VMPValidation Master Plan

A Validation Master Plan (VMP) is the highest-level validation document at a manufacturing site. Where each system has its own validation pack (URS, FS, DS, IQ, OQ, PQ, RTM), the VMP sits above all of them — listing every validated system, classifying each by GxP risk, identifying the deliverables required, assigning owners, and scheduling periodic review and revalidation.

Annex 15 §2 requires a VMP for every EU GMP site. FDA does not name a 'VMP' explicitly but expects an equivalent governance document under 21 CFR 211 and the 2011 Process Validation guidance. In practice, a single VMP serves both jurisdictions.

1. Validation policy — the site's commitment, scope, and governance structure.
2. Organisational structure — who owns validation, who approves, who executes, how Quality is involved.
3. Inventory of validated systems — every computerised system, manufacturing equipment, lab instrument, utility (water, steam, HVAC) and process within scope.
4. Risk classification — GxP impact (high / medium / low) per item, driving the validation rigour.
5. Validation deliverables matrix — for each item, the URS / DQ / IQ / OQ / PQ / PPQ / CPV documents required.
6. Schedule — initial validation timing, revalidation triggers, periodic review frequency.
7. Change control — how validated state is preserved across upgrades, configuration changes, supplier updates.
8. Acceptance criteria and deviations — what 'validated' means and how exceptions are handled.
9. Training requirements — who must be trained on what.
10. References — links to per-system validation packs, SOPs, and the QMS.

Confusing the two is the most common VMP failure. The VMP says 'V5 Ultimate requires URS, DQ, IQ, OQ, PQ' — it does not BE those documents.

• VMP exists but inventory is out of date — half the listed systems are gone, new systems aren't listed.
• No risk classification — every system treated identically, oversimplifying or overcomplicating.
• Schedule never updated — periodic reviews overdue and there's no evidence anyone noticed.
• Change-control disconnected — system upgrades happen with no link back to the VMP.
• Signed once at creation, never re-signed at annual review.
• No mention of cloud / SaaS supplier qualification under Annex 11 §3 and GAMP 5 supplier audit.

V5 ships a VMP template populated with the V5 platform as a Category 4 GAMP system, including pre-filled risk classification, supplier qualification evidence (V5 SOC 2 / ISO 27001 / supplier audit pack), and the deliverables matrix pointing to the V5 validation pack. The template includes placeholder rows for the customer's other systems (ERP, LIMS, scales, ovens, autoclaves, HVAC) which the customer Quality team extends.