- Campaign strategy is set by scheduling convenience, so changeover frequency and cleaning burden are an outcome rather than a decision.
- Capacity is planned to high utilisation, leaving no headroom to absorb an investigation or a maintenance overrun.
- The organisational model assumes staffing levels that recruitment has never actually achieved.
WHAT CONTAINS IT
- Operating-model choices assessed for the contamination-control and changeover burden they create.
- Capacity planning that reserves headroom for deviation, maintenance and requalification.
- Staffing model validated against actual qualified headcount, not the approved establishment.
EVIDENCE IT OPERATES
- Site strategy and campaign rationale with the quality burden stated.
- Capacity models showing utilisation assumptions and reserved headroom.
- Qualified-staffing records against the model the schedule assumes.
02
Production planning & controlled execution
Turning a schedule into made product under control: readiness checks, batch record execution, in-process status, reconciliation, batch review and the handover into release.
The batch record is the primary evidence that the approved process was followed. Where execution and recording drift apart — recorded later, recorded by someone else, recorded from memory — the product may be fine and the evidence is not, and only the evidence is available at release.
HOW IT FAILS
- Entries are made after the step rather than as it happens, so the record documents intent rather than events.
- Reconciliation discrepancies inside an accepted range are closed without investigation, so a systematic loss is never seen.
- Batch review checks that fields are filled rather than whether what they say is coherent.
WHAT CONTAINS IT
- Contemporaneous recording enforced by process design, not only by procedure.
- Reconciliation limits set from process understanding, with any discrepancy assessed rather than accepted.
- Batch review that examines the narrative of the batch, including deviations, alarms and timing.
EVIDENCE IT OPERATES
- Executed batch records with contemporaneous entries and second checks.
- Reconciliation calculations and the assessment of any discrepancy.
- Batch review and disposition records including deviation linkage.
03
Aseptic processing & contamination control
Keeping what should be sterile sterile: the contamination-control strategy as one coherent system, clean behaviours, barrier technology, sterilisation, and the monitoring that shows it is holding.
Sterility cannot be tested into product — the test examines a sample and the risk lives in the units it did not examine. Assurance therefore comes from the control strategy, which is why regulators assess the strategy rather than the sterility result.
HOW IT FAILS
- The contamination-control strategy exists as a document assembled from existing controls rather than as a designed system with identified gaps.
- Interventions are qualified in media fills under ideal conditions and performed differently under production pressure.
- Environmental excursions are investigated individually, so a slow shift in the microbial flora is never recognised.
WHAT CONTAINS IT
- A contamination-control strategy that states residual risk and how each control addresses it, reviewed as a whole.
- Intervention lists derived from observed practice, with media fills covering the difficult ones.
- Trend analysis of environmental and personnel monitoring including organism identification, not only counts.
EVIDENCE IT OPERATES
- Contamination-control strategy with risk assessment and gap analysis.
- Media fill records covering the actual intervention set.
- Environmental monitoring trends with identifications and investigation outcomes.
04
Process control & continued verification
Holding the process where validation said it must be: the control strategy in operation, critical parameter monitoring, in-process controls, ongoing verification, and what happens when control is lost.
Validation establishes a state of control at a point in time; continued verification is the evidence it persists. Without it an organisation is asserting a validated state on the strength of work done years ago.
HOW IT FAILS
- Continued verification collects data and produces a report nobody uses to make a decision.
- Trends inside specification are not evaluated, so drift is only detected when a batch finally fails.
- Loss-of-control response is improvised because no one defined in advance what would constitute it.
WHAT CONTAINS IT
- A continued process verification plan with defined signals, owners and required responses.
- Statistical trend evaluation against process capability rather than against specification alone.
- Pre-defined loss-of-control criteria and the actions that follow, agreed before they are needed.
EVIDENCE IT OPERATES
- Continued process verification protocol, data and periodic evaluation.
- Capability and trend analyses with the actions they triggered.
- Records of loss-of-control events and the response against pre-defined criteria.
05
Cleaning, sanitation & changeover
Removing the previous product and returning equipment to a defined clean state: cleaning strategy, campaign boundaries, line clearance and the cross-contamination controls between products.
Cross-contamination is a patient-harm pathway that leaves no trace in the affected product. The controls are entirely preventive, which means their effectiveness is only ever demonstrated by the evidence that they were performed as validated.
HOW IT FAILS
- Cleaning is validated on a worst-case product that is no longer made, and the rationale was never revisited.
- Line clearance is performed as a checklist by the same people under time pressure to start the next batch.
- Campaign length is extended for efficiency without re-examining the validated hold and cleaning limits.
WHAT CONTAINS IT
- Worst-case selection reviewed whenever the product mix changes, with health-based limits.
- Independent verification of line clearance, with the check separated from the pressure to proceed.
- Campaign boundaries defined by validated limits, with extension requiring assessment rather than approval.
EVIDENCE IT OPERATES
- Cleaning validation with worst-case rationale and health-based residue limits.
- Line clearance records with independent verification.
- Campaign records showing adherence to validated boundaries.
06
Materials, warehousing & production logistics
Controlling material from receipt to consumption: dispensing, staging, status labelling, genealogy, movement, work in progress, temperature-controlled handling and reconciliation at every step.
Genealogy is what makes a recall bounded. When the link from finished unit back to component lot is incomplete, the organisation cannot say what is affected — and the market action expands to whatever it cannot rule out.
HOW IT FAILS
- Status is controlled in the system but not physically, so quarantined material sits where released material is picked from.
- Genealogy breaks at a manual repack or a partial-container return, and the link is reconstructed later from inference.
- Cold-chain excursions during internal movement are unmonitored because monitoring stops at goods receipt.
WHAT CONTAINS IT
- Physical and system status control that agree, with physical segregation for quarantined material.
- Genealogy captured at every transformation including repacks, splits and returns.
- Temperature monitoring across internal movement and staging, not only at receipt and storage.
EVIDENCE IT OPERATES
- Dispensing and material movement records with status at each step.
- Batch genealogy traceable from finished product to component lot.
- Temperature records covering storage and internal transfer.
07
Packaging, labeling & serialization operations
The last operations before the product leaves: pack execution, label control and reconciliation, serialisation and aggregation, tamper evidence, and line clearance between packs.
Labelling and packaging errors are among the most common causes of recall, and they are the failures most likely to reach a patient as the wrong product entirely. They are also almost entirely preventable by control of the line rather than by inspection of the output.
HOW IT FAILS
- Label reconciliation tolerances are wide enough to absorb a missing roll, so a discrepancy is arithmetically invisible.
- Line clearance between packs is performed visually on a line where the previous label can remain in a feed mechanism.
- Serialisation aggregation errors are corrected in the system without investigating how the physical mismatch arose.
WHAT CONTAINS IT
- Reconciliation limits tight enough that a real discrepancy cannot pass, with any variance investigated.
- Physical line clearance including feed paths and reject stations, independently verified.
- Aggregation discrepancies treated as deviations, with physical verification before system correction.
EVIDENCE IT OPERATES
- Packaging records with label reconciliation and clearance verification.
- Serialisation and aggregation records with exception handling.
- Reject and reconciliation investigation records.
08
Reliability, maintenance & utilities
Keeping the equipment and utilities available and behaving as qualified: planned work, failure response, spares, calibration coordination and the scheduling negotiation with production.
Maintenance is where the validated state is preserved or lost in practice. Deferred work on qualified equipment is a quality decision made by a scheduling conversation, usually without quality present.
HOW IT FAILS
- Preventive maintenance is deferred repeatedly on running equipment, and the cumulative deferral is visible to nobody.
- Breakdown repairs replace a component with a functionally similar part that was never assessed against the qualification.
- Utility performance drifts within alarm limits, and the qualification assumption behind those limits is never re-tested.
WHAT CONTAINS IT
- Deferral of maintenance on qualified equipment routed through quality assessment.
- Spare-part equivalence assessed against the qualified configuration before fitting.
- Periodic utility performance review against the assumptions qualification relied on.
EVIDENCE IT OPERATES
- Maintenance completion, deferral and backlog records for qualified equipment.
- Part equivalence assessments and change records for repairs.
- Utility monitoring and periodic requalification records.
09
Operational excellence & performance
Making the operation better without making it less controlled: flow, yield, cycle time, constraint management, waste reduction, standard work and structured problem solving.
Improvement and compliance are usually presented as a trade-off and usually are not one — most waste in regulated manufacturing is rework, investigation and delay caused by poor control. But an improvement programme that treats procedures as waste will remove the wrong things.
HOW IT FAILS
- Improvement targets are set on throughput alone, so gains are taken from the time available for checks and reviews.
- Standard work is written by improvement specialists and diverges from the approved procedure, leaving two instructions.
- Problem solving stops at the local cause because the systemic one belongs to another department.
WHAT CONTAINS IT
- Improvement changes routed through change control, with quality impact assessed before implementation.
- A single instruction set — standard work and approved procedure reconciled, never parallel.
- Problem solving with the authority to escalate a cause that sits outside the improving function.
EVIDENCE IT OPERATES
- Improvement initiatives with change records and quality impact assessment.
- Reconciled procedures and standard work with a single approval route.
- Problem-solving records showing systemic causes escalated and owned.
10
Operational readiness, startup & ramp-up
Bringing a new capability into routine operation: people qualified, procedures usable, materials flowing, systems working, laboratory ready, and the stabilisation period before the process is genuinely routine.
Everything is new at once, and the deviation rate during ramp-up is the highest the process will ever see. Treating that as a temporary nuisance rather than as signal wastes the clearest information about the process the organisation will ever get.
HOW IT FAILS
- Readiness is declared function by function, and nobody assesses whether the functions are ready together.
- Early deviations are attributed to newness and closed without cause, discarding the signal.
- Commercial commitments are made against a ramp curve with no allowance for the stabilisation the process needs.
WHAT CONTAINS IT
- Integrated readiness review across people, procedures, materials, systems, laboratory and supply.
- Ramp-up deviations investigated with the same rigour as routine ones, and trended as a set.
- Supply commitments built on a ramp profile that includes a stabilisation allowance.
EVIDENCE IT OPERATES
- Integrated operational readiness assessment and its closure.
- Ramp-period deviation trending and the process changes it produced.
- Stabilisation criteria and the evidence that routine operation was reached.