Do you know Process Validation?

Yeah, sure, it's IQ, OQ, and PQ! What's really behind these acronyms that everyone believes to know!

Does your customer suddenly want you to do process validation? Or did your notified body ask for process validation documents? Either way, chances are you don’t have what they asked for. No worries, you are not the only one and certainly not the last one. The U.S. FDA issued 18,5% of their 483s in the fiscal year of 2020 against the requirements of 21 CFR 820.75 (Process validation) – this is enough evidence for us to write another blog about the approach to validate processes.

This post talks about:

·??????What process validation is

·??????Why we must validate processes

·??????What processes need to be validated

·??????Different elements of process validation

·??????Validation Master Plan

While the GHTF (Global Harmonization Task Force; IMDRF - International Medical Device Regulators Forum) published?excellent?guidance ?on?that topic, very few seem to know or follow it. But let's start from the beginning …

What is process validation?

The U.S. FDA defines process validation as “establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.”

Why do we have to validate processes?

Process validation is nothing new that was only introduced by the European MDR (Medical Device Regulation). The requirement for process validation has been around for many years, in fact, multiple decades! The ISO 13485 and the U.S. FDA and other regulatory bodies require the organization to validate their processes for production.

·??????ISO 13485:2016, 7.5.6 – Validation of processes for production and service provision

·??????TITLE 21 CFR 820.75 – Process validation

However, the regulatory requirements should not be the only reason why you should be validating your processes. Process validation indicates “that a process has been subject to such scrutiny that the result of a process (a product, a service or other outcome) can be practically guaranteed” [1], as process defects may only become apparent when the product is used. So, it's in your best interest to know your processes; it can save you a lot of headaches later.

Do we need to validate all our processes?

It depends … let’s look at what the requirements say, i.e.,?ISO 13485:2016, 7.5.6 -?Validation of processes for production and service provision.

The organization shall validate any processes for production and service provision where the resulting output cannot be or is not verified by subsequent monitoring or measurement and, as a consequence, deficiencies become apparent only after the product is in use or the service has been delivered?[2].

Well, this should answer our question. An organization must validate processes if they do not fully verify its output.

This may be why some in the industry believe that only those processes need to be validated whose results can only be tested using destructive test methods. While we must validate a process whose results can only be tested destructively, this is not the criteria for when to validate and when not. Imagine you had to test the seal strength (destructive test method) of a sterile barrier system, and you fully verified, then there is very little left to sell. On the other hand, just because you don't need to test a product specification with a destructive method doesn't mean you don't need to validate the process. So, it’s best to forget everything related to destructive methods or not.?

The important aspect is if you decide to fully verify the output of a process. If you do not fully verify the output, you must validate the process, otherwise not. While this is true for most manufacturing processes, there are specific processes that are considered by the US FDA to require validation, such as sterilization, aseptic processing, injection molding, and welding [3]. The GHTF adds cleanroom ambient conditions, sterile packaging sealing processes, lyophilization processes, heat-treating processes, and plating processes to the list of processes that should be validated [1]. Chances are that the output of these processes is not fully verified anyway.?

To answer whether a process needs to be validated, we must first answer whether the process output is fully verified; if this answer is "yes", then validation is not required and vice versa.?

Different elements of process validation

Now we are talking IQ, OQ, PQ! This is what everyone knows when it comes to process validation. The three major phases of process validation are installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ).

Installation qualification (IQ) is performed for equipment and machines to ensure reliable equipment operation [3]. While the operational qualification (OQ) shall ensure that all predetermined product requirements are met at process limits, the performance qualification (PQ) shall ensure that all predetermined product requirements are met consistently. This indicates that multiple processes can run on the same equipment. Thus, one must distinguish between “machine” and “process”. We often find that the industry uses the terms machine and process interchangeably, which is incorrect and makes process validation challenging to understand. The following figure shows where the actual manufacturing process begins.

Each of the three elements (IQ, OQ, PQ) is worth a blog post each. To get detailed information about each phase, visit our blogs for installation qualification (IQ), operational qualification (OQ), or performance qualification (PQ).

Validation Master Plan

Another term that is often thrown around. A validation master plan (VMP; sometimes called a master validation plan) is a tool for planning and monitoring all validation activities. No regulation requires a validation master plan, but it is recommended by the GHTF [4].

A VMP often includes listings of equipment and processes to be qualified and validated, regardless of whether the process is performed in-house or outsourced. Furthermore, VMPs also serve to demonstrate management's commitment to validation activities and thus support the planning and allocation of human and financial resources, which are indeed required by regulations [3].

The fact that we have only briefly touched on the acronyms shows that there is more to process validation than IQ, OQ, and PQ.

Are you concerned about the increased requirements due to MDR (Medical Device Regulation; 2017/745) and already behind schedule? Contact us today, and we'll take the burden off your shoulders and help you make your supply chain compliant.

https://www.sifo-medical.com

References

[1]???????https://www.imdrf.org/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n99-10-2004-qms-process-guidance-04010.pdf

[2]???????ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes

[3]???????https://www.fda.gov/medical-devices/quality-system-qs-regulationmedical-device-good-manufacturing-practices/medical-devices-current-good-manufacturing-practice-cgmp-final-rule-quality-system-regulation

[3]???????https://www.quality-on-site.com/get.php?fileid=139

[4]???????https://www.fda.gov/media/94074/download