Any process whose output cannot be fully verified by subsequent measurement requires validation (ISO 13485 clause 7.5.6). Welding, bonding, moulding, package sealing and sterilisation are typical examples. Validation is carried out through installation (IQ), operational (OQ) and performance (PQ) qualification.
Which processes are validated?
The rule is simple: a process whose output cannot be fully verified by a later inspection or test is validated. In practice the most common are welding and bonding, injection moulding, cleaning, package sealing, sterilisation and — where they affect the quality system — software applications.
Validation runs in three stages. Installation qualification (IQ) shows that the equipment is installed correctly. Operational qualification (OQ) shows that the output meets the acceptance criteria even when process parameters sit at their limits. Performance qualification (PQ) shows that the result is reproducible under production conditions.
Sterilisation and packaging
Each sterilisation method has its standard: ISO 11135 for ethylene oxide, ISO 11137 for radiation and ISO 17665 for moist heat. Ethylene oxide residuals are evaluated to ISO 10993-7. Bioburden monitoring and sterility testing form the basis of dose setting and periodic dose audit work.
The sterile barrier system is validated to ISO 11607: packaging material, the sealing process and transport conditions are handled together. Shelf life is demonstrated through accelerated and real-time ageing studies; accelerated data may be enough to go to market, but the real-time study continues.
Cleanrooms and environmental monitoring
In sterile or low-bioburden manufacturing the environment is part of the process. Cleanroom classification is carried out to ISO 14644; classification is not a one-off and is requalified periodically. The environmental monitoring programme defines acceptance limits and sampling frequency for particles, microbiological load, pressure differentials, temperature and humidity. Gowning and entry discipline are part of that programme too.
What it covers
- Validation master plan and risk-based prioritisation of processes
- IQ/OQ/PQ protocols and reports
- Sterilisation validation and periodic revalidation
- Planning bioburden and sterility testing
- Cleanroom classification and environmental monitoring (ISO 14644)
When is revalidation required?
Validation proves the state of a process on a given day. When something changes, the evidence is renewed. Typical triggers: equipment change or major maintenance, a change of raw material or supplier, changed process parameters, relocation of the manufacturing site, a change in product design, and adverse trends in monitoring data.
Not every change calls for a full IQ/OQ/PQ. The scope is set by risk assessment: which critical process parameter does the change touch, and is the existing evidence still valid? The decision and its justification are recorded — in an audit it is the decision, more than the work, that is questioned.
Sterilisation also runs on periodic confirmation; dose audits for radiation, and work with process challenge devices and biological indicators for ethylene oxide, are repeated at defined intervals. When load configuration, packaging or product density changes, the validation changes too. For supplier-driven changes the notification lead time is critical; writing it into the quality agreement is part of validation.
Validating quality system software
ISO 13485 requires computer software used in the quality management system to be validated for its intended use (clause 4.1.6), and the same requirement applies to software used in production and service provision (clause 7.5.6). That covers document management, complaint handling, ERP, measurement and test software, and electronic record systems.
Again, depth follows risk: does a software fault affect product safety or the integrity of a record? The typical output is a description of the intended use, a requirements list, test scenarios and their results, user permissions, backup arrangements and a plan for what happens at version upgrades.
Software validation is not a one-off either: when a version upgrade, a new module or a configuration change arrives, the affected scenarios are run again. With cloud services that the provider updates on its own schedule, this means writing a notification obligation into the contract.
Why a validation master plan?
Before writing individual protocols you have to decide which processes will be validated and in what order. That is what a validation master plan does: scope, responsibilities, the justification for treating a process as critical, the method to be used, how acceptance criteria are set and what triggers revalidation, all in one document.
The part that really earns its keep is prioritisation. In a plant with limited resources, trying to validate every process to the same depth delays the critical one. Priority follows the effect of the process on product safety and whether its output can be verified afterwards.
The plan is updated when the site moves or a new product family is added. It is also one of the first documents requested in an audit; individual protocols and reports are read through it.
Common problems
The most common problem is validation done once and then forgotten. When equipment, raw material, supplier or a process parameter changes, the need for revalidation has to be assessed and recorded. In sterilisation, changes to load configuration and packaging are the most frequently overlooked.
