IPVIn-Process Verification

An In-Process Verification (IPV) is the independent confirmation, performed during a manufacturing step, that the operator executed the step the way the approved procedure required. The operative words are independent (a second person or a qualified system, not the operator themself), during (captured at the moment of execution, not after the fact) and the way the approved procedure required (verified against the MMR / SOP / specification, not against an operator's recollection).

Definition matters because the term is widely abused. 'IPV' is used informally to mean any of: an IPC sample, a periodic audit, a paper checkmark in a batch record, an electronic signature at end of shift. None of these are an IPV in the regulatory sense. An IPV is the moment-of-execution independent check that creates the evidence the batch record requires under 21 CFR 211.101, 211.188, 111.65 or 820.70 — and that an FDA, EMA or notified-body investigator can verify happened when the step happened.

IPV is not a single-cite obligation; it lives across the production-and-control sections of every major framework. The convergence is striking: regardless of industry, the regulators want independent verification of critical operations at the moment they happen.

The common thread is risk-based verification of operations where an undetected error would propagate. Dispensing the wrong material, charging the wrong quantity, identifying the wrong equipment, signing the wrong cleaning record — each is a single-point failure that an IPV is designed to catch.

There are exactly three regulatory-acceptable IPV modes. Knowing which mode a step uses is foundational to designing the workflow.

Mode 1 — One-person IPV (electronic system)

The operator performs the step; a qualified electronic system independently verifies. Example: an operator scans the container barcode; the MES reads the material ID from the scan, queries the work-order's material reservation, confirms identity match, reads the gross weight from a calibrated balance with a current calibration record, and writes the verified entry into the batch record. The 'second person' is the system, but the system must be qualified to the same risk level as a human verifier and the operator cannot bypass the check.

Mode 2 — Two-person IPV (human verifier)

The operator performs the step; a second qualified individual, physically present, observes and signs. This is the historical default and remains the standard for the highest-risk operations (dispensing of controlled substances, identity of API in a small-batch process, equipment-clearance for changeover). The second person must be qualified for the verification, must observe in real time (not after the fact), and must sign with an identity-attributed signature.

Mode 3 — Hybrid (system-assisted human verification)

The system performs the deterministic checks (identity, status, expiry, weight in range); the human verifies the parts the system cannot (visual inspection of container condition, sensory check of material, presence of foreign matter). The system records its checks; the human records theirs; both are bound to the same record. This is the modern standard for dispensing in pharma and supplements.

Not every step needs an IPV. The risk-based selection is part of the MMR design. The classic catalogue of IPV-required steps:

• Dispensing of any raw material into a work-order batch — identity, status, quantity.
• Manual additions to a vessel — the moment the material enters the process.
• Equipment identity at the start of a step — confirming the right reactor, mixer, mill, granulator, packaging line.
• Equipment cleanliness verification at changeover — the previous-product residue check.
• Critical parameter setpoint changes — temperature, pressure, agitation, spray rate.
• Sampling for in-process control — chain of custody from the vessel to the lab.
• Sample-size or fill-weight calibration at the start of a packaging run.
• Label reconciliation at the end of a packaging run.
• Line clearance between batches or between products.
• Disposition of waste, scrap or reject material under controlled-substance or hazardous-waste rules.

For each step, the MMR specifies whether IPV is required, which mode applies, what the verifier is qualified to check, and what the failure path is if verification fails. Steps that do not appear on the catalogue do not require IPV — adding IPVs reflexively to every step creates noise, slows the line, and dilutes the rigour of the IPVs that do matter.

Every IPV record, regardless of mode, must capture the same minimum data set. Missing any one element is a common 483 finding.

A modern IPV is structurally impossible to record incorrectly. The kiosk reads from the calibrated instrument, the verifier identity is captured by a separate badge or biometric, the timestamps come from a synchronised clock, and the record writes atomically to the batch record at sign-off. The operator cannot edit, the verifier cannot back-date, the instrument cannot be substituted.

Pattern that works: structural verification

The MES will not let the operator advance until the verifier signs. The verifier cannot sign without being authenticated. The authentication record is independent of the operator's. The instrument reading is captured directly. None of these depend on operator vigilance — they depend on the workflow design. This is how a modern dispense booth runs.

Pattern that does not work: dual signatures on paper

Two signatures on a paper batch record after the fact. Nothing prevents one person from signing both lines. Nothing prevents the signatures from being added at end of shift. Nothing ties either signature to the moment the step happened. This is the historical pattern that drove the data-integrity guidance and the move to electronic IPV.

Pattern that does not work: 'pull-and-paste' verification

Operator records a balance reading from the printout; verifier compares the BMR entry to the printout. The verification is of the transcription, not of the weighing. The operator could have weighed the wrong material and copied the right number.

Pattern that works: instrument-fed IPV

Balance reading streams directly from the instrument into the IPV record. The operator confirms the entry; the verifier confirms the operator. The IPV verifies the actual measurement, not a transcription of it.

Across published FDA observations, the recurring IPV failure modes are remarkably consistent and remarkably avoidable with a modern eBMR.

• Verifier signature added at end of shift covering all steps performed during shift.
• Verifier was not present at the step — confirmed by interview or by access logs showing the verifier was in a different room.
• Operator and verifier signatures were applied by the same person via shared kiosk login.
• Verifier was not qualified for the step — no training record on the relevant SOP.
• IPV record was edited after sign-off without an audit-trail entry justifying the edit.
• Acceptance criteria were not visible to the verifier — the MMR was on a desk in the supervisor's office.
• Instrument calibration expired before the step but the IPV referenced it as the source.
• IPV record exists on paper but the corresponding entry in the eBMR is blank.
• Step was performed without an IPV because the workflow allowed advance without sign-off.
• IPV mode in the MMR is 'two-person' but only one signature is present in the executed record.

Every ALCOA+ principle has an IPV dimension. Attributable: the verifier identity must be unique and authenticated. Legible: the IPV record must be readable years later, not interpretable only by the original operator. Contemporaneous: the verification timestamp must match the event. Original: the instrument reading must come from the instrument, not a transcription. Accurate: the recorded value must match the measured value. Complete: every required IPV must be present. Consistent: the IPV in the eBMR must match the entry in any parallel system. Enduring: the IPV record must survive its retention period. Available: the record must be retrievable on demand.

A well-designed IPV workflow is the data-integrity programme made operational. A badly-designed IPV workflow is the data-integrity programme rendered into 483 observations.

In V5, IPV is a first-class primitive in the master recipe. Every step carries an IPV requirement (none, one-person system-only, two-person human, or hybrid system-assisted). The kiosk enforces the requirement structurally — an operator cannot advance to the next step until the IPV is satisfied. Identity comes from authenticated kiosk login (badge, biometric or hardware token); instrument readings stream directly from calibrated equipment; the verifier is authenticated separately and must be physically present (the kiosk and the verifier badge reader confirm presence); the IPV record writes to the batch record atomically at signature.

• MMR-driven: the IPV mode is part of the master recipe, not a floor-level convention.
• Instrument-fed: balance, mixer, oven and analytical readings are captured at the source.
• Identity-attributed: every operator and every verifier signature is bound to an authenticated identity.
• Presence-verified: the verifier's badge confirms physical presence in the suite at the moment of sign-off.
• Calibration-aware: an instrument with an expired calibration cannot serve as the source for an IPV.
• Training-gated: a verifier without current training on the relevant SOP cannot sign.
• Audit-trailed: every IPV event writes to an immutable, Part 11-compliant audit trail.
• Exception-routed: a failed IPV opens a deviation, locks the batch, and routes to QA before any further step can run.

• Median delta between operator-action timestamp and verifier-signature timestamp — should be seconds to minutes, not hours.
• Verifier-to-operator ratio — how often the same person verifies the same operator (concentration is a risk signal).
• Failed-IPV rate — too low suggests reflexive signing, too high suggests training gap.
• After-the-fact correction rate on IPV records — should be near zero.
• Cross-suite presence anomalies — verifier signatures recorded when the verifier was elsewhere.