By the PharmaTradz BD Team. Published October 2026.
In pharmaceutical manufacturing, qualification proves that equipment, facilities and utilities are installed correctly and work as intended, and validation proves that a process, a cleaning method or a computer system consistently gives the right result. Qualification follows a fixed sequence: a URS (user requirement specification) says what is needed, then DQ, IQ, OQ and PQ (design, installation, operational and performance qualification) confirm the design, the installation, the operation and the real-life performance. Process validation, cleaning validation and computerised system validation build on top of that foundation.
For a buyer, validation is where a manufacturer's quality claims become evidence. A site can say it follows GMP; its validation reports show whether it does.
URS, DQ, IQ, OQ and PQ explained
The definitions below follow EU GMP Annex 15 (Qualification and Validation, in force since 1 October 2015) and ICH Q7, the GMP guide for active pharmaceutical ingredients (APIs). Each step is "documented verification": a written protocol with acceptance criteria, executed and signed, then summarised in a report. The example column follows one new fluid-bed dryer for a tablet line.
| Step | Question it answers | Example: a new fluid-bed dryer |
|---|---|---|
| URS (user requirement specification) | What do we need the equipment to do, and which GMP risks must the design control? | Dry a set batch of granules to a target moisture; stainless steel contact parts; easy to clean; alarms and audit trail on the controller |
| DQ (design qualification) | Does the proposed design meet the URS and GMP? | Each URS requirement traced to the supplier's drawings and functional specification before purchase |
| FAT and SAT (factory and site acceptance tests) | Does it work at the supplier's factory, and again on arrival? | Trial run at the supplier; checks repeated after delivery |
| IQ (installation qualification) | Is it installed as designed, with the right parts and documents? | Materials of construction, utilities connections, instrument calibration, manuals and drawings checked |
| OQ (operational qualification) | Does it work across its intended operating range? | Air flow, inlet temperature and alarms tested at upper and lower limits |
| PQ (performance qualification) | Does it perform reliably with real materials under normal conditions? | Repeated runs with production granules, showing the moisture target is met each time |
Annex 15 calls the URS "a point of reference throughout the validation life cycle", which is why a weak URS causes problems at every later step. It also allows IQ and OQ to be combined into a single IOQ where that is justified. Qualification applies to equipment, rooms and utilities such as purified water and HVAC (heating, ventilation and air conditioning); validation applies to processes, cleaning, analytical methods and computerised systems.
The V-model: how the pieces fit
The V-model is the usual way the industry draws this. The left arm of the V runs downwards through the specifications, from the broad URS to the detailed functional and design specifications. The point of the V is the build or installation. The right arm runs upwards through testing, and each test level checks the specification facing it: IQ checks the design specification, OQ checks the functional specification and PQ checks the URS.
The value of the V-model is traceability. Every requirement should be traceable to a test that proved it, usually through a traceability matrix. When an auditor picks a requirement at random, the site should be able to show where it was tested and what the result was.
Process validation: the three stages
The US FDA's guidance Process Validation: General Principles and Practices (January 2011) defines process validation as the collection and evaluation of data, from the process design stage through commercial production, which establishes scientific evidence that a process is capable of consistently delivering quality product. It describes three stages:
- Stage 1, Process Design. The commercial process is defined using knowledge gained in development and scale-up, including which parameters affect quality and how they will be controlled.
- Stage 2, Process Qualification. The design is confirmed at commercial scale. It has two elements: qualification of the facility, equipment and utilities, and the process performance qualification (PPQ), in which commercial-scale batches are made under the approved process. The guidance does not fix a number of batches; the manufacturer must justify its number.
- Stage 3, Continued Process Verification (CPV). During routine production, data are trended to give ongoing assurance that the process stays in a state of control.
EU GMP Annex 15 reaches the same place with different words. It accepts a traditional approach, in which a minimum of three consecutive batches made under routine conditions is generally acceptable but the number must still be justified; continuous process verification, where the process is monitored in real time against a well-developed control strategy; or a hybrid of the two. It then requires ongoing process verification through the product lifecycle. Watch the terms: FDA "continued" process verification is Stage 3, while EU "continuous" process verification is an alternative way of doing the initial validation.
Annex 15 also states that retrospective validation, based only on historical batch records, is no longer acceptable for medicines. ICH Q7 still allows it as an exception for well-established API processes, and uses three consecutive successful production batches as a guide for prospective validation.
Validation is not a one-off event. Any change to equipment, materials, scale or site has to be assessed through change control and may need requalification or revalidation.
Cleaning validation
Cleaning validation proves that a cleaning procedure removes residues of the previous product, cleaning agents and microbes to safe, pre-set limits, so that one product does not contaminate the next. In the US, 21 CFR 211.67 (Equipment cleaning and maintenance) requires written cleaning procedures; in the EU, Annex 15 sets out what the validation must show.
Limits based on health. Annex 15 says carry-over limits should be based on a toxicological evaluation. The EMA's Guideline on setting health based exposure limits for use in risk identification in the manufacture of different medicinal products in shared facilities (adopted November 2014, in effect from 1 June 2015) explains how a toxicologist derives a PDE (permitted daily exposure): a substance-specific daily dose unlikely to cause an adverse effect even if taken every day for a lifetime. The PDE comes from animal or human data, usually the highest dose with no observed adverse effect, adjusted for body weight and divided by a set of safety factors.
MACO (maximum allowable carry-over) turns the PDE into a limit for the equipment. A widely used calculation is: MACO = PDE of the previous product × minimum batch size of the next product ÷ maximum daily dose of the next product.
Worked example. Product A has a PDE of 0.1 mg per day. Product B, made next on the same equipment, has a minimum batch size of 50 kg (50,000,000 mg) and a maximum daily dose of 400 mg. MACO = 0.1 × 50,000,000 ÷ 400 = 12,500 mg, or 12.5 g of Product A across the whole equipment train. If the shared product-contact surface is 20 m² (200,000 cm²), the surface limit is 12,500,000 µg ÷ 200,000 cm² = 62.5 µg/cm². A 25 cm² swab must therefore find no more than about 1,560 µg. Check: a patient taking 400 mg of Product B would receive at most 0.1 mg of Product A, exactly the PDE. Many sites then set a tighter working limit based on what their cleaning actually achieves.
Swab and rinse sampling. A swab wipes a defined area, usually a hard-to-clean spot, and is good at picking up residue stuck to a surface. A rinse sample passes solvent or water over a large or hard-to-reach area such as pipework. Most programmes use both. Annex 15 requires the site to prove its recovery: the method must be shown to pick up a known amount of residue from each surface material sampled.
Worst-case products. Rather than validate every product, a site may group products and validate the hardest case, for example the least soluble, the hardest to clean or the one with the lowest PDE. Annex 15 requires a written scientific rationale for that choice.
Annex 15 adds three points auditors often check. A visual check is part of the acceptance criteria but is not enough on its own. Cleaning and retesting until results pass ("test until clean") is not acceptable. And the site must define its dirty hold time (from end of production to cleaning) and clean hold time (from cleaning to next use).
Computerised system validation in brief
Computerised system validation (CSV) applies the same logic to software that controls production or holds GMP data: tablet press controllers, chromatography data systems, LIMS (laboratory information management systems) and ERP systems. The main references are EU GMP Annex 11 (Computerised Systems), US 21 CFR Part 11 (electronic records and electronic signatures) and the industry guide GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, whose second edition was published by ISPE in July 2022. The second edition stresses critical thinking: effort should match risk to patients and data, and supplier testing should be used where it can be relied upon. CSV is closely tied to data integrity, which our explainer on ALCOA+ covers.
Analytical methods are validated too, following ICH Q2(R2), so that a test result on a certificate of analysis can be trusted.
What buyers should ask a manufacturer for
Few manufacturers will hand over full validation reports, which are confidential and often hundreds of pages long. Most will share summaries, show the reports during an audit, or include key data in a technical package. Ask for these:
- Validation master plan (VMP): the site's overall programme, showing what is qualified and validated, and how often it is reviewed.
- Qualification status of key equipment and utilities on your product's line, including purified water, HVAC and compressed air, with dates of the last requalification.
- Process validation report or PPQ summary for your product: batch size, number of batches, critical parameters and results. Check the validated batch size matches the one you will buy.
- Evidence of ongoing verification: trend data or the latest product quality review (EU) or annual product review (US).
- Cleaning validation summary for shared equipment, with the PDE basis, MACO calculation, worst-case rationale and recovery data. This matters most for potent, hormonal or sensitising products.
- Analytical method validation reports for the release tests on your specification.
- CSV summary for systems that hold batch and laboratory data, including audit-trail review practice.
- Revalidation triggers: how changes are assessed and when revalidation is needed.
A red flag is any answer of "validated" without a document number, a date or a batch size. Another is a process validated at one batch size but sold at another. Our guide on verifying a pharmaceutical supplier lists further checks, and GMP versus cGMP explains the wider framework that validation sits in.
How PharmaTradz can help
Tell us your product, market and batch size, and we will ask manufacturers for their validation and cleaning validation summaries before you commit. Our documentation and quality pack gathers these documents up front, and our CDMO guide hub covers contract manufacturing in more depth. When you are ready, send us an RFQ. For other terms, see our pharma abbreviations A-Z.
Frequently Asked Questions(FAQs)
What is IQ, OQ and PQ in pharma?
They are the three main steps of equipment qualification. Installation qualification (IQ) checks that equipment is installed as designed, operational qualification (OQ) checks that it works across its operating range, and performance qualification (PQ) checks that it performs reliably with real materials under normal conditions.
What is a URS (user requirement specification)?
A URS is the document that sets out what a piece of equipment, facility or system must do and which GMP risks its design must control. EU GMP Annex 15 treats it as the point of reference for the whole qualification, with each requirement later traced to a test.
What are the three stages of process validation?
Under the FDA's 2011 process validation guidance, they are Stage 1 process design, Stage 2 process qualification (including the process performance qualification batches) and Stage 3 continued process verification during routine production.
What is the difference between qualification and validation?
Qualification applies to equipment, facilities and utilities and proves they are installed and work correctly. Validation applies to processes, cleaning, analytical methods and computerised systems and proves they consistently give the intended result.
How are cleaning validation limits calculated?
Limits start from a health-based exposure limit such as the PDE of the previous product. A common calculation is MACO = PDE × minimum batch size of the next product ÷ maximum daily dose of the next product, which is then divided by the shared surface area to give a limit per swab.
