Process Validation (IQ/OQ/PQ) — Medical Device

21 CFR §820.75(a) and ISO 13485 §7.5.6 use almost the same trigger: a process must be validated when the resulting output cannot be fully verified by subsequent inspection and test. The classic examples are sterilization, sealing, welding, injection moulding, cleaning, lyophilization, plasma treatment, software builds, and most aseptic processes — the only way to prove the unit is good is to prove the process that made it is in control.

Where 100% inspection is feasible and economically reasonable, verification under §820.80 is acceptable. The decision must be documented in a verification-vs-validation rationale, usually inside the design transfer package or the DMR. Inspectors and Notified Bodies routinely ask for this rationale by name — a missing rationale is the most common §820.75 observation.

The GHTF guidance — adopted globally and effectively required by FDA and Notified Bodies — structures process validation as three sequential qualifications, each with a clear question.

The three stages must be done in order: PQ on an OQ that has not closed, or OQ on an IQ that has not closed, is a finding waiting to happen because the parameter ranges in PQ are unproven and the equipment baseline is undefined.

Process validation is not a manufacturing-only activity — it is the back half of design transfer (§820.30(h)). The validated process parameters, the acceptance criteria, the sampling plan and the in-process controls all become part of the DMR (§820.181). The DHR (§820.184) then records, per unit or per lot, that those validated parameters were met.

1. Design output specifies the process parameters that have to be controlled (e.g., seal temperature 185 ± 5 °C, dwell 0.4 s, pressure 60 ± 3 psi).
2. The validation master plan (VMP) lists which processes need validation, which need verification, and the rationale.
3. IQ confirms the sealer is installed and calibrated per spec.
4. OQ proves the sealer holds the parameters across the worst-case range (highest line speed, thickest material lot, lowest ambient humidity).
5. PQ runs three production lots through the validated parameter window and shows the seal-strength acceptance criterion is met with the agreed statistical confidence.
6. The DMR locks the validated parameters as the only allowed setpoints; the eDHR captures each unit's actual values; deviations trigger a §820.90 nonconformance investigation.

The most common process-validation failure in FDA Form 483 observations is an OQ that ran the process at the nominal setpoint instead of at the worst-case combination of edges. 'Worst case' means the combination of input variables most likely to cause process or product failure, run within the proposed operating range.

For an ETO sterilization cycle, the worst case is typically the largest, densest, highest-bioburden load at the shortest dwell, lowest temperature, lowest RH and lowest gas concentration the cycle allows. For a sealing process, it is the thickest material at the highest line speed and lowest dwell. The worst-case combination is identified from a risk analysis (ISO 14971) and a process FMEA, not picked by feel.

The 'three consecutive successful lots' convention is not a regulatory requirement — neither §820.75 nor ISO 13485 nor the GHTF guidance specify a number. It is a long-standing inspectional expectation grounded in the statistical argument that three consecutive lots, each independently sampled to a defensible AQL or Cpk, give reasonable assurance that the process is stable batch-to-batch.

Three lots is the floor, not a ceiling. More lots are required when: variability is high relative to the specification (low Cpk), the process has multiple shifts or operators that need to be bracketed, raw-material lots from different suppliers must be covered, or the regulatory submission (e.g., a PMA) commits to a larger number. Continuous-manufacturing processes do not fit the lot-counting model at all and validate against a documented period of stable operation per ICH Q13 principles.

§820.75(c) requires revalidation 'when changes or process deviations occur'. The QMSR / ISO 13485 §7.5.6 wording is similar. A documented revalidation matrix tied to change control (§820.40 / §820.70) is the standard way to manage this. Typical triggers:

• Change to equipment, software or firmware that affects a critical process parameter
• Change to the manufacturing site, layout or utility supply
• Change to a critical raw material, supplier, or specification
• Change to the validated operating range (extension beyond OQ-proven edges)
• A CAPA root-cause finding that the process is not in the validated state
• A trend signal from continued process verification (Cpk drift, SPC rule breach) sustained over a defined window
• Periodic review interval reached (commonly 2–5 years depending on risk class)

Continued process verification — Stage 3 in the FDA lifecycle model and the implicit expectation under ISO 13485 §8.2.5 / §8.2.6 — is what catches drift between full revalidations. Live SPC against the validated parameters, with a documented escalation path when a Western Electric or Nelson rule fires, is the modern minimum.

Software used as part of the production process — PLC code, SCADA, MES, eDHR, ERP MRP — falls under §820.70(i) and must be validated for its intended use. This is not the same as IEC 62304 (which covers software that is part of the device); §820.70(i) covers software in the quality system and manufacturing line.

The expected evidence is a risk-based validation per GAMP 5 categories: URS, FRS, IQ/OQ at the software level, leveraged supplier documentation where the vendor's quality is demonstrably adequate, and a defined revalidation trigger on each release. QMSR keeps this requirement intact — it is one of the few QSR clauses ISO 13485 does not fully cover, so the FDA preamble explicitly retains it.