Validation: It's a process, not a project

By Jan Eudy

Validation in the biopharmaceutical manufacturing world is the establishment of documented evidence. The data derived from rigorous testing, which results in a high degree of assurance that a specific process or system will consistently meet a predetermined specification or set of quality attributes, is the documented evidence required for validation. The validated process creates a validated product.

Why validate?

The U.S. Food and Drug Administration (FDA) has mandated validation to ensure that all of the systems have a consistent high level of assurance to produce a product that consistently meets its pre-designed specifications. This gives a biotech company a control system that is consistent and reproducible. Further, a validated process is credible and stable because the acceptance criteria have already been specified in the qualification stages of validation.

If the specifications of the system—how it is designed and how it is to operate—are known, then it becomes possible to maximize the performance of that system. If validation is performed properly and with the right objectives, it can be a value-added process for the company.

Who is responsible?

The FDA has stated that the facility using the system is totally responsible for validating the system. The site management team may either write its own protocols and perform its own testing, or it may contract with qualified outside validation firms to perform these services for them.

If an outside firm is contracted to perform these services, the facility using that system is still responsible for assigning personnel to review and approve the protocols. Further, the facility is still responsible for executing the test procedures and the validation processes, while assuring the protocols were designed to validate what is actually performed at their facility, under their control. Employees who perform the validation have ownership of the equipment and the process.

What does validation involve?

Validation is a multi-disciplined process consisting of the installation qualification (IQ), operation qualification (OQ), performance qualification (PQ) and change control. The entire process is mapped in the master plan (See Figure 1).

The project, or overview of the validation process, is the master plan for the validation process. Once there is an overview, then the validation protocol is written. The validation protocol consists of the design validation, a specific set of test procedures and their acceptance criteria for each of the systems being validated and for the specifications that are required over the whole project.

Once the validation master plan has been prepared, and during the preparation of the validation protocol, an assignment of responsible parties is determined:

• The installation qualification is defined. These are specifications that must be achieved during the installation phase of the project.
• The operation qualification is defined. These are all the operation specifications that must be met to assure that everything is going to operate as planned.
• The performance qualification specifications are prepared. This is taking all the information derived from the installation qualification and operation qualification and assuring that all the systems consistently perform as specified.
• Change control is defined. These are the steps to be taken if any changes are required during the validation process.

In all of these phases, standard operating procedures (SOPs) are prepared and serve as the blueprint to perform each of the qualifications. These SOPs are contained in each of the phase method sections. A change control process is used if any part of these results fails to meet the required specifications or to make a change to either the specification or the system. The change control is also outlined in the SOP in the corrective action section.

Work the validation master plan

There are several components of the validation master plan, and it's imperative that the master plan be written before executing the validation process; otherwise, the validation can be partially completed, and bits of information that are important can be lost.

A validation master plan consists of all the steps involved in the entire life cycle of the validation. It will also designate responsibility and authority as far as who is authorized to approve changes in the process of validating the cleanroom. It will define the project purpose, scope and definitions so that all the individuals working on the validation team are proceeding with the same directions, talking about the same pieces of equipment and working on the same process.

Also defined in the master plan are specifications that are to be distributed to vendors and documentation required to prove the systems and equipment meet the end-user-specified requirements. The SOPs, in their entirety, become part of the master plan. These SOPs may become a separate volume that will be used on a continuing basis after the validation has been completed to prevent deviations from the validated program.

Within the master plan protocol is the full life cycle, including schedules, deliverables, due dates and responsibility and authority designations. A vendor audit protocol should be part of the validation process in the design specification portion of the master plan.

The SOPs should be specific to the system and equipment being used because they will become the method of determining how the system should be monitored once it's in place. They should be written clearly and concisely to be understood by everyone involved in validating the system.

Vendors are required to provide a complete documentation package, including certificates of conformance on any of the specifications that are required. Prior to the start of specific validation testing, the necessary calibrations should be performed using National Institute of Standards and Testing (NIST)-traceable standards.

Flow diagrams and specifications, when documented, are good ways of looking at the entire process and product flow. The validation protocol should outline each of the different steps used in the validation process. This will clarify that as one part of the process is completed and the next is begun, a different benchmark becomes the target.

Developing a validation protocol

While there are different types of validation, the most frequently used is called a prospective validation. It's a validation that is planned and initiated at the beginning of the implementation of any new instrumentation, equipment, process or system. It is the easiest type of validation to perform because there is total control of the validation process from the beginning.

The first step is to determine the scope of the validation, for example, machinery versus systems. This includes evaluating the vendors and their capabilities to meet all the requirements within the scope of the validation, including supporting systems such as HVAC systems, electrical systems and purified water systems.

The manufacturer of each of these components is responsible for providing documentation regarding a particular system and its compatibility and its suitability for its intended use. The manufacturer is also responsible for any quality testing and should provide installation instructions, operating parameters and technical support.

This should be specified as part of the parameters in the purchase agreement with the manufacturer. The documentation package is the verification of conformance that is requested from the manufacturer.

After documentation is received from vendors of equipment and for systems installed by contractors, a facility develops specific SOPs for the operation of those systems. The manufacturer should provide adequate training for personnel to operate the system, including preventive and corrective maintenance. The facility is responsible for selecting the appropriate personnel and assigning specific responsibilities to each member of the validation team. These members have been designated in the writing of the validation protocol and are given appropriate responsibilities and authority.

When the written validation protocol and test procedures are developed and approved, the actual testing is performed as outlined in the protocol. It's performed as stipulated in the protocols, with each step being fully documented. All results are verified by a "second-party" to assure that (a) the test results are correct and within the specifications, and (b) that the test results are what was expected during this validation process.

Test procedures

These tests must show not only the responses under ideal conditions, but simulated worst-case scenarios as well. Ideal operating conditions should be defined and then adverse conditions addressed in a disaster prevention/response/recovery plan in case of a partial or total failure of the process or system.

Should there be a process or system failure, this plan defines the procedures to bring the process or system back in line and to assure it operates within the previously required specifications.

Once these test procedures are written and the specifications defined, alert and action parameters are established to set the limits of the system's capabilities. This will ensure that when the process deviates from normal operating ranges and trends towards upper or lower limits, the operator can take corrective action.

Responsibility and authority

Prior to the execution of the validation protocol, all operators should be trained in procedures for operating the system, including specific goals and objectives. The parties responsible for validation are identified and recorded in the validation master plan.

The qualifications of the personnel that are to perform the validation process are defined. Documentation that the selected personnel meet these qualifications and completed training in an effective manner is retained in training files.

It's imperative to remember that the core of the validation master plan is the execution of the IQ, OQ and PQ.

The IQ documents that all equipment, control loops and devices are installed and functioning as specified. This includes any computerized hardware and software that control the installed equipment. The steps of IQ include ensuring that the equipment complies with the design specifications and a certificate of conformance accompanies the equipment or components of the systems.

The IQ documentation consists of a series of verification checklists (see Figure 2) and forms, electrical schematics and equipment manuals. An audit of the installed system is performed to confirm that the system installed meets the intended specifications.

The OQ documents that each piece of equipment and its control system used in the process is performing within specified parameters. The OQ starts after the installed system has been thoroughly audited and deemed operational (see Figure 3).

Completion of the OQ ensures that all the installed equipment and processes operate as designed. It proves that all the alert and action limits and system tracking mechanisms designed into the system by the manufacturer are in place and functioning as specified.

The PQ starts as the system begins commercial operation (see Figure 4). The PQ documents that the entire system can operate consistently and will produce a product meeting the predetermined specifications of the facility.

Even though it has been established that all components of the system have been installed according to the installation specifications and that they operate according to manufacturer specifications, it is still uncertain that the system is robust and will function consistently over time.

Performance qualification puts the entire cycle of the process together to validate that it produces consistently according to specifications. The PQ also ensures that the equipment and personnel are adequately monitoring, sampling and testing the product and process.

Change control

During the validation process, changes may be required. Change control is the procedure to provide documented evidence of any change that has been performed. Once it is determined that a change is required, the change is documented and implemented. After implementation of the change, the changed process must be revalidated.

Revalidation starts at the beginning and continues through the entire validation life cycle of the process, reviewing the effects of the change on the previously documented IQ, OQ and PQ results.

The summary report

Once all the documentation is accumulated from the IQ, OQ and PQ, a summary report is prepared.

This completes the validation master plan. It consists of a summation of the life cycle that has been outlined in the validation protocol, documentation of the testing and verification of the test data. Once data is compiled and verified, statistical analysis is performed on the data and included in the summary report.

The concluded validation process is a documented and verified record of the installation, operation and performance of a manufacturing system, which was defined in the validation master plan.

The execution of the validation process defines the normal operating functions, provides documented procedures to evaluate the system and allows preventive and corrective actions to be executed in "worst-case scenarios." lll

Jan Eudy is corporate quality assurance manager, Cintas Cleanroom Resources (Cincinnati), IEST's technical vice president of contamination control and a member of the CleanRooms Editorial Advisory Board. She can be reached at EudyJ@cintas.com.

Execution of validation plan

The core of the validation master plan is the execution of the installation qualification (IQ), operation qualification (OQ) and performance qualification (PQ).

If an outside firm is contracted to perform these services, the facility using that system is still responsible for assigning personnel to review and approve the protocols.