FDA 21 CFR §211.63 requires documented evidence that pharmaceutical manufacturing equipment is properly installed, operates within defined parameters, and performs its intended function reproducibly under production conditions. The structured three-stage approach — Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) — is how that evidence is generated and retained. Skipping any stage, or executing tests before the protocol is approved, converts acceptable results into a compliance liability. Sign in to OxMaint to manage IQ/OQ/PQ protocols, requalification schedules, and 21 CFR Part 11-compliant electronic records — or book a demo to see qualification workflows configured for your regulated facility.
GMP Compliance / Pharma Validation
Equipment Qualification IQ/OQ/PQ: Pharmaceutical Validation Guide
IQ, OQ, PQ protocol requirements, documentation standards, requalification triggers, and FDA expectations — the essential framework for regulated pharmaceutical manufacturing.
211.63
Primary CFR basis — equipment must be demonstrated suitable for GMP use before production
DQ→PQ
4-stage lifecycle — no stage may be skipped or retroactively documented
3 runs
Minimum consecutive PQ runs — each must meet pre-defined acceptance criteria independently
Part 11
Electronic qualification records require audit trail, e-signatures, and validated system
The 4 Stages — At a Glance
What Each Qualification Stage Requires and Generates
Each stage builds on the prior. PQ cannot begin until OQ is complete and all OQ deviations are closed. Book a demo to see OxMaint's sequential stage gating and protocol approval enforcement.
| Stage | Question Answered | Timing | Key Protocol Elements | Output Document |
|---|---|---|---|---|
| DQ — Design Qualification | Does the equipment design meet the User Requirements Specification? | Before procurement — gates the purchase decision | URS traceability matrix; vendor assessment; material compatibility; FAT plan | Approved DQ report; FAT report; vendor qualification dossier |
| IQ — Installation Qualification | Was the equipment installed exactly as specified? | At physical installation on the GMP site — one-time | Serial/model vs. purchase order; utility connections vs. P&ID; instrument calibration certificates; documentation collection | Approved IQ report; calibration certificates; as-built P&IDs; spare parts register entered in CMMS |
| OQ — Operational Qualification | Does the equipment function correctly across its full operating range? | After IQ approval — without product | High/low/nominal parameter testing; alarm and interlock testing; worst-case conditions; repeatability over multiple cycles | Approved OQ report; validated operating range; all OQ deviations closed before PQ |
| PQ — Performance Qualification | Does the process consistently produce a compliant product? | After OQ approval — with actual product at production scale | Actual product; production-scale sampling plan; minimum 3 consecutive runs; statistically justified acceptance criteria; validated analytical methods | Approved PQ report; approved production SOP; first GMP batch authorised |
Documentation Rules
The Three Rules That Determine Inspection Outcome
FDA investigators do not evaluate whether maintenance was adequate. They evaluate whether records prove it was performed correctly, with pre-defined criteria, by a qualified person. These three rules determine compliance at audit time. Sign in to OxMaint to enforce all three automatically through the qualification workflow.
01
Protocol Approved Before Any Testing Begins
Acceptance criteria must be pre-defined and Quality-unit-approved before the first test is executed. Retroactive acceptance — filling in criteria after seeing results — is a data integrity violation regardless of whether results are acceptable. OxMaint locks acceptance criteria fields after protocol approval and blocks execution access until approval is confirmed.
02
All Results Recorded Contemporaneously (ALCOA+)
Every test result must be captured at the time of execution — Attributable, Legible, Contemporaneous, Original, and Accurate. Results transcribed from scratch paper after the fact, or reconstructed from memory, are not ALCOA-compliant. System-generated printouts and electronic records are preferred over manual transcription. All raw data must be retained with the qualification report.
03
Every Deviation Formally Documented and Closed
Any result that does not meet its pre-defined acceptance criterion is a deviation — regardless of magnitude. Deviations must capture the actual result, the criterion, an impact assessment, root cause, and corrective action. All OQ deviations must be formally closed with Quality approval before PQ begins. Deviations erased, overwritten, or left undocumented are the most common cause of data integrity findings. Book a demo to see OxMaint's deviation workflow.
Requalification
When Requalification Is Required — Triggers and Scope
Initial qualification establishes the validated state. Maintaining it requires a written requalification policy that pre-defines scope for each trigger type — before the trigger event occurs, not after. Sign in to configure requalification triggers and automatic work order generation in OxMaint.
| Trigger Event | Requalification Scope | Steel Plant Example | CMMS Action |
|---|---|---|---|
| Physical relocation | Full IQ → OQ → PQ | Moving a tablet press to a new manufacturing room | Requalification work order; new IQ protocol issued |
| Major mechanical modification | Full IQ → OQ → PQ | Replacement of control system, new drive, major component change | Change control linked to requalification work order |
| Software version upgrade | Partial OQ (control-dependent parameters) | Firmware update affecting dosing or temperature control logic | Software change record; OQ re-test protocol generated |
| Critical component replacement | Partial OQ or PQ (impact-dependent) | Control module, sensor, pump head — performance-affecting parts | Maintenance work order with requalification scope field |
| Out-of-tolerance calibration | OQ re-test of dependent parameters | Critical temperature sensor found 3°C out of tolerance in use | OOT investigation; batch impact assessment; OQ re-test |
| Periodic review (scheduled) | Annual data review — no new testing if trending nominal | All critical equipment — annual performance data analysis | Scheduled annual review work order; trend report generated |
| New product or new process | PQ required for new product/process combination | Introducing a new formulation outside validated operating range | New PQ protocol; prior OQ confirmed still current |
The most consistent qualification finding I reviewed as an FDA investigator was not a failure to test — it was acceptance criteria filled in after results were known, in the same ink and handwriting as the result itself. The investigator cannot distinguish pre-defined acceptance from post-hoc rationalisation. This failure mode is entirely structural: if the protocol is not approved before testing begins, the acceptance criteria have no integrity. CMMS-enforced qualification workflows that lock acceptance criteria at protocol approval and block test execution until approval is confirmed eliminate this finding category. Without that structural control, it exists in every manual qualification programme, waiting to be found.
OxMaint Qualification Management
How OxMaint Manages the Full IQ/OQ/PQ Lifecycle
Stage Gate
Sequential Stage Enforcement
OQ access blocked until IQ report is approved. PQ access blocked until OQ is approved and all deviations closed. System-enforced — not reliant on procedural discipline. Sign in to activate stage gating.
Part 11
21 CFR Part 11 Records
Immutable audit trail, dual-component electronic signatures, access controls by role, computer-generated timestamps. Validation package — VAQ, IQ/OQ protocol framework, infrastructure qualification summary — available. Book a demo to see Part 11 architecture.
Deviation
Deviation and CAPA Tracking
Out-of-spec test results auto-generate deviation records with mandatory impact assessment. CAPA linked to deviation with owner and due date. Stage cannot advance until all deviations are Quality-approved closed. Sign in to configure CAPA workflows.
Requalify
Requalification Trigger Management
Maintenance events, out-of-tolerance calibrations, and software changes evaluate automatically against the requalification trigger policy. Requalification work orders generated at trigger point with scope pre-determined — not assembled under inspection pressure. Book a demo to see trigger configuration.
Status
Qualification Status Dashboard
Every asset shows current qualification status: Current / Requalification Due / Overdue. Exportable for QA review. No asset enters production with an open requalification without management visibility. Sign in to see the qualification dashboard.
Templates
Pre-Built Protocol Templates
DQ, IQ, OQ, and PQ protocol templates for common pharmaceutical equipment — autoclaves, tablet presses, filling lines, HVAC, WFI systems. Each includes mandatory sections per EU GMP Annex 15 and FDA §211.63. Locked after Quality unit approval. Book a demo to review template library.
Protocol Approved Before Testing. Stage Gates Enforced. Every Record Part 11-Compliant.
OxMaint manages the complete DQ → IQ → OQ → PQ lifecycle — with deviation tracking, requalification scheduling, and FDA inspection-ready documentation packages. Free trial, no implementation fees.
Common Questions
Validation Teams Ask These
Can a qualification protocol be written and approved after testing has begun?
No. A qualification protocol must be Quality-unit-approved before any testing begins. Retroactive approval — regardless of whether results are acceptable — is a data integrity violation. An FDA investigator examining qualification records will verify approval dates against execution dates. Where the protocol approval date matches or follows the first test execution date, this is a citable finding under §211.63. OxMaint enforces this structurally by blocking execution access until protocol approval is confirmed. Sign in to see the approval-gated workflow.
How many PQ runs are required?
Three consecutive successful production runs is the industry minimum — not regulatory statute, but a scientifically justified baseline that must be defended in the PQ protocol. Where process variability is high or critical quality attributes are particularly sensitive, more runs may be required. Each run must meet all pre-defined acceptance criteria independently — "two out of three" is not acceptable. One failed run requires root cause investigation, CAPA closure, and restart of the consecutive count. Book a demo to see PQ execution tracking in OxMaint.
When does 21 CFR Part 11 apply to qualification records?
Part 11 applies when electronic records are used to satisfy requirements previously met with paper — including IQ, OQ, and PQ records required under 21 CFR Part 211. The pharmaceutical manufacturer — not the CMMS vendor — is responsible for validating the CMMS in their specific environment. Key requirements: immutable audit trail, two-component electronic signatures (user ID and password minimum), access controls, and system validation documentation. Sign in to access OxMaint's Part 11 compliance documentation package.
