TIPS: GMP Process Validation and Quality Systems
Common Process Validation Mistakes to Avoid
What FDA Inspectors Find and What You Can Do Before They Do
What FDA Inspectors Find and What You Can Do Before They Do
Process validation failures do not usually happen because manufacturers are careless. They happen because the same avoidable gaps appear in program after program: validation conducted before equipment is qualified, acceptance criteria written to be vague enough to guarantee a pass, three runs selected arbitrarily rather than statistically justified, and protocols that describe what was done rather than what must happen for the process to be in control. These tips cover the most common and consequential validation mistakes, grounded in FDA’s guidance framework and recurring inspection observation patterns.
#3
Most Cited Drug cGMP Area
Failure to follow written procedures and inadequate validation were in the top five most cited drug cGMP observations in FDA FY2024 inspections. Validation deficiencies have held a top-five position for over a decade.
FDA 483 Enforcement Data, FY2024
2011
FDA Process Validation Guidance
FDA’s Guidance for Industry: Process Validation (January 2011) replaced the 1987 guidance and established the three-stage lifecycle framework: Process Design, Process Qualification, and Continued Process Verification.
FDA CDER/CBER/CVM, January 2011
CPV
The Stage Most Companies Skip
Continued Process Verification (Stage 3 of FDA’s lifecycle framework) is the most commonly neglected validation stage. Many manufacturers complete Stage 2 qualification and consider validation done, with no ongoing statistical process control or trend analysis program.
FDA Process Validation Guidance, 2011
Why Process Validation Keeps Failing Even at Experienced Companies
Process validation is one of the most well-documented cGMP requirements. FDA published its current guidance framework in 2011. ICH Q8, Q9, and Q10 provide the science and risk management underpinnings. Yet validation deficiencies consistently appear in FDA 483 observations and Warning Letters year after year, including at companies with long manufacturing histories and experienced quality teams.
The reason is that most validation failures are not knowledge failures. They are execution and program design failures. Companies that understand what validation requires still make mistakes in how they structure their programs: running the minimum number of batches without justification, writing acceptance criteria that cannot be falsified, qualifying equipment and validation on the same timeline, and treating Stage 2 process qualification as the end of the validation program rather than the beginning of a monitored lifecycle.
These tips address the most consequential recurring failures, grounded in FDA’s 2011 guidance framework, 21 CFR 211 requirements, and inspection observation patterns.
1
Starting Validation Before Equipment Is Fully Qualified
THE MISTAKE
Equipment qualification (IQ, OQ, PQ) and process validation are treated as parallel tracks rather than sequential ones. Process validation batches are manufactured before OQ or PQ is complete. The qualification and validation reports are finalized simultaneously after all runs are done, making it impossible to demonstrate that the equipment was shown to be in a qualified state before validation commenced.
WHY IT MATTERS TO FDA
FDA’s 2011 Process Validation Guidance and 21 CFR 211.68 require that equipment used in drug manufacturing be of appropriate design and adequately calibrated and inspected. If the equipment was not demonstrated to operate within its specified parameters before it was used to manufacture validation batches, the validation data cannot demonstrate that the process is in control. Any variation in validation results may be attributable to unqualified equipment rather than the process itself.
WHAT TO DO INSTEAD
Require a completed and approved IQ, OQ, and PQ report for every critical piece of equipment before the first process validation batch is manufactured. The validation protocol should reference the equipment qualification report numbers and confirm that qualifications are current. If equipment is modified or requalified during the validation period, the impact on validation data already collected must be evaluated and documented.
2
Writing Acceptance Criteria After Seeing the Data
THE MISTAKE
Validation protocols contain acceptance criteria that are defined or revised after the validation runs are complete, either because results came in worse than expected and limits were loosened to accommodate them, or because results came in better than expected and limits were tightened to appear more rigorous. In either case, the acceptance criteria do not represent a pre-defined, scientifically based expectation. They represent a post-hoc rationalization of what actually happened.
WHY IT MATTERS TO FDA
The purpose of pre-defined acceptance criteria is to provide a falsifiable standard against which the process is tested. Criteria that are written or adjusted after results are known cannot be falsified. FDA inspectors look for the date of protocol approval versus the date of validation execution. If the protocol was approved or modified after runs were completed, the acceptance criteria are effectively post-hoc and the validation cannot demonstrate prospective assurance of process capability.
WHAT TO DO INSTEAD
Protocol approval must be complete, with all acceptance criteria finalized, before the first validation batch is manufactured. Acceptance criteria should be derived from development data, specifications, regulatory requirements, and risk assessment, not from a guess that will be confirmed later. If data from validation runs reveals that an acceptance criterion was incorrectly specified, the deviation must be documented, the batches may not be retroactively approved against revised criteria, and a protocol amendment with prospective re-execution may be required.
3
Using Three Runs With No Statistical or Scientific Justification
THE MISTAKE
Three is the most common number of process validation batches, and three is often the right number. But companies frequently run three batches because three is the industry convention, not because three has been shown to be sufficient for their specific process, variability, and the statistical confidence required. The validation report states “three batches were run per industry practice” rather than “three batches were determined to be sufficient based on the following analysis.”
WHY IT MATTERS TO FDA
FDA’s 2011 Process Validation Guidance explicitly states that the number of samples and the sampling frequency should be based on statistical principles and process understanding, not arbitrary convention. A process with high inherent variability or complex critical quality attributes requires more data to demonstrate control than a simple, well-characterized process. Running three batches because “that’s what’s always done” without documented justification is a program design deficiency that FDA inspectors increasingly challenge.
WHAT TO DO INSTEAD
Document the statistical and scientific rationale for the number of validation batches and sampling frequency chosen. Consider process variability from development data, the degree of confidence required, and the consequences of process failure. For highly variable or high-risk processes, three batches may be insufficient. For simple, well-characterized processes with extensive development data, fewer batches with more intensive sampling may be appropriate. The justification must appear in the validation protocol before execution begins.
4
Skipping or Inadequately Documenting the Risk Assessment
THE MISTAKE
Risk assessment is either skipped entirely, performed informally without documentation, or conducted as a checkbox exercise that identifies no significant risks. A risk assessment that concludes all risks are low with no substantive analysis is the same as no risk assessment for regulatory purposes. The critical process parameters (CPPs) and critical quality attributes (CQAs) identified in the risk assessment should directly drive the validation sampling plan, testing locations, and acceptance criteria. When they do not, the risk assessment added no value to the program.
WHY IT MATTERS TO FDA
ICH Q9 (Quality Risk Management) and FDA’s 2011 Process Validation Guidance both call for risk-based approaches to validation. The validation program should be designed around the risks that actually exist for the specific process, not around a standard template. When FDA inspectors find no documented risk assessment, or a superficial one, they look for evidence that the validation was designed to challenge the actual risks. If that evidence is absent, the validation may be inadequate regardless of whether all batches passed.
WHAT TO DO INSTEAD
Conduct a documented risk assessment using a recognized methodology (FMEA, HACCP, fault tree, or equivalent) before protocol development. The risk assessment should identify the CPPs and CQAs, evaluate the likelihood and severity of failures at each process step, and determine which risks require enhanced controls or sampling during validation. The results should be reflected in protocol design: higher-risk steps get more intensive sampling, more challenging conditions, and tighter acceptance criteria. Link the validation protocol explicitly to the risk assessment by reference.
5
Treating Stage 2 Qualification as the End of Validation
THE MISTAKE
Once the three validation batches pass, the validation is considered complete. No ongoing monitoring program is established. No statistical process control charts are maintained. No trend analysis is performed on routine production data. If a subsequent batch fails, the investigation starts from zero because there is no baseline trend data to indicate when the process began to shift. The validation was an event, not a lifecycle program.
WHY IT MATTERS TO FDA
FDA’s 2011 guidance explicitly established three stages of process validation. Stage 3 (Continued Process Verification) requires ongoing collection and analysis of process data from routine production to demonstrate the process remains in a state of control. This is not optional language: the guidance reflects FDA’s expectation under 21 CFR 211.110 that sampling and testing plans for in-process controls be established and followed. Absence of a Stage 3 program is a significant inspection finding, particularly after a product quality complaint or batch failure.
WHAT TO DO INSTEAD
Design Stage 3 as a formal program before Stage 2 is complete. Define the CPPs and CQAs to be monitored in routine production, the frequency and sample size for ongoing testing, the statistical tools for trend analysis (control charts, Cpk tracking, ANOVA), and the alert and action thresholds that trigger investigation. Annual product reviews required under 21 CFR 211.180(e) should incorporate Stage 3 data. A product that has been in commercial production for five years without any Stage 3 monitoring has never completed its validation lifecycle.
6
Failing to Validate After Process Changes
THE MISTAKE
A change is made to a manufacturing process (a different excipient supplier, a new blending time, a different granulation equipment model) and approved through the change control system. The change control documentation states the change is “minor” and concludes that revalidation is not required. No validation impact assessment is performed. The conclusion that revalidation is unnecessary is not supported by data or scientific rationale: it is a judgment made to avoid the cost and time of revalidation.
WHY IT MATTERS TO FDA
21 CFR 211.100 requires that written procedures cover manufacturing operations, and 21 CFR 211.110 covers in-process sampling and testing. Changes that affect CPPs, CQAs, or the conditions under which the process was originally validated require reassessment of validation status. FDA inspectors examine change control records and look for validation impact assessments that are substantive rather than formulaic. A change control system that consistently concludes no revalidation is needed, without documented scientific rationale for each conclusion, is a process validation program that is not being maintained.
WHAT TO DO INSTEAD
Every change control for a validated process must include a documented validation impact assessment that evaluates whether the change affects any CPP, CQA, or validated operating range. The assessment must be performed by qualified personnel and approved before the change is implemented. Where the assessment concludes revalidation is not required, the rationale must be specific and science-based. A SOP that defines the criteria for triggering revalidation (changes to CPPs, changes to equipment that affects mixing or heat transfer, changes to critical raw material sources) removes ambiguity and provides a defensible framework for each impact assessment.
7
Validating with Atypical Conditions That Favor Passing
THE MISTAKE
Validation batches are manufactured with the best-available raw material lots, by the most experienced operators, under ideal environmental conditions, using freshly calibrated equipment, with the quality team present throughout. Routine production then uses average material lots, regular operators with normal training, variable environmental conditions, and equipment at the end of its calibration interval. The process passes validation but then fails in routine production. The validation demonstrated best-case performance, not typical or worst-case performance.
WHY IT MATTERS TO FDA
Validation must demonstrate that the process works under the conditions it will actually be used, not under artificially favorable conditions. Worst-case validation is a recognized approach precisely because it tests the boundaries of the design space. When a validated process fails in routine production, FDA’s investigation will include whether the validation was conducted under representative conditions. Evidence that validation batches used exceptional conditions not representative of routine operations undermines the validity of the entire validation study.
WHAT TO DO INSTEAD
Define in the validation protocol the conditions under which validation batches will be manufactured, and confirm those conditions are representative of routine production. Consider using worst-case or bracketing approaches for critical process parameters: validate at the edges of the operating range, not the center. Rotate operators across validation runs to represent the normal operator population. Use raw material lots of documented typical quality, not specially selected lots. Document in the validation report what conditions were used and why they represent routine manufacturing conditions.
8
No Process Design Stage: Jumping Straight to Process Qualification
THE MISTAKE
Stage 1 (Process Design) in FDA’s lifecycle model is where process knowledge is built and the commercial manufacturing process is defined. Many companies skip or minimize this stage and move directly to Stage 2 validation runs without sufficient process understanding. The result is a validation study that tries to learn about the process while simultaneously attempting to validate it. Variables that should have been understood and controlled in development appear as unexplained variability during validation, leading to failed batches, protocol deviations, and investigations that reveal the process was not ready to validate.
WHY IT MATTERS TO FDA
FDA’s 2011 guidance establishes Stage 1 (Process Design) as the foundation of the validation lifecycle. It is where CPPs and CQAs are identified through development studies, design of experiments (DOE), or prior knowledge. The process design package, including the documented rationale for the chosen operating ranges and controls, supports the validation protocol. Without a robust Stage 1, the validation protocol has no scientific basis for its acceptance criteria, operating ranges, or sampling strategy.
WHAT TO DO INSTEAD
Confirm that Stage 1 documentation exists and is adequate before Stage 2 is initiated. Stage 1 outputs should include: identified CPPs and their operating ranges, documented CQAs and their acceptable ranges, data from development batches, scale-up studies, or platform knowledge that supports the commercial process design, and a process flow with identified critical control points. This documentation feeds directly into the validation protocol. If it does not exist, Stage 2 is premature regardless of commercial schedule pressure.
9
Inadequate Cleaning Validation
THE MISTAKE
Cleaning validation is treated as a separate, lower-priority program that runs independently from process validation with less rigor. Worst-case products for carry-over limits are not identified, or identification is not documented. Visual inspection alone is used as the only criterion despite FDA’s expectation of analytical testing. Swab recovery studies have never been performed to confirm that the sampling method actually detects the residue being measured. The cleaning validation covers the equipment used in development batches but not the commercial manufacturing equipment.
WHY IT MATTERS TO FDA
FDA’s 1993 Guide to Inspections of Cleaning Validation and subsequent inspection experience consistently cite cleaning validation gaps. Under 21 CFR 211.67, equipment must be cleaned at appropriate intervals. FDA expects cleaning validation to demonstrate that cleaning procedures consistently reduce residues to below established limits. A cleaning validation without analytical testing, without documented swab recovery data, or without worst-case product identification is incomplete regardless of whether visual inspection results have always passed.
WHAT TO DO INSTEAD
Integrate cleaning validation planning into the process validation program from the start. Identify worst-case products for each piece of shared equipment based on potency, solubility, and difficulty of cleaning. Establish acceptable residue limits based on toxicological data (health-based exposure limits are the current standard approach). Perform and document swab and rinse recovery studies. Use validated analytical methods capable of detecting residues at the acceptable limit. Validate the worst-case cleaning scenario, not the easiest one.
10
Validation Reports That Describe Rather Than Conclude
THE MISTAKE
The validation report contains extensive tables of data, descriptions of what was done, and summaries of individual test results. It does not contain a clear, specific conclusion on whether each acceptance criterion was met, a summary of any deviations and their disposition, a statement of whether the process is in a validated state, and any limitations or conditions associated with the validation (equipment ranges validated, batch sizes validated, material sources validated). FDA inspectors reading the report cannot quickly determine whether the process passed, failed, or had qualified exceptions.
WHY IT MATTERS TO FDA
A validation report is a regulatory document that must support the conclusion that the process is validated for commercial manufacturing. It must be clear enough that an FDA inspector can read it and determine, without ambiguity, whether the validation was successful, what the scope and limitations of the validation are, and what conditions apply to commercial manufacturing as a result. A report that requires the reader to draw their own conclusions from raw data is not a complete regulatory document under 21 CFR 211.68 and the cGMP framework for documented evidence.
WHAT TO DO INSTEAD
Structure every validation report to include, at minimum: an executive summary that states in one paragraph whether the validation was successful and what the validated state is; a criterion-by-criterion results table showing actual result versus acceptance criterion and pass/fail status; a deviation and exception summary with disposition for each; and a conclusions section that explicitly states what has been validated, under what conditions, and what limitations apply. The report should also reference the validation protocol and confirm the protocol version that was followed. A person unfamiliar with the process should be able to read the report and determine whether the process is validated.
Process Validation Mistakes: Quick Reference
Source: FDA Guidance for Industry: Process Validation (January 2011) | 21 CFR Part 211 | ICH Q8, Q9, Q10
Key Takeaways
Validation Is a Lifecycle, Not an Event
FDA’s three-stage lifecycle framework makes explicit what the underlying regulatory requirements always required: process understanding must precede qualification, qualification must be designed around that understanding, and the validated state must be monitored and maintained throughout commercial production. Treating Stage 2 as the end of validation is a structural program error, not a minor gap.
The Protocol Must Be Final Before the First Batch
No acceptance criterion, no operating range, and no sampling plan element may be changed after the first validation batch is manufactured without triggering a documented deviation and re-evaluation of whether the study can continue. The approved protocol is the commitment. Revising it based on data is not flexible science. It is the elimination of a falsifiable standard.
Justify Everything That Three Does Not Say for Itself
Three batches is a convention, not a requirement. The requirement is that the number of batches and the sampling frequency must be statistically and scientifically justified for the specific process being validated. Document that justification in the protocol before execution. The absence of that documentation is increasingly what FDA inspectors challenge in process validation programs.
Change Control Must Include Validation Impact Assessment
Every change to a validated process requires a documented validation impact assessment with a science-based conclusion. A change control system that routinely concludes no revalidation is needed, without specific rationale tied to CPPs and CQAs, is not maintaining the validated state. It is creating the illusion of maintenance while the process may have drifted outside its validated design space.
Frequently Asked Questions
Does FDA require exactly three validation batches?
No. FDA’s 2011 Process Validation Guidance does not specify a minimum number of batches. It requires that the number of batches and sampling frequency be based on statistical principles and process understanding. Three is common because it is often sufficient for well-characterized processes with moderate variability, but FDA expects the number to be justified, not assumed. Where three is used, the rationale for choosing three over two or five must be documented in the protocol.
When does a process change require revalidation?
Any change that potentially affects a critical process parameter (CPP) or critical quality attribute (CQA), or that moves manufacturing outside the previously validated operating range, requires at minimum a documented validation impact assessment. Changes that do affect CPPs or CQAs typically require at minimum partial revalidation. Examples include: change of API source, change of a critical excipient or its supplier, change of manufacturing equipment model or size, change in batch size beyond the validated range, and facility changes that affect environmental controls for aseptic processing. The change control SOP should define the criteria that trigger revalidation, and the impact assessment must apply those criteria specifically.
What is the difference between a validation deviation and a validation failure?
A deviation is a departure from the approved protocol (a test was performed on a different day, a sampling point was missed, an equipment parameter drifted slightly from its set point). A failure is when actual results do not meet a pre-defined acceptance criterion. Deviations require documentation and evaluation of their impact on the validity of the data. Failures require investigation to determine root cause and a decision about whether the batch can be qualified or whether additional runs are required. Deviations do not automatically invalidate a run; failures typically do for that specific criterion, pending investigation.
Government and Regulatory Sources
- FDA. Guidance for Industry: Process Validation: General Principles and Practices. CDER/CBER/CVM, January 2011.
- FDA. Guide to Inspections of Cleaning Validation. Office of Regulatory Affairs, July 1993.
- eCFR. 21 CFR Part 211: Current Good Manufacturing Practice for Finished Pharmaceuticals.
Industry References
Related VelSafe Articles
- Cleanroom Compliance: FDA and EU GMP Requirements
- GMP Record Retention Laws for Dietary Supplement Companies
- FDA Complaint Handling: QMSR and ISO 13485 Requirements
Build Validation Programs That Hold Up Under Inspection
The ten mistakes in this guide are not obscure edge cases. They are recurring patterns in FDA 483 observations and Warning Letters that show up in facilities of every size and experience level. The common thread is treating validation as a compliance event rather than a quality program: designing to pass rather than to understand, documenting to satisfy rather than to prove, and ending at Stage 2 rather than maintaining through Stage 3. Find more pharmaceutical GMP and quality compliance resources at velsafe.com.