Auditing Process Validation & Developing Protocols


Continue learning
from Rob Packard at OMTEC 2014

OMTEC-2014-Presenter-Badge Web

Have you ever had to perform a process validation protocol for a new piece of equipment or acquired a process that was not properly validated?

If not, consider yourself lucky. However, you can be certain that there is a manufacturing engineer a few cubicles away who still has nightmares about a similar experience. Ideally, new equipment purchases include the purchase of an equipment validation template from the manufacturer—probably at a purchase price of thousands of dollars. Usually, the validation templates are a waste of money and the resulting process validation is inadequate.

How to perform an internal audit or supplier audit of process validation:

Auditing process validation is a logical opportunity for using the process approach to auditing, but most auditors use a checklist. Typically, I see lame questions like this:

1. Did you validate the process?
2. Have you made any changes to the process?
3. Have you moved the equipment?
4. Is the process operating within the validated range?

First of all, all of these questions can be answered with a yes/no response. Even the most experienced auditee is not likely to respond with anything other than the word “yes.” If you are a competent auditor, you will ask for records. For example, a typical completed audit checklist:


What to Look at What to Look for Notes

 820.75 -  process  validation

Validation Protocol
and Report

IQ/OQ/PQ for
automated equipment

Combined IQ/OQ (PV-123-1) was performed at the time of installation and three PQ lots (PV-123-2) were performed at the nominal temperature setting.      

 820.40 -
 control of  documents

Process work instructions and the Device Master Record (DMR)

Changes in the revision history for the process work instructions or the DMR

No process changes are indicated in the work instruction revision history.   

 820.70g -  equipment  and  maintenance

Maintenance records

Location of equipment and non-routine maintenance

The equipment is the same location that is indicated in the validation report.

 820.70b -  production  controls

Device History Record (DHR)

Actual operating range used

Temperature of sealer was set 300F for lot 123. This is the nominal temperature indicated in the DMR.

Here’s how a process audit would be performed. First, the auditor would interview the manufacturing engineer who was responsible for validating the equipment. She would complete a turtle diagram to document the various inputs and outputs of the validation process. The resulting turtle diagram might look like the figure below (if she read last year’s article on Adjacent Link Auditing):


In the auditor’s notes, we would expect details on each of the seven parts of the turtle diagram. This might include the following items:

  • ID# of the thermocouple used to verify temperature of the sealer
  • Equipment ID# for the sealer that was validated
  • Name and title of the operator who ran the equipment for the process validation
  • Equipment maintenance work instruction and operating instructions from the DMR
  • References to peel test data analysis for Tyvek pouches sealed with heat sealer
  • Maximum and Minimum validated pressures, temperatures and dwell times for the sealer
  • Accuracy and precision of the temperature sensor integrated into the sealer

Additionally, we would expect the auditor to have follow-up trails where an operator was interviewed—possibly the same person who performed the original process validation. The auditor should be asking what the operator does at start-up to make sure that the seal is good and to learn what the operator does if the seal is not good. Ideally, the operator can provide examples and should be showing the auditor where these instructions can be found in a controlled document.

Another follow-up trail for the auditor is to interview maintenance personnel to verify that required maintenance has been performed. The auditor would also verify that the equipment has not been moved, or has been revalidated if it was moved. The auditor should also be reviewing calibration records for the sealer and the thermocouple used to calibrate the sealer. During the initial interview of the manufacturing engineer, the auditor may have even asked how low or high the temperature can deviate from the work instruction before the sealer will begin producing weak seals. The engineer should be able to identify this information within the operational qualification (OQ) report.

How to develop a validation protocol:

I frequently receive requests to share a process validation protocol template. The template to which I refer everyone can be downloaded for free from the International Medical Device Regulators Forum (IMDRF). The specific document that I recommend was actually created by the Global Harmonization Task Force (GHTF) about ten years ago, and the guidance documents have been maintained by IMDRF since the GHTF was disbanded. Study Group 3 (SG3) was responsible for creating the guidance document (i.e., GHTF/SG3/N99-10:2004):

This is a 36-page document that was updated (i.e., edition 2) in January 2004. The core of the guidance document is 13 pages, and then there are Appendices. Appendix A provides ten pages of statistical methods and tools for process validation. Appendix B provides examples of process validation protocols for the most common process validation in the medical device industry—heat sealer validation. Examples are available in MS Word and PDF formats. Therefore, you can easily edit the Word version and conduct your own heat sealer validation with minimal time required for protocol writing. The example protocols include:

1. A process validation protocol
2. Installation qualification (IQ) results
3. Operational qualification (OQ) results
4. Performance qualification (PQ) results
5. A final report

If you need a validation protocol for a different type of process, you can start with the basic templates provided in the GHTF guidance document. However, three primary areas need to be reviewed, and will probably change. The first area is the equipment used. Heat sealers are simple machines with three operating parameters: 1) pressure, 2) temperature and 3) dwell time. Some sealers have cooling, vacuum and other features, but automated filling equipment would be an example of equipment that is more complex and that has multiple operations that require validation, including heat sealing. Before writing a protocol, all of the elements of the equipment that require maintenance, adjustment, monitoring and control should be identified. Each element needs to be covered in the IQ at a minimum.

The second area of the protocols to review is the process variables. Anyone writing a new protocol needs to consider which variables are most likely to be adjusted during normal operation and which variables will be the most difficult to control. A heat sealer often has no change to the pressure, temperature is typically a range of 20 degrees Fahrenheit defined by the melting point of plastics being sealed, and the dwell time is dependent upon the amount of insulating material between the heating bars and the plastic layer that is melting. In a filling process there are more machine variables, but the material variation is likely to be greater, as well. For example: fluid viscosity, bulk density, temperature and the effects of shear all vary among lots being filled. Therefore, in order to properly evaluate each of these variables, you must determine which extreme in the anticipated range for each variable will be the “worst-case scenario.” The above material variation explains why a PQ with three different lots is a critical component of process validation. This also explains why the ubiquitous and unexplainably magical quantity of “three” is seldom an adequate sample size. This is why you need statistical methods.

The third area of the protocols that requires review is the product specification. Each product specification affected by a process has a tolerance. Prior to creating an OQ protocol, you want to perform some experimentation to determine which specifications are easily met and which specifications may be difficult for the process to consistently achieve. The most common statistical metric used to evaluate this aspect is the process capability index or Cpk. The recommended approach is to use a process FMEA to evaluate the importance of each specification. The severity of effect for a failure in each of the specifications is probably different. The probability of occurrence can be correlated to the Cpk, and detectability is dependent upon the test method used.

Unfortunately, for processes requiring validation, detectability is often poor. For example, you can’t detect non-sterile products without performing a sterility test, which is destructive. Therefore, overkill methods have been developed to provide sterility assurance that is several orders of magnitude (i.e., SAL = 10-6). For filling operations, weight checks are easily performed in a non-destructive way. If a fill weight is extremely critical, an automated check weight system may even be used. However, your check weight system is another piece of equipment requiring process validation and gage reproducibility, and repeatability (i.e., R&R) is the best practice for validating this type of test method.


For existing processes, make sure that all of your auditors have reviewed the first part of this article so that they understand how to use the process approach to perform value-added audits of process validation. This is important, because validated equipment does not always fail in a way that can be easily detected if the process is not validated properly. If you are installing new equipment, or moving equipment, use this opportunity to review your previous validation methods. If the previous validation methods were not rigorous, review the second part of this article carefully and read through the GHTF guidance document. You might also consider having a validation expert review your IQ/OQ/PQ protocols before implementation.

Robert Packard is a regulatory consultant with 20 years of experience in the medical device, pharmaceutical and biotechnology industries. Robert served in senior management at several medical device companies, including President and CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing and maintaining ISO 13485 and ISO 14971 certification. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE Marking applications, Canadian medical device applications and 510(k) submissions. The most favorite part of his job is training others. He can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..

Medical Device Academy