GUIDES: GMP Process Validation
What FDA Actually Requires for Process Validation
and Where Most GMP Manufacturers Fall Short
and Where Most GMP Manufacturers Fall Short
FDA’s 2011 guidance replaced the old three-batch approach with a lifecycle framework built on scientific understanding of your process. Most warning letters cite not the absence of validation but failures in the third stage: continued process verification. This guide covers what each stage requires and what auditors look for first.
2011
FDA Guidance Year
FDA’s Process Validation: General Principles and Practices replaced the 1987 guidance and eliminated the three-batch minimum, replacing it with a science-based lifecycle approach.
FDA, 2011
3
Validation Stages
Process Design, Process Qualification, and Continued Process Verification. All three stages are required under the FDA lifecycle framework. Stage 3 is the most commonly deficient.
FDA Process Validation Guidance
21 CFR
Part 211.68
The primary regulatory anchor for pharmaceutical process validation in the US. Medical device manufacturers are governed by 21 CFR Part 820.75 under QMSR.
21 CFR 211.68
Why Process Validation Exists and What the Law Actually Requires
Process validation is the documented evidence that a manufacturing process consistently produces a product meeting its predetermined specifications and quality attributes. The regulatory requirement is not bureaucratic: it reflects a fundamental principle of GMP: you cannot test quality into a product after it is made. Quality must be built in through a controlled, understood, and reproducible process.
For pharmaceutical manufacturers, the requirement flows from 21 CFR 211.68, which requires that equipment and processes be validated to ensure they perform as intended. FDA’s 2011 guidance document elaborates this into a three-stage lifecycle. For medical device manufacturers under QMSR, 21 CFR 820.75 requires that processes whose results cannot be fully verified by subsequent inspection or test be validated. ICH Q7 for API manufacturers and ICH Q10 for the broader pharmaceutical quality system both reinforce validation as a core lifecycle obligation.
The 1987 vs 2011 Framework: What Changed
1987 Approach
Three consecutive batches meeting specifications was widely interpreted as sufficient validation. Static, point-in-time evidence with little ongoing monitoring required.
2011 Lifecycle Approach
No minimum batch number. Instead: scientific process understanding in Stage 1, statistically meaningful qualification in Stage 2, and continuous monitoring throughout commercial production in Stage 3.
Source: FDA Process Validation: General Principles and Practices, 2011
ICH Q10 reinforces this lifecycle view of validation by embedding continued process verification within the broader pharmaceutical quality system. Under ICH Q10, process validation is not a one-time regulatory event but an ongoing commitment to understanding and controlling the process across its commercial lifetime. Organisations that treat validation as complete at the end of Stage 2 are operating outside both the FDA and ICH quality system frameworks.
Stage 1: Process Design
Stage 1 is where process knowledge is developed and the commercial manufacturing process is defined. The output of Stage 1 is a process design that captures the relationship between process parameters and product quality attributes. This stage includes development activities, scale-up studies, and design of experiments, all the scientific work that establishes what the process must do and how it must be controlled.
Critical Quality Attributes (CQAs) identification
CQAs are the physical, chemical, biological, or microbiological properties or characteristics that must be within an appropriate limit, range, or distribution to ensure product quality. Identifying CQAs is the foundation of Stage 1, and every subsequent control strategy is built around protecting them. CQAs are typically defined in the regulatory submission and the product specification.
Critical Process Parameters (CPPs) and normal operating ranges
CPPs are process parameters whose variability has an impact on a CQA and therefore should be monitored or controlled to ensure the process produces the desired quality. Stage 1 uses risk assessment (FMEA, fishbone analysis, Ishikawa diagrams) to identify CPPs from the full set of process parameters. Normal operating ranges for CPPs must be established and scientifically justified.
Control strategy development
The control strategy is a planned set of controls derived from the product and process understanding that ensures process performance and product quality. It encompasses in-process controls, material specifications, equipment parameters, environmental monitoring, and the acceptance criteria for finished product testing. A robust control strategy reduces the burden on end-product testing by controlling quality at source.
Scale-up and technology transfer documentation
When a process moves from development to commercial scale, the knowledge generated in development must be transferred in a way that preserves the process understanding and control strategy. Technology transfer protocols must document which parameters were fixed at development scale, which were adjusted for commercial scale, and what the scientific basis for each scale-up decision was.
Stage 2: Process Qualification
Stage 2 evaluates whether the process design can be reproduced consistently at commercial scale. This is where IQ, OQ, and PQ protocols are executed. FDA’s guidance requires that the number of PPQ (Process Performance Qualification) batches be determined based on statistical rationale and the level of process understanding from Stage 1, not defaulted to three batches.
IQ: Installation Qualification
Documented evidence that equipment is installed correctly per the manufacturer’s specifications and drawings. IQ verifies that utilities, instruments, and controls are connected as designed. It typically includes equipment inventory, calibration status, software version, and as-built drawings verification.
OQ: Operational Qualification
Documented evidence that equipment operates within established limits under simulated or actual operating conditions. OQ challenges the equipment at its operational boundaries (worst-case conditions) to demonstrate that it performs as specified across the range of intended use.
PQ: Performance Qualification
Documented evidence that the process consistently produces acceptable product under commercial conditions using commercial-scale equipment. PQ (also called PPQ, Process Performance Qualification) in FDA’s 2011 guidance) uses the actual product, actual processes, and trained commercial-scale personnel. It must use pre-approved acceptance criteria established before execution.
PPQ Protocol requirements
FDA requires that the PPQ protocol address: manufacturing conditions, process parameters, controls and in-process tests, the basis for the number of batches, statistical methods for data analysis, and pre-determined acceptance criteria. The protocol must be reviewed and approved by appropriate organisational units, including QA, before execution begins.
Stage 3: Continued Process Verification
Stage 3 is ongoing assurance that the process remains in a state of control during routine commercial production. This is the stage most frequently cited in FDA warning letters and inspection observations. Many manufacturers invest heavily in Stages 1 and 2 and then treat Stage 3 as a passive annual product review. FDA’s guidance is explicit: Stage 3 requires an ongoing programme that collects and analyses process and product data to detect undesired process variability and identify opportunities for improvement.
The most common Stage 3 failure: treating it as a retrospective review
Continued process verification is prospective and real-time, not a retrospective annual product review completed as a regulatory exercise. FDA expects statistical process control, trend analysis, and a programme that detects process drift before it causes a product failure. Completing an annual product review that notes “no adverse trends” without statistical evidence is not Stage 3 compliance.
The practical implication is that every commercial batch contributes data to the Stage 3 monitoring programme. In-process measurements, CPP readings, and finished product test results must be trended at a frequency sufficient to detect drift before it causes failure. A manufacturer reviewing process data only during an annual product review is accumulating undetected risk across every intervening batch. Stage 3 monitoring closes that gap by making process health visible in real time.
Statistical process control (SPC) requirements
Stage 3 requires that process data be collected and analysed using statistically sound methods. Control charts for CPPs and CQA-correlated in-process measurements allow detection of special cause variation before it causes product failure. FDA expects manufacturers to establish action and alert limits, define response procedures, and demonstrate that these are consistently applied. Manufacturers should also consider that process capability data from Stage 3 can inform future process improvements and support post-approval change submissions, making Stage 3 not just a compliance obligation but an operational asset that builds process knowledge over time.
Process capability and variability analysis
Capability indices (Cpk, Ppk) provide a quantitative measure of how well a process performs relative to its specification limits. FDA expects manufacturers to know their process capability and to trend it over time. A process with low Cpk values is at risk of producing out-of-specification batches, and a manufacturer who cannot demonstrate awareness of their process capability is demonstrating inadequate Stage 3 monitoring.
Data collection frequency and sampling strategy
The sampling strategy for Stage 3 must be statistically justified and risk-based. The frequency of data collection for each CPP and monitored CQA should be sufficient to detect trends and shifts in process performance. Changes to sampling frequency must be documented and justified: reducing sampling without scientific rationale is a common inspection finding.
Prerequisites Before Validation Begins
A validation programme cannot succeed if the foundational systems supporting it are not in place and qualified. Attempting to run PPQ batches with unqualified equipment, unvalidated analytical methods, or inadequately trained personnel produces results that cannot be relied upon and will not withstand regulatory scrutiny.
Equipment and Facilities
Equipment IQ and OQ completed and approved
Calibration current on all instruments used in validation
Cleaning validation complete for all equipment
Environmental monitoring programme qualified
Utilities (WFI, clean steam, compressed air) qualified
Calibration current on all instruments used in validation
Cleaning validation complete for all equipment
Environmental monitoring programme qualified
Utilities (WFI, clean steam, compressed air) qualified
Analytical and Documentation
All analytical methods validated per ICH Q2(R2)
Raw material specifications established and qualified suppliers confirmed
Master batch records reviewed and approved
Process validation protocol approved by QA
Training records current for all participating personnel
Raw material specifications established and qualified suppliers confirmed
Master batch records reviewed and approved
Process validation protocol approved by QA
Training records current for all participating personnel
Process Validation Compliance Checklist
Stage 1: Process Design
CQAs identified and documented
CPPs identified via risk assessment
Normal operating ranges established
Control strategy documented
Scale-up rationale recorded
Technology transfer protocol complete
CPPs identified via risk assessment
Normal operating ranges established
Control strategy documented
Scale-up rationale recorded
Technology transfer protocol complete
Stage 2: Process Qualification
IQ completed and approved for all equipment
OQ completed at worst-case conditions
PPQ protocol approved prior to execution
Batch number statistically justified
Pre-approved acceptance criteria established
PPQ report approved by QA before commercial production
OQ completed at worst-case conditions
PPQ protocol approved prior to execution
Batch number statistically justified
Pre-approved acceptance criteria established
PPQ report approved by QA before commercial production
Stage 3: Continued Process Verification
SPC programme defined for all CPPs and monitored CQAs
Control chart action and alert limits established
Response procedures defined for out-of-trend results
Process capability (Cpk/Ppk) calculated and trended
Sampling strategy statistically justified and documented
Annual product review integrates Stage 3 data (and is supplementary, not a substitute)
CAPA system linked to Stage 3 adverse trend findings
Change control triggers reassessment of validation status
Control chart action and alert limits established
Response procedures defined for out-of-trend results
Process capability (Cpk/Ppk) calculated and trended
Sampling strategy statistically justified and documented
Annual product review integrates Stage 3 data (and is supplementary, not a substitute)
CAPA system linked to Stage 3 adverse trend findings
Change control triggers reassessment of validation status
Common Validation Failures and What Auditors Find First
Acceptance criteria defined after seeing data
Pre-approved acceptance criteria are a fundamental requirement of PPQ. Setting acceptance criteria after reviewing PPQ batch results to ensure the criteria match the data rather than the reverse. This is one of the most serious validation failures and is easily discovered during document review. The protocol approval date must predate execution.
No statistical justification for the number of PPQ batches
Selecting three batches because “that is what has always been done” is not compliant with FDA’s 2011 guidance. The number of PPQ batches must be justified based on the degree of process understanding from Stage 1, the inherent variability of the process, and statistical principles. A process with high variability or limited Stage 1 data may require significantly more than three PPQ batches.
Change control not triggering revalidation
Any change to equipment, materials, processes, or facilities that could affect product quality or the validated state must be assessed through change control and may trigger partial or full revalidation. Manufacturing sites that fail to assess validation impact during change control, or that assess it only nominally, create undocumented gaps between what was validated and what is being commercially produced.
Cleaning validation gaps for multi-product equipment
Cleaning validation must demonstrate that residues from the previous product, cleaning agents, and degradation products are removed to levels that will not affect the quality of the subsequent product. The worst-case product selection for multi-product equipment must be scientifically justified using solubility, potency, and toxicological data, not defaulted to the most recently run product.
A practical approach to avoiding these failures is to build validation readiness checks into routine quality system activities. Change control assessments should include a mandatory validation impact field. Deviation investigations should ask whether the root cause could affect process control or validation status. CAPA effectiveness checks should verify that corrective actions have not inadvertently introduced new validation gaps. These integration points turn the validation programme from a project-based activity into a continuous quality system function.
Key Takeaways
Three batches is not the standard
FDA’s 2011 guidance eliminated the three-batch minimum. The number of PPQ batches must be statistically justified based on process understanding and variability. A high-variability process with limited development data may require significantly more. Defaulting to three without justification is a documentation deficiency.
Stage 3 is where most warning letters originate
Continued process verification is not a passive monitoring activity. FDA expects statistical process control, trend analysis, defined response procedures, and a CAPA linkage for adverse trends. An annual product review that lacks statistical analysis of process data does not satisfy Stage 3 requirements.
Validation is only as strong as the change control system supporting it
A validated process that has been modified without reassessment is no longer validated in any meaningful sense. Every change to equipment, materials, suppliers, facilities, or processes must be assessed for its impact on validation status. The gap between what was validated and what is currently running is the exact vulnerability that FDA inspections and CAPA programmes are designed to find.
Frequently Asked Questions
Does the FDA 2011 guidance eliminate the three-batch requirement entirely?
Yes. The 2011 guidance explicitly states that the number of PPQ batches should be determined based on a statistical rationale and the degree of process understanding gained from Stage 1. Three batches has no special regulatory status under the current framework. That said, many manufacturers find that three to five batches is sufficient for well-understood processes: the key is that the number must be justified, not assumed.
What is the difference between process validation and process verification?
Process validation (Stages 1 and 2) is the prospective demonstration that a process will consistently produce a product meeting its specifications. Process verification (Stage 3) is the ongoing confirmation during commercial production that the validated state is being maintained. Verification does not replace validation: it complements it by detecting drift before it becomes failure.
When does a change require revalidation?
Any change that could affect product quality or the validated state must be assessed through change control. Changes that typically require revalidation include: equipment replacement or significant modification, changes to raw material suppliers or specifications, changes to the manufacturing site, scale-up or scale-down beyond the validated range, and changes to formulation or process parameters outside validated ranges. The assessment must be documented and the conclusion justified.
Does ICH Q7 align with FDA’s three-stage lifecycle approach?
ICH Q7 (Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients) requires validation of critical steps and critical processes. While Q7 does not use the exact three-stage lifecycle terminology of the 2011 FDA guidance, the underlying principles are consistent. ICH Q7 Section 12 requires process validation to demonstrate that a defined process will consistently produce an API meeting its specifications and quality attributes. Continued process monitoring is also expected under Q7.
What is concurrent validation and when is it acceptable?
Concurrent validation involves releasing product for distribution while validation is still in progress, typically when the demand for a product makes it impractical to withhold all PPQ batches until a full validation report is approved. FDA’s 2011 guidance discourages concurrent validation as a routine approach and states it should be used only in exceptional circumstances with documented justification. The basis, risks, and controls for concurrent release must be documented and approved.
How does cleaning validation relate to process validation?
Cleaning validation is a prerequisite for process validation on shared equipment. Before PPQ batches can be run, cleaning validation must demonstrate that cleaning procedures consistently remove product residues, cleaning agents, and microbial contamination to predetermined acceptance limits. The worst-case product for cleaning validation must be identified using scientific criteria including solubility and potency, and the cleaning validation must cover all product contact surfaces used in the process.
What documentation must a validation master plan contain?
A Validation Master Plan (VMP) should document: the validation policy and philosophy, the scope of validation activities at the site, the organisational structure and responsibilities for validation, the planning and scheduling approach, the documentation requirements and format for validation protocols and reports, the change control and revalidation strategy, and the approach to equipment qualification. The VMP serves as the site-level document from which individual validation protocols are derived. FDA does not mandate a specific VMP format but expects the validation system to be documented at an appropriate level.
Sources
Government and Regulatory Sources
- FDA: Process Validation: General Principles and Practices (2011): the primary US regulatory framework for pharmaceutical process validation, establishing the three-stage lifecycle approach.
- 21 CFR Part 211: Current Good Manufacturing Practice for Finished Pharmaceuticals: the regulatory basis for pharmaceutical process validation requirements in the US.
- 21 CFR Part 820: Quality Management System Regulation (QMSR): medical device process validation requirements under Section 820.75.
- ICH Q7: Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients: Section 12 covers validation requirements for API manufacturing processes.
Industry and Technical References
- ICH Q10: Pharmaceutical Quality System: the international framework for pharmaceutical quality systems, which positions process validation within the product lifecycle.
- ISPE: Process Validation Technical Report: industry guidance on implementing FDA’s lifecycle approach to process validation in pharmaceutical manufacturing.
Related VelSafe Articles
Guides
Medical Device Adverse Event Reporting: 5 Regions
FDA MDR, EU MDR, Health Canada, PMDA, and TGA reporting obligations compared for medical device manufacturers.
Law
Cleanroom Compliance: FDA and EU GMP Requirements
ISO 14644, FDA 21 CFR Part 211, and EU GMP Annex 1 cleanroom requirements directly relevant to validation environments.
Law
FDA Complaint Handling: QMSR and ISO 13485 Requirements
How complaint handling and CAPA intersect with validation status assessment under QMSR 21 CFR Part 820 and ISO 13485.
GMP VALIDATION COMPLIANCE
Build a Validation Programme That Holds Up Under FDA Inspection
Find more GMP compliance guides, process validation resources, and regulatory references at VelSafe.
Explore More Guides
