QA/RA Consulting, Auditing & Training


Let's get started

Overview of Medical Device Process Validation: IQ, OQ, and PQ

Business people working together

In this article:

How the US FDA defines process validation
Difference between verification and validation
Relationship between design validation and process validation
Which production processes require validation?
Basic steps in process validation
Process validation plans and protocols for IQ, OQ, and PQ
Forming your process validation team
It all starts with a process validation plan
Example of a validation master plan (VMP) checklist
Writing process validation protocols
Content of validation protocols
Format of a basic process validation protocol
Understanding IQ, OQ, and PQ for manufacturing processes
What is installation qualification (IQ)?
What is operational qualification (OQ)?
What is performance qualification (PQ)?
When to revalidate a process
Does your medical device process require revalidation?
Software used in medical device production

Before introducing a new medical device onto the market, manufacturers should have a high degree of certainty that their manufacturing processes have the proper controls in place to produce products that are safe and meet specified user, technical, and regulatory requirements. The US FDA and ISO 13485 require device makers to verify that their products meet documented design specifications, and this may be accomplished through post-production inspection or testing. This is otherwise known as “verifying” product quality and, if you choose this route, you’ll need to test every single device you produce.

But what if testing every product is impractical, would never reveal all variations, or the testing itself destroys the product?

That’s where process validation comes into play. Process validation fulfills an important quality assurance need by subjecting a process to such intense scrutiny that the output of the process is extremely likely to consistently meet established production quality specifications. The key word here is process, because it does not mean validating the device itself.

How the US FDA Defines Process Validation

The US FDA Quality System Regulation defines process validation as follows: “Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.” In section 820.75, FDA goes on to say:

(a) Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures. The validation activities and results, including the date and signature of the individual(s) approving the validation and where appropriate the major equipment validated, shall be documented.

Similarly, ISO 13485:2016 says, “The organization shall validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement.”

Neither FDA nor ISO 13485 provide much instruction on medical device process validation and instead defer to the GHTF SG3/N99-10 guidance published by the GHTF (now the IMDRF) that was released in 2004.

It is important to note that process validation links to other sections of the QMS, including design controls, purchasing controls, personnel, and production/process controls.


Difference between verification and validation


Relationship Between Design Validation and Process Validation

Design validation focuses on the device itself and involves creating evidence that it meets user needs and intended uses. Process validation, as the name implies, focuses on the production of the device. Process validation demonstrates that, when a process is operated within specified limits, it will consistently produce product complying with established specifications and requirements.  Most companies follow FDA requirements for design control 820.30 and ISO 13485 standard clause 7.3, and then perform validation during the final stage(s) of the product and process development sequence. However, planning begins with the initial design control process implemented by R&D. This helps to identify device quality characteristics and process variables.


Product Validation Process

Note: Design and development planning is usually a project management type of activity, and design validation in many companies is a cevaluation activity.

Which Medical Device Production Processes Require Validation?

Validation should be performed on any new processes that are being implemented, existing processes that need to be qualified on a regular basis, and existing processes that have been modified, expanded (volume or scope), experienced a downward trend in performance, or seen an increase in customer complaints. According to guidance published by the GHTF (as noted above, now the IMDRF), the following are common examples of processes that should be validated:

  • Sterilization and sterile packaging sealing
  • Clean room ambient conditions
  • Heat treating, plating, welding, soldering, painting, etc.
  • Plastic injection molding

In addition, process validation is needed if the following conditions exist:

  • Routine end-product tests have insufficient sensitivity to verify the desired safety and efficacy of the finished devices
  • Clinical or destructive testing would be required to show that the manufacturing process has produced the desired result or product
  • Routine end-product tests do not reveal all variations in safety and efficacy that may occur in the finished devices
  • The process capability is unknown, or it is suspected that the process is barely capable of meeting the device specifications

By contrast, there are some processes for which product verification is adequate, such as manual cutting processes, visual inspection of printed circuit boards, and testing of wiring harnesses. In these cases, the output of a process can be verified with high reliability and accuracy. But even with these processes, we need to understand the sources of variation and control them.

Basic Steps in Medical Device Process Validation

The basic principles of process validation must:

  • Establish equipment capability to operate within parameters
  • Demonstrate that equipment and instrumentation are capable of operating within the parameters
  • Perform replicate cycles or runs, representing the required operational range of the equipment
  • Monitor the validated process during routine operation
  • Requalify and recertify the equipment as needed

To ensure that a manufacturing process will consistently meet certain parameters, you must follow a systematic series of steps, such as those shown below. Some of these steps may be combined, but we have broken them out separately for clarity.


Basic Steps in Medical Device Process Validation

Forming Your Process Validation Team

Process validation isn’t something to do alone in a cubicle. You’ll want to get input from experts who know the product and process inside and out. Typically, your cross-functional team will include members from quality assurance, engineering, risk management, clinical evaluation, postmarket surveillance, and manufacturing. Team members should be qualified/competent in:

  • Quality management systems, risk management (risk-based thinking), and process thinking
  • Metrology and measurement systems
  • Quality tools and analysis


Putting Together Medical Device Process Validation Plans and Protocols for IQ, OQ, and PQ

There are many ways to conduct process validation, but given the huge variation in production volumes and manufacturing complexity, you won’t find many suggestions on how to go about it in FDA regulations or ISO 13485. That being said, this guidance document from 2004 is still the go-to source for medical device process validation. Even the FDA website will refer you to this guidance document.

It All Starts With a Process Validation Plan

Once you have formed your validation team, now what? The next step is to create a detailed process validation plan (PVP). The PVP is not an FDA requirement, but it is recommended in GHTF guidance and is always one of the first documents a regulator asks to see. It’s extremely important. Among other things, the process validation plan identifies:

  • Elements to be validated
  • Approach to be taken for validation of each element
  • Organizational responsibilities
  • Documentation to be produced

Your PVP should contain the following elements:

  • Define device and the validation approach
  • Identify what needs to be validated
  • Site activities
  • Scope of documentation
  • Schedule of activities
  • Overall master schedule
  • Listings and references to validations performed internally and externally

Plans can be created for a variety of reasons. Individual validation plans can be used to support the planning of more complex projects, such as new manufacturing lines or transferring production to another vendor.

Master Validation Plan

Your master validation plan will tie together all elements of your facility, from utilities to measuring tools. Within that master validation plan, you’ll identify equipment and processes that will require more detailed protocols. The master validation plan also provides information that is useful for managing schedules, risk, resources, cost estimation, and ongoing activities. Perhaps more important, creating a plan forces you to think about the interrelationships among processes, tools, equipment, and so on.

Example of a Validation Master Plan (VMP) Checklist

VMP - Validation Master Plan Checklist

Writing Process Validation Protocols

Your process validation plan provides a general framework for where you want to be, but your protocols are the actual maps on how to get there. Protocols are critical because they help determine if rules or procedures are done correctly and prevent crucial steps from being overlooked. They specify instructions or guidelines on how you plan to carry out a comprehensive study to investigate consistent operation of a new system or new equipment or procedure. Typically, protocols include significant background information. They explain the rationale for an objective of the study, give a full description of the procedures to be followed, set out parameters to be measured, describe how results will be analyzed, and provide predetermined acceptance criteria for reaching conclusions. Protocols determine:

  • What to verify/measure
  • How to do it and how many to do
  • When to do it

You need to determine the best documentation strategy for your project. A complex piece of equipment like a filling line or a CMC will likely need a process validation plan that identifies the need for separate IQ, OQ, and PQ protocols. A simpler process/equipment such as a pH meter or balance may have a strategy that combines IQ, OQ, and PQ into a single plan/report.

It is important to reiterate that in order to write an effective protocol you need to fully understand the exact product requirements. That’s because your protocols will also establish your criteria for acceptance or rejection and outline the specific documentation you need. Remember, both the US FDA and ISO 13485 require you to document the results of your process validation activities, and this includes writing a clear, simple conclusion!


Content of Validation Protocols

There are three types of validation protocols (IQ, OQ, PQ) and we will talk more about those later. But first let’s discuss the contents of a protocol. The details of what should be included in your process validation protocol can be found in Here’s what the guidance suggests:

  • Identify the process(es) to be validated
  • Identify the device(s) to be manufactured using this process
  • Set objective and measurable criteria for a successful validation
  • Specify length and duration of the validation
  • Determine shifts, operators, and equipment to be used in the process
  • Identify utilities for the process equipment and quality of the utilities
  • Identify  operator qualification
  • Provide a complete description of the process
  • Stipulate relevant specifications that relate to the product, components, manufacturing materials, etc.
  • Note any special controls or conditions to be placed on preceding processes during the validation
  • Specify process parameters to be monitored, and methods for controlling and monitoring, such as:
  • Product characteristics to be monitored and method for monitoring
  • Any subjective criteria used to evaluate the product
  • Definition of what constitutes nonconformance for both measurable and subjective criteria
  • Statistical methods for data collection and analysis
  • Consideration of maintenance and repairs of manufacturing equipment
  • Criteria for revalidation

Format of a Basic Medical Device Process Validation Protocol

A well-written protocol will outline the correct rules, policies, and procedures to be followed during process validation. As seen below, it includes facilities, equipment, methods, and training. It also identifies process inputs and limits and shows all the necessary steps for successful completion of the process validation project. This outline below is by no means a complete list of everything that should go into your protocol, but it gives you a sense of the detail required. We strongly suggest that you study the GTHF process validation guidance or consider this training class for a deep dive into the subject. Shown below is the basic framework for a protocol:

  • Title page
  • Table of contents
  • Signature page
  • General
  • Purpose/scope of protocol
  • Why you are doing the protocol and general background
  • Scope of the protocol, including goals
  • Reference documentation
  • External considerations
  • System description
  • Responsibilities
  • Major players on validation and any external experts
  • Responsibility matrix for various departments
  • Execution procedures documentation
  • How protocols will be executed
  • Needed SOP training for personnel
  • Recordkeeping
  • Test equipment
  • List of equipment to be used plus certificates of calibration
  • Specific procedures to be used
  • How parameters will be set, monitored, and controlled
  • Instructions for conducting visual inspections
  • Visual inspection
  • Equipment components
  • Instrumentation
  • Full list of instruments with SOPs
  • Utility verification
  • Full list of all critical and noncritical utilities applicable to the process
  • Summary report
  • Approval page


Understanding IQ, OQ, and PQ for Medical Device Manufacturing Processes

The goal of process validation is to produce a stable medical device manufacturing process that offers consistent performance. Variation is minimal and predictable. Your process validation plan (PVP) will provide the framework for executing three important phases in the validation process:

  • Installation qualification (IQ):Is everything installed correctly?
  • Operational qualification (OQ):Is everything operating correctly? Are operating limits understood?
  • Performance qualification (PQ): Did it produce the correct result? Is the process stable and capable?

What Is Installation Qualification (IQ)?

IQ can be executed by the facilities, engineering, production, or operations groups. The basic idea is to ensure that everything is installed properly. During this qualification phase, the installation of equipment, piping, services, and instrumentation will be checked against engineering drawings, piping and instrument diagrams (P&ID), and functional specifications developed during the project planning stage. During the project planning stage, all system elements, service conduits, and gauges are identified, and a documented record is prepared showing that all installed equipment satisfies your requirements. At various stages during IQ, you will need to review, check, report, and authorize protocols, documentation, procedures, equipment, specifications, and acceptance criteria for test results.


IQ-OQ-PQ Flow Chart

IQ touches on many tangible and intangible aspects related to installation, including:

  1. Components and equipment
  2. Software and standard operating procedures (SOP)
  3. Calibration and testing
  4. Installation
  5. Software and systems testing
  6. Records
  7. Electrical
  8. Signals and alarms
  9. Revalidation, facility conditions, and documentation

There should be an SOP, checklist, or some other documented process that defines the standard installation procedure for each type of system or deliverable being installed. This is required for any equipment used in the manufacturing process. IQ verifies and documents that key aspects of an installation meet approved requirements. These requirements may come from:

  • Design specifications
  • System specifications
  • Manufacturer’s recommendations
  • Developer’s recommendations
  • Data sheets

US FDA Requirements for IQ

The US FDA outlines the key areas of IQ in 21 CFR 820.70(g):

  1. Maintenance schedule: Each manufacturer shall establish and maintain schedules for the adjustment, cleaning, and other maintenance of equipment to ensure that manufacturing specifications are met. Maintenance activities, including the date and individual(s) performing the maintenance activities, shall be documented.
  2. Inspection: Each manufacturer shall conduct periodic inspections in accordance with established procedures to ensure adherence to applicable equipment maintenance schedules. The inspections, including the date and individual(s) conducting the inspections, shall be documented.
  3. Adjustment: Each manufacturer shall ensure that any inherent limitations or allowable tolerances are visibly posted on or near equipment requiring periodic adjustments or are readily available to personnel performing these adjustments.
  4. Automated processes: Each manufacturer shall validate computers or data processing systems that are used as part of production processes.

Consequences of Improper Medical Device IQ

Aside from being a regulatory imperative, installation qualification offers some tangible benefits to the company. For instance, IQ can reduce the risk that workers did not install equipment according to the procedure. It can also reduce the chance that a potentially serious blunder will be overlooked. Examples include having no backup for components damaged or destroyed during installation, purchasing/coding software that won’t work with installed equipment, or installing equipment with voltage or amperage requirements outside the range of your existing electrical supply.

In addition to IQ, you may perform design qualification. DQ proves that the design or selection of the equipment meets your requirements. It documents that that equipment considerations were included in design controls and the equipment requirements were identified prior to purchasing. Think of DQ as the bridge from design to manufacturing. This is an important element in planning for product realization and resources required by ISO 13485:2016 (7.1 and 6.3).

What Is Operational Qualification (OQ)?

After you have performed IQ and checked all aspects of installation, the next step is to perform operational qualification (OQ). This is where you challenge your parameters to make sure your process will result in a product that meets requirements. OQ is associated with equipment performance to ensure that the functions of machines, measuring devices, utilities, and manufacturing areas perform as intended throughout all anticipated operating ranges in the selected environment. This is typically accomplished by identifying important process variables and providing evidence that even if you produce devices at limits of those parameters they will still meet specs. The OQ process does the following:

  • Identifies the critical operating parameters
  • Lists the experiments to be conducted on the critical variables
  • Describes the sequence of the experiments
  • Lists the necessary measuring equipment
  • Ensures that the acceptance criteria for the product can be met

It also includes the procedures required to verify specific dynamic attributes of the new or modified process throughout its operating range, which may include worst-case conditions.

Generally, you will start the OQ process according to plan and let it reach standard operating conditions. You will then monitor the operating parameters to ensure that the process start-up occurs as expected. Once the process is stable, you can send product through and test the final product. You can then adjust the operating conditions to test the limits of the key inputs.

While the OQ is being conducted, you’ll want to perform several other checks to ensure they are operating with specified ranges. These include process controls, voltage and amperage levels, computer and software systems, environmental conditions (e.g., temperature, humidity, air quality, etc.), safety, alarms and interlocks, automation features, activity triggers, and timing. This is also an opportunity to check correct use of procedures by operating personnel.

Lack of proper operational qualification can result in many problems. These might include a process that does not start up correctly or, once stabilized, produces a product that does not meet your specifications. Items that have passed the IQ can falter in operation.

The completion of a satisfactory OQ should permit a formal release of the performance qualification (PQ) process. That release should take the form of a written authorization from your validation team and management.

What Is Performance Qualification (PQ)?

With OQ successfully completed, you can move on to conduct PQ – the final stage in the validation process. By now all the bugs should have been worked out during IQ and OQ so that the PQ should (hopefully) proceed smoothly. During this phase you will generate evidence that your process will consistently produce an acceptable product under normal operating conditions over the long term. PQ is performed on the manufacturing process as a whole. Components of the system or process are typically not tested individually.

Performance qualification should also include testing the system against its operational capacity but not exceeding it. It is important at this stage to ensure that all operational test data conforms with predetermined acceptance criteria from the previous qualifications.

Elements of a PQ Protocol

The absence of process qualification can cause many problems, including a process that will not stabilize, or a process that is stable but produces products that meet specifications only intermittently. Thus, a robust process qualification protocol is important. Here are some elements that should be included in your PQ protocol:

  • Description of the process in the regular work environment
  • Duration of the PQ (dependent on the nature of the process)
  • Standard operating parameters and limits
  • Acceptance criteria for qualification
  • Performance measurement indicators and expected results
  • Test procedures for each item of measuring equipment
  • Test data to be gathered and the timeframe and schedule for gathering data
  • Instructions on handling abnormal data and resolution procedure for unexpected results
  • Documented justification for using whatever data is to be used
  • Requirements for setting up data acquisition, whether it is manual or automated
  • Instructions on how test results are to be reported, whether manually or electronically
  • List of statistical tools that can be used to analyze the data

Contents of the PQ Report

Upon successful completion of the PQ, the process validation project will be complete and the new or modified process can be placed into routine production. Your performance qualification report should include statements on whether or not the PQ protocol was followed in its entirety and reasons for any deviations. You will also want to reference all data gathered during the PQ, prepare a summary of conclusions drawn, state whether the expected results were achieved, and specify any follow-up activities you plan to correct deviations.

The following checklist for the PQ portion of process validation combines both the FDA QSR and GHTF guidance:

  • Have the product characteristics been defined?
  • Have the process parameters been set?
  • Has the SOP been established and maintained?
  • Does the SOP define the nominal values for the process parameters?
  • Have the operators been trained?
  • Has the method for monitoring been established?
  • Is there a mechanism in place to evaluate proposed process changes to see if the process requires revalidation?
  • Is there a mechanism in place to evaluate process deviations to see if the process requires revalidation?

The completion of a satisfactory PQ should permit a formal release of the process for full production. The release should take the form of written authorizations and approvals from the process validation team and management. The validation team then prepares a final report on the entire process validation project and presents it to management.

When to Revalidate a Process

To maintain optimal performance, operations management needs to monitor key measures, review work methods and procedures, and take action when problems occur. In doing so, it will become necessary to partially or fully revalidate a process. Section 820.75(c) US FDA QSR requires you to consider revalidating a process under the following conditions: “When changes or process deviations occur, the manufacturer shall review and evaluate the process and perform revalidation where appropriate. These activities shall be documented.”

Potential triggers for process revalidation can include changes to specifications, methods, procedures, software, designs, key components, batch scaling, location changes, equipment changes, and more, such as:

  • Changes made to the process
  • Negative trend in quality, sudden quality deterioration, and/or spike in customer complaints
  • Major expansion of line capacity
  • Change in design
  • Change in product packaging
  • Transfer of a process to another facility
  • Change of the application of the process

However, process revalidation is not only event-driven; it can also be triggered by the passage of time. Periodic revalidation is not required but you may, for example, determine that a specific process should be subject to a full or partial revalidation every 2 or 3 years, even if everything is running smoothly. This may be determined largely based on the critical nature of the process. An example could be sterilization. This revalidation timeframe needs to be defined in your validation report or your validation master plan.

Does Your Medical Device Process Require Revalidation?

When you buy a new car you don’t expect it to run smoothly forever. Likewise, despite your diligence and best efforts, glitches will occur and process refinements will be made. Even new or modified processes falter after implementation. Thus, it’s important to remember that process validation is never complete for long. Process performance must be monitored and maintained over time to ensure consistent performance, and full or partial revalidation of IQ, OQ, and PQ is simply part of the ongoing cycle. Revalidation requirements should always be considered an integral aspect of an original validation approval.


Medical Device Process Re-validation


Full or Partial Revalidation?

The decision on whether to revalidate is one based on risk, as shown in the table below. It can be a perplexing decision for many medical device QA professionals because the determination of risk and impact is somewhat subjective. One of the inputs to a decision to revalidate might be a potential impact to a critical process parameter that might bring about a change in product quality or create a new risk. Another input would be a change to a standard that applies to the process.

A partial revalidation may be to simply repeat the PQ section whereby you are running in production mode but with more sampling. In any case, having a robust risk evaluation process is critical. Partial revalidations need to have a clear justification documenting the reasons a partial or no revalidation was deemed to be appropriate.





Partial revalidation

Full revalidation


No revalidation

Partial revalidation

Don’t Overlook Software Used in Medical Device Production

Keep in mind that if you have software that is used in the production of your device, you need to validate (and revalidate) this as well.  ISO/TR 80002-2:2017 states that validation must be performed on “software used in production and service provision, and software used for the monitoring and measurement of requirements, as required by ISO 13485:2016:  7.5.6 and 7.6.”

Likewise, TIR36 published by AAMI), says “software used to automate device design, testing, component acceptance, manufacturing, labeling, packaging, distribution, and complaint handling or to automate any other aspect of the quality system, as defined by the Quality System Regulation (21 CFR 820).”

The issue of validating software used in the production of medical devices is an important and complex topic that we will cover in a future article.

Want to Learn More About Process Validation?

We have only scratched the surface of what there is to know about medical device process validation. If you enjoyed this article medical device process validation training class.

Our team is here to help. Contact us online
Get answers right now. Call

US OfficeWashington DC


EU OfficeCork, Ireland

+353 21 212 8530