FOR MEDICAL DEVICE, IVD & PHARMACEUTICAL MANUFACTURERS
VALIDATION
Validation provides documented evidence that products, processes, methods, equipment, and computerised systems perform consistently for their intended purposes. Medical device, IVD, and pharmaceutical manufacturers must identify and validate activities required by their products, risks, processes, and markets. Applicable frameworks include ISO 13485, the QMSR, 21 CFR Parts 11, 210, and 211, and recognised technical standards. Requirements differ according to intended use, product classification, sterility, software, manufacturing technology, and regulatory commitments. Therefore, no organisation needs every validation activity described on this page. A risk-based validation programme should define responsibilities, protocols, acceptance criteria, deviations, approvals, monitoring, and revalidation triggers. FDA Consulting can help manufacturers evaluate process, software, cleaning, analytical, packaging, sterilisation, and equipment qualification needs. An FDA mock inspection can then assess whether validation records provide credible evidence of continued control throughout the product lifecycle. Evidence must remain complete, traceable, and current.
Why Validation?
Final inspection and testing cannot always confirm every critical quality attribute. Some tests destroy the product, sample only part of a batch, or detect problems too late. Other results depend on software, analytical methods, equipment, or processes that require prior evidence of accuracy. Validation provides documented, objective evidence that an activity can consistently achieve its intended results. Examples include identity, strength, purity, performance, data integrity, sterility, measurement accuracy, and package integrity.
For device manufacturers, the QMSR incorporates ISO 13485:2016. Clause 7.5.6 requires process validation when subsequent monitoring or measurement cannot, or does not, verify the output.
Drug CGMP requires scientifically controlled manufacturing. The FDA’s Process Validation guidance recommends a lifecycle approach covering design, qualification, and continued verification.
FDA Consulting can help determine whether an activity requires validation or verification. A Mock FDA Inspection can assess whether records demonstrate continued control. The manufacturer retains responsibility for all validation decisions.
Medical Device Process Validation
Medical device process validation establishes objective evidence that a production process can consistently achieve its planned results. Under the QMSR, finished device manufacturers must follow ISO 13485:2016 requirements, including Clause 7.5.6. Validation becomes necessary when subsequent monitoring or measurement cannot fully verify the process output. Common examples include moulding, welding, bonding, coating, automated assembly, software installation, packaging, sterilisation, and specialised supplier processes. The manufacturer should define critical inputs, operating parameters, acceptance criteria, sampling, responsibilities, and revalidation triggers before execution. Protocols must reflect product risk, process complexity, and available scientific knowledge. Successful results support routine production but do not remove ongoing monitoring duties. FDA Consulting can help assess validation scope, review protocols, and identify evidence gaps. A Mock FDA Inspection can trace records from requirements through execution, deviations, approval, and continued monitoring. The manufacturer retains responsibility for process suitability and compliance.
When Process Validation Is Required
Process validation applies when inspection or testing cannot fully confirm the resulting device output. It also applies when defects may appear only during use or after service delivery. Manufacturers should assess each process using intended use, risk, detectability, variability, and available controls. Special processes commonly include sterilisation, sealing, moulding, welding, coating, bonding, automated assembly, and selected software-controlled operations. A capable final test does not automatically remove validation obligations when sampling cannot detect all failures. FDA Consulting can support a documented, risk-based applicability assessment. A Mock FDA Inspection can test whether the rationale matches actual operations, controls, records, and product risks.
Planning and Executing Process Validation
A validation plan should define the process, product family, equipment, operators, materials, utilities, and expected operating ranges. Approved protocols should identify responsibilities, test methods, sampling, statistical rationale, acceptance criteria, and deviation handling. Industry practice commonly confirms installation and operational suitability before performance qualification under routine conditions. Worst-case challenges should reflect credible risks rather than arbitrary extremes. Execution must follow the approved protocol and preserve original data. Any deviation requires documented evaluation before approval. FDA Consulting can review the scientific rationale and protocol design. A Mock FDA Inspection can examine traceability between risks, parameters, results, deviations, conclusions, and final authorised release.
Continued Monitoring and Revalidation
Validation does not end when the final report receives approval. Routine monitoring should confirm that parameters, outputs, and variability remain within established limits. Manufacturers should trend deviations, nonconformities, complaints, maintenance, yield, and process capability. Changes to equipment, software, materials, suppliers, facilities, methods, or operating ranges require documented impact assessment. Revalidation may become necessary when changes affect validated status or evidence indicates declining control. Periodic review should follow risk and procedure, not an unsupported calendar alone. FDA Consulting can assess continued validation evidence and related change controls. A Mock FDA Inspection can evaluate whether monitoring data supports the current validated state.
Supplier and Outsourced Process Validation
Manufacturers remain responsible when suppliers perform validated processes on their behalf. Supplier controls should reflect process risk, technical complexity, detectability, and the supplier’s demonstrated capability. Agreements should define specifications, validation responsibilities, change notification, records, monitoring, and access to relevant evidence. The manufacturer should review validation before approving the supplier or process for routine production. Ongoing controls may include audits, performance measures, incoming verification, certificates, and periodic review. FDA Consulting can assess whether outsourced process controls remain proportionate and documented. A Mock FDA Inspection can trace supplier qualification, validation evidence, purchasing controls, changes, nonconformities, and direct management oversight across the quality system.
Pharmaceutical Process Validation
Pharmaceutical process validation establishes scientific evidence that a process can consistently produce drug products meeting predetermined quality attributes. 21 CFR Parts 210 and 211 contain enforceable CGMP requirements for manufacturing, laboratory testing, equipment, records, and quality-unit oversight. The Agency’s Process Validation guidance recommends a lifecycle approach rather than a single qualification exercise. Its three stages cover process design, process qualification, and continued process verification. Manufacturers should understand variability, identify critical material attributes and process parameters, establish controls, and analyse routine performance. Validation scope should reflect risk, dosage form, manufacturing technology, scale, and process knowledge. Protocols need predefined acceptance criteria and scientifically justified sampling. FDA Consulting can support strategy, protocol review, statistics, and remediation. A Mock FDA Inspection can examine whether development knowledge, qualification evidence, deviations, approvals, and commercial data remain connected. The manufacturer retains responsibility for validation and CGMP compliance.
Stage 1: Process Design
Process design converts development and scale-up knowledge into a defined commercial manufacturing process. Teams should understand sources of variability and their effects on critical quality attributes. Studies may evaluate materials, equipment, unit operations, operating ranges, hold times, and control strategies. Risk assessment supports priorities but cannot replace experimental evidence or sound science. The resulting knowledge should justify process parameters, in-process controls, specifications, and monitoring plans. FDA Consulting can review development evidence and identify unsupported assumptions before qualification begins. A Mock FDA Inspection can trace whether the proposed commercial process reflects actual studies, documented decisions, risk assessments, and approved manufacturing instructions.
Stage 2: Process Qualification
Process qualification confirms that qualified facilities, utilities, equipment, personnel, and the commercial process can support reproducible manufacturing. Equipment qualification should establish installation and operational suitability before process performance qualification, when appropriate. PPQ protocols should define manufacturing conditions, sampling locations, test frequency, statistical rationale, acceptance criteria, and deviation handling. Runs should represent routine conditions and challenge justified operating ranges without creating artificial risks. The quality unit should approve protocols and reports through established procedures. FDA Consulting can review qualification strategy, PPQ design, and statistical support. A Mock FDA Inspection can examine raw data, deviations, investigations, traceability, approvals, and batch disposition decisions.
Stage 3: Continued Process Verification
Continued process verification uses routine production data to confirm that the process remains in a state of control. Manufacturers should monitor critical parameters, quality attributes, yields, deviations, complaints, stability results, and other relevant indicators. Statistical methods should detect shifts, trends, and increasing variability before product quality deteriorates. Review frequency should reflect process risk, manufacturing volume, and accumulated knowledge. Findings may require investigation, CAPA, process improvement, or revalidation. FDA Consulting can help establish practical monitoring plans and interpret emerging trends. A Mock FDA Inspection can assess whether commercial data supports conclusions, management review, change control, and continued confidence in process performance.
Change Control and Revalidation
Process changes require a documented evaluation before implementation. The assessment should consider materials, formulation, equipment, facilities, utilities, software, scale, suppliers, methods, and operating ranges. Teams must evaluate potential effects on validated status, regulatory filings, product quality, stability, and patient risk. Not every change requires complete revalidation, but every relevant change needs a justified decision. Adverse trends, repeated deviations, maintenance, or extended shutdowns may also trigger additional qualification. FDA Consulting can review change assessments and proposed risk-based validation scope. A Mock FDA Inspection can trace whether changes received appropriate evaluation, testing, approval, controlled implementation, effectiveness review, and regulatory reporting when required.
IVD Analytical and Clinical Performance Validation
Under the QMSR, IVD manufacturers must maintain documented evidence that tests perform as intended for users, specimens, populations, and settings. Analytical studies may address accuracy, precision, measuring range, linearity, analytical sensitivity, specificity, interference, cross-reactivity, and carryover. Not every characteristic applies to every assay. Clinical studies should support the claimed intended use and may evaluate clinical sensitivity, clinical specificity, agreement, cut-offs, or other suitable measures. Study design must reflect the target population, reference method, clinical spectrum, user type, and testing environment. The Agency expects valid data and statistical analysis supporting performance claims. ISO 20916 provides good-study-practice principles for clinical performance studies. FDA Consulting can review study plans, protocols, acceptance criteria, and evidence gaps. A Mock FDA Inspection can assess whether source data, deviations, analyses, conclusions, and claims remain traceable and consistent. The manufacturer retains responsibility for study validity and regulatory submissions.
Computer System Validation and Software Assurance
Computer system validation and software assurance establish confidence that regulated systems perform their intended functions and protect product quality and data integrity. The required approach depends on system use, risk, records, electronic signatures, and applicable predicate rules. The QMSR incorporates ISO 13485 requirements for device and IVD software used in quality management, production, and monitoring activities. The Agency’s 2026 Computer Software Assurance guidance recommends risk-based assurance for production and QMS software. Pharmaceutical manufacturers must address applicable 21 CFR Part 211 and Part 11 controls. Risk-based testing may cover requirements, configuration, access, calculations, interfaces, audit trails, migration, backup, recovery, and change control. FDA Consulting can help classify systems, assess risk, and review assurance evidence. A Mock FDA Inspection can trace intended use through testing, deviations, approval, operation, and changes. The manufacturer remains responsible for system fitness, record integrity, security, and compliance.
Cleaning Validation
Cleaning validation demonstrates that established procedures consistently remove relevant product residues, cleaning agents, microorganisms, or other contaminants to justified limits. For drug manufacturers, 21 CFR 211.67 requires appropriate equipment cleaning and maintenance. Agency materials explain that cleaning programmes should prevent contamination affecting safety, identity, strength, quality, or purity. Device and IVD manufacturers should apply QMSR process-validation requirements when verification cannot adequately confirm cleaning results. Validation should address equipment design, materials, product families, worst cases, cleaning methods, sampling locations, recovery, analytical methods, dirty hold times, and clean hold times. Acceptance limits require scientific and risk-based justification; no universal residue limit fits every operation. FDA Consulting can review strategy, protocols, methods, and continued monitoring. A Mock FDA Inspection can trace cleaning records, deviations, changes, and evidence supporting routine effectiveness. The manufacturer remains responsible for preventing cross-contamination and maintaining validated control over time.
Analytical Method Validation
Analytical method validation demonstrates that a procedure is fit for its intended purpose and produces reliable results. For pharmaceutical manufacturers, 21 CFR 211.165(e) requires documented accuracy, sensitivity, specificity, and reproducibility when applicable. ICH Q2(R2) provides guidance for selecting validation characteristics, including specificity, accuracy, precision, range, detection limit, quantitation limit, and robustness. Not every characteristic applies to every method. Compendial procedures generally require documented verification of suitability under actual conditions rather than full revalidation. Under the QMSR, device and IVD manufacturers should establish evidence for methods supporting product acceptance, process monitoring, and performance claims. Protocols should define intended use, samples, reference materials, equipment, calculations, acceptance criteria, statistics, and deviation handling. FDA Consulting can review strategy, transfer, verification, and controls. A Mock FDA Inspection can trace raw data, calculations, approvals, changes, and results. The manufacturer remains responsible for method suitability and compliance.
Sterilisation and Aseptic Process Validation
Sterilisation and aseptic process validation establish evidence that controlled operations can achieve specified sterility or contamination-control requirements. Under the QMSR, device and IVD manufacturers must apply ISO 13485:2016 requirements for sterilisation and sterile barrier processes when applicable. Drug CGMP under 21 CFR 211.113(b) requires validation of aseptic and sterilisation processes for products purporting to be sterile. Validation scope depends on product design, materials, bioburden, packaging, load configuration, processing method, and intended sterility assurance. Common technologies include ethylene oxide, electron beam, gamma radiation, moist heat, and other justified methods. Aseptic processing requires different controls because the product does not undergo terminal sterilisation. FDA Consulting can review cycle development, qualification, microbiological evidence, and routine controls. A Mock FDA Inspection can examine traceability across risks, protocols, deviations, release, and revalidation. Manufacturers remain responsible for method selection, validated control, worker safety, and regulatory compliance.
Ethylene Oxide (EtO) Sterilisation
Ethylene oxide sterilisation suits many heat-sensitive or moisture-sensitive medical devices, but validation must address the entire process lifecycle. ISO 11135 covers development, validation, and routine control for medical devices. Studies commonly evaluate preconditioning, humidity, gas concentration, temperature, exposure, load configuration, aeration, microbiological performance, and residuals. Product and packaging functionality must remain acceptable after processing. Manufacturers should justify product families, process challenges, biological indicators, and documented release criteria. FDA Consulting can review cycle rationale, qualification evidence, residual evaluations, and change controls. A Mock FDA Inspection can trace whether routine records remain consistent with validated parameters, approved loads, deviations, and requalification requirements.
Electron-Beam Sterilisation
Electron-beam sterilisation uses accelerated electrons to deliver ionising radiation over short processing times. ISO 11137-1 covers development, validation, and routine control of radiation sterilisation for medical devices. Validation should address sterilisation dose establishment, dose mapping, dosimetry, product density, orientation, load configuration, bioburden, packaging, and material compatibility. Electron penetration depends on energy, product thickness, and density, so load design requires particular attention. Routine monitoring must confirm the delivered dose within validated limits. FDA Consulting can review dose studies, equipment qualification, product families, and transfer assessments. A Mock FDA Inspection can examine dosimetry records, deviations, batch release, change control, and periodic dose verification.
Gamma Radiation Sterilisation
Gamma sterilisation commonly uses cobalt-60 to deliver deeply penetrating ionising radiation to packaged medical devices. ISO 11137-1 governs development, validation, and routine control of applicable radiation processes. Validation should establish the sterilisation dose and map minimum and maximum absorbed doses throughout representative loads. Studies must consider product density, orientation, packaging, bioburden, material compatibility, functionality, and ageing effects. Routine dosimetry confirms that processed loads remain within validated dose limits. FDA Consulting can review dose establishment, product grouping, mapping, qualification, and change assessments. A Mock FDA Inspection can trace dosimetry, load records, deviations, release decisions, periodic dose audits, and continuing process control.
Aseptic Process Validation
Aseptic processing controls contamination while sterile components, containers, closures, and product move through critical operations. It does not terminally sterilise the finished product. Under 21 CFR 211.113(b), manufacturers must validate aseptic and sterilisation processes for sterile drug products. Validation commonly includes facility and equipment qualification, sterilising filtration, personnel qualification, environmental monitoring, interventions, and aseptic process simulations. Media fills should represent routine and challenging conditions without creating artificial practices. FDA Consulting can review simulation design, intervention coverage, contamination investigations, and corrective actions. A Mock FDA Inspection can examine media-fill records, operator participation, environmental data, deviations, sterility assurance, and continued programme effectiveness.
Packaging and Seal Process Validation
Packaging and seal process validation establishes evidence that packaging operations consistently protect product quality, integrity, and, where applicable, sterility. Under the QMSR, device and IVD manufacturers must validate applicable sterile barrier processes under ISO 13485. ISO 11607-2 addresses validation of forming, sealing, and assembly processes for terminally sterilised medical devices. Pharmaceutical manufacturers must meet container, closure, packaging, and labelling controls under 21 CFR Part 211. Validation may evaluate equipment qualification, seal temperature, pressure, dwell time, line speed, material variation, seal strength, package integrity, and visual defects. Distribution simulation and ageing studies can support a scientifically justified shelf life. Worst-case configurations should reflect credible production conditions. FDA Consulting can review protocols, sampling, methods, and acceptance criteria. A Mock FDA Inspection can trace packaging specifications, data, deviations, changes, release decisions, and revalidation. The manufacturer remains responsible for validated control and package suitability.
Additional Validation and Qualification Services
In addition to the areas above, CIRG supports other validation and qualification activities for pharmaceutical, device, and IVD manufacturers. Services may include equipment qualification, facility qualification, cleanroom qualification, HVAC qualification, water-system validation, utility qualification, and temperature mapping. We can also review shipping, cold-chain, hold-time, shelf-life, stability, container-closure integrity, and distribution studies. Medical device projects may require design validation, usability engineering, biocompatibility evaluation, software validation, cybersecurity testing, or clinical evidence review. IVD programmes may include reagent stability, specimen stability, metrological traceability, lot comparability, and reference-interval studies. Applicable scope depends on intended use, product risk, technology, process, claims, and target markets. FDA Consulting can help determine which activities require validation, verification, qualification, or documented justification. A Mock FDA Inspection can test whether the supporting evidence remains complete, traceable, and current. The manufacturer retains responsibility for all technical conclusions, approvals, and regulatory compliance.
Contact CIRG when validation questions require an independent, experienced perspective. Our FDA Consulting specialists can assess protocols, reports, deviations, and lifecycle controls across regulated systems. A Mock FDA Inspection can also test readiness and identify evidence gaps. We provide recommendations while your organisation retains responsibility for compliance decisions and approvals.