Skip to content
PQMS
  • Homepage
  • Products
  • About Us
  • Blog
  • Contact us
Login
Book demo

  • Equipment Classification: The Decision That Drives Qualification

    Equipment Classification: The Decision That Drives Qualification

    Before an equipment qualification protocol is drafted, here’s a question worth asking: Does every piece of equipment have to go through a qualification lifecycle requiring the same resources, time, and effort, or would commissioning suffice for some?

    Some never pause to question whether full commissioning and qualification are truly necessary. Instead, the default option of qualifying every asset is exercised because it appears comprehensive on paper. But is this approach the most efficient use of time and resources, or could a more targeted strategy deliver faster, equally reliable outcomes?

    Equipment classification provides a structured way to answer that question. As outlined in the ISPE Baseline Guide Volume 5, the System Classification framework classifies equipment as Direct Impact or Not Direct Impact, providing the basis for determining the qualification strategy.

    System Classification According to ISPE

    Classification comes down to answering eight questions — a YES to any one of them makes the equipment Direct Impact. All eight have to come back NO before it can be Not Direct Impact. (ISPE Baseline® Guide Volume 5, Section 3.3)

    1. Does it control a CPP, or otherwise serve a defined CQA?
    2. Does it have direct contact with the product or process stream?
    3. Does it produce an excipient, ingredient, or solvent—Water for Injection being the obvious one?
    4. Is it used for cleaning, sanitising, or sterilising?
    5. Does it maintain an environment—temperature, humidity, an aseptic zone — that’s a CPP for the process?
    6. Does it generate or hold data used to accept or reject the batch, or fall under 21 CFR Part 11 or EU GMP Annex 11?
    7. Does it provide the container closure or product protection?
    8. Does it apply or check product identification with no independent verification elsewhere?

    Classification Outcomes

    Every piece of equipment gets sorted into one of two categories based on how it answers those eight questions — Direct Impact or Not Direct Impact.

    Direct Impact (DI)Not Direct Impact (NDI)
    Qualified and commissioned Commissioned only
    Scope set by CQA/CPP risk to the productScope set by SME judgment and HSE criticality
    System Risk Assessment identifies the CDEsSME review sets the commissioning scope
    Full C&Q documentation packageCommissioning documentation only

    Consider the following examples:

    • A vial filling machine answers YES at Q2 alone—it’s in direct contact with the product during filling, and a failure there is a direct line to product quality. One YES is enough. It’s Direct Impact and goes through the commissioning and qualification workflow.
    • A shrink-wrapping machine sits downstream; it bundles product that’s already capped, stoppered, or sealed. It doesn’t touch product, so Q2 is a clean NO. The question worth pausing on is Q7—product protection. Shrink film does protect the product in transit, so a quick read might call this a YES. But Q7 asks whether this equipment provides the seal on which product quality depends, and the upstream capping or stoppering step already provides that seal. The shrink wrap is a secondary bundle, not the barrier the product relies on. Q7 comes back NO, and so does the rest. The shrink-wrapper is Not Direct Impact. It still goes through commissioning—it just doesn’t go through qualification.

    Where classification gets genuinely tricky

    Most equipment can be classified with relative ease. Utilities, however, often require a closer evaluation because their classification depends on how they support the process.

    1. Utilities controlling critical process parameters: Product contact alone does not determine classification. Utilities that control Critical Process Parameters (CPPs) may still be classified as Direct Impact.

    Example: A chilled water system cooling a jacketed reactor may never contact the product, but if it controls the reaction temperature (a CPP), it is classified as Direct Impact.

    • Utilities with multiple points of use: The same utility can serve both Direct Impact and Not Direct Impact applications. Classification should be based on the specific point of use rather than the utility itself.

    Example: Compressed air used to dry product-contact equipment after cleaning may be classified as Direct Impact. The same compressed air used only to operate non-product-contact equipment is Not Direct Impact.

    • Function over equipment type: Classify systems such as nitrogen, vacuum, or compressed air according to their function in the process, not their names.

    Example: Nitrogen used for product blanketing is Direct Impact, whereas nitrogen used only for line pressurisation may not be.

    The Bottom Line

    The most effective qualification programmes do not qualify every equipment. They are selective. Equipment classification provides the framework for making that decision consistently, ensuring that the qualification effort, project resources, and regulatory focus remain aligned with actual product and process risk.

    Reference

    1. ISPE Baseline® Guide: Commissioning and Qualification, Volume 5, Second Edition. International Society for Pharmaceutical Engineering (ISPE), 2019. ISBN 978-1-946964-23-6.

    Sindu K

    July 27, 2026
    Uncategorized
    digital transformation, direct impact, Equipment Qualification, GxP Compliance, ispe, not direct impact, pharmaceutical, Pharmaceutical Validation, Quality Assurance

  • User Requirements Specification — Getting the Sequence Right.

    User Requirements Specification — Getting the Sequence Right.

    Most of us have written a URS with a system already in mind. The vendor had been shortlisted, sometimes already selected, and the document was drafted to formalise what had already been decided. The result is a URS that describes a product rather than defines a need. It cannot be used to challenge whether the selected system is fit for purpose, because that question was never genuinely open.

    This is the most common URS failure in the industry. Not vague language. Not missing signatures. The sequence. A URS written after vendor selection is not a requirements document. It is a justification; those of us who have reviewed enough of them know the difference.

    What the Regulators and ISPE Expect

    The ISPE definition is precise: the URS states what the system must do, not how it should do it. Every major GxP framework shares one expectation underneath the differing language: document what you need before you build it, and prove you did.

    The Annex 11 makes this more explicit than before. URS traceability to testing is no longer implied — it is mandatory. Risk management must be embedded from URS through to system retirement. The one-time IQ/OQ/PQ followed by silence is no longer a defensible position.

    What the URS Must Cover

    Every requirement in it must be verifiable — specific enough that someone can design a test, run it, and return a clear pass or fail. If it cannot be tested, it does not belong.

    The URS must cover, at a minimum:

    • Functional capabilities — calculations, safety functions, access controls, audit trails, and output formats
    • Data handling — data definitions, valid ranges, integrity controls, backup, and archiving
    • Technical performance — capacity, failover behaviour, and disaster recovery
    • Interfaces — with users, other systems, and equipment
    • Environmental and power conditions — the physical operating environment in which the system must function
    • Alarm requirements — including explicit identification of critical alarms
    • System automation — with clearly defined boundaries between systems
    • Data integrity requires its own attention. The URS must define what the system needs to do to satisfy ALCOA+ principles — data that is Attributable, Legible, Contemporaneous, Original, and Accurate, and beyond that, Complete, Consistent, Enduring, and Available. These are not abstract ideals. Each one translates directly into a testable requirement — audit trails, user access controls, timestamps, backup provisions, and data storage conditions.
    • Every requirement should state its category — Quality, Business, or HSE — and its source, whether a CQA, a CPP, a regulatory requirement, a risk assessment output, or an engineering standard. We must explicitly identify quality-critical requirements and write them with precision.

    Finally, not every requirement carries the same weight. Separating mandatory from beneficial and nice-to-haves keeps the qualification effort focused where it actually matters.

    What a GMP-Grade Requirement Looks Like

    The gap between a weak requirement and a defensible one is not technical knowledge. It is discipline, specificity, and process ownership.

    Weak Requirement GMP-Grade Requirement
    The system shall monitor temperature.The system shall continuously monitor storage temperature within 2°C–8°C(CPP), trigger a GMP-critical alarm within 60 seconds of exceedance, and maintain a tamper-proof audit trail per 21 CFR Part 11.
    The system should print labels correctly.The system shall restrict label reprints to QA-authorised personnel with an electronic signature, reason code, and a full audit trail of all print events and template changes.

    A requirement that cannot be tested has no place in a qualification programme.

    Five Failure Modes That Destroy URS Credibility

    These are not theoretical. They are the patterns behind real audit observations, 483s, and warning letters.

    1. Vague, untestable language. Robust, appropriate, user-friendly — these are not requirements. If a test cannot be written for it, it does not belong in the document.
    2. Vendor Brochure Transcription. A URS sourced from supplier documentation belongs to their sales cycle, not your process. Auditors notice immediately.
    3. No CQAs or CPPs identification. You cannot build a credible risk assessment on a document that fails to identify what is critical.
    4. URS Written Post-Selection. A URS written after vendor selection is not a requirements document. It is a justification.
    5. Never Updated After Go-Live. If your team has not updated the document to reflect the current validated state, it is a liability.

    Each of these patterns is recoverable before qualification begins. After a deviation occurs, they become the gap that an investigation cannot close.

    Conclusion

    A URS is only as useful as the process understanding behind it. Written early, classified correctly, and maintained through every system change — it is the document that gives every qualification activity its purpose. Written late, vaguely, or not at all — it is the gap an investigation will eventually fall into.

    Sindu K

    June 15, 2026
    Uncategorized
    ALCOA+, GMP validation, GxP Compliance, Pharmaceutical Validation, QMS, Quality Assurance, Regulatory compliance, User Requirement Specification

  • Factory Acceptance and Site Acceptance Testing: Accelerating Equipment Qualification with ValDoc Pro

    Factory Acceptance and Site Acceptance Testing: Accelerating Equipment Qualification with ValDoc Pro

    https://www.pqms.com/wp-content/uploads/2025/12/FAT-SAT-Article-1.mp4

    Synopsis:

    “Suitable for the intended purpose/activities” is a core regulatory expectation for all pharmaceutical manufacturing equipment, and qualification is the documented proof that this is achieved. The qualification lifecycle starts with a User Requirement Specification (URS) document followed by a Functional Specification (FS).  Test Scripts are executed in IQ, OQ and PQ documents to demonstrate that the requirements noted in the URS are met. Because running IQ/OQ/PQ scripts at the manufacturing site is time-consuming and the responsibility falls only on the drug manufacturer, some of the effort can be shared with the vendor via Factory Acceptance Testing (FAT) and Site Acceptance Testing (SAT).  ValDoc Pro can streamline this process and build better compliance.  

    Regulatory Guidelines:

    121 CFR 211.63 states that “Equipment must be of appropriate design, adequate size, and suitably located to facilitate operations for its intended use”[2].  While the FDA recognises the advantages of FAT and SAT (mentioned in presentations by the FDA), there is no guideline that discusses this.   EU GMP Annex 15 & PIC/S explicitly state, in sections 3.4-3.7, that:

    • Equipment, especially if incorporating novel or complex technology, may be evaluated, if applicable, at the vendor prior to delivery.
    • Prior to installation, equipment should be confirmed to comply with the URS/ functional specification at the vendor site, if applicable.
    • Where appropriate and justified, documentation review and some tests could be performed at the FAT or other stages without the need to repeat on-site at IQ/OQ if it can be shown that the functionality is not affected by the transport and installation.
    • FAT may be supplemented by the execution of a SAT following the receipt of equipment at the manufacturing site.

    Leveraging Vendor Testing:

    The Factory Acceptance Test (FAT) is carried out at the vendor’s site and provides documented evidence that the equipment meets the user requirements and the vendor has fulfilled contractual responsibilities. A well‑planned FAT helps save time during qualification by identifying design issues, functional gaps, and integration problems before the equipment leaves the factory.   Sending the equipment back to the vendor to fix issues, especially when they are located across continents, is avoided through FAT.  Fat also provides the ability to check internal components of the equipment that one would not be able to reach at the site unless it is disassembled. 

    It is not necessary that a FAT test be performed for all equipment/systems.  That decision is left to the manufacturing site and its policy.  For a greenfield facility, a commissioning and qualification (C&Q) plan will direct this strategy.  A survey by ECA Academy in 2018 found that FAT is used by 37% of the companies surveyed, while 55% stated “it depends on the complexity of the project”. SAT was found to be used by 49% of those surveyed [5]. 

    Planning and preparation for the Factory Acceptance Test (FAT) are critical because the activity is conducted at the vendor’s site and involves budgeting for extra expenses on both sides. The decision to perform FAT is typically taken very early in the procurement lifecycle, during the development of the User Requirement Specification (URS) for the equipment.  The contract signed between the drug manufacturer and the vendor for an equipment includes scope of the FAT, responsibilities and the commercials.  The details of what is to be covered in FAT are put down in a protocol and frozen before approval of the design stage.  The site and the vendor have to agree on the features/functions to be demonstrated, parameter specification to be met, tests to be carried out, and identify the URS points covered by FAT.  The FAT protocol is sent to the drug manufacturer for review.  Once approved, then only the protocol can be executed.  During execution, the drug manufacturer representative(s) ideally should be present to at least to verify the minimum test requirements and resolve any deviations.  During and after the pandemic, many FATs have been conducted remotely, reducing travel and related expenses and making this an attractive option, particularly when organisations can leverage a wide range of digital tools and platforms to their advantage.

    The FAT protocol, once executed, is compiled along with attachments and sent to the site by the vendor for review.  In most cases, the equipment would have to be disassembled before shipping.  The documentation put together details equipment component labels and the process to follow to reassemble these components. 

    Similar to the FAT, the Site Acceptance Test (SAT) is not a mandatory test to perform.  The advantage of SAT is time savings.   A successful execution of the SAT protocol provides assurance that the equipment works as per specification post-transportation to the site.  While infrastructure, utilities, interfaces, etc, are defined in advance and agreed upon, surprises may crop up.  The SAT protocol also rechecks issues found during FAT.  These should be addressed before IQ begins.  In addition, the presence of the vendor’s team at the site speeds up testing, as that machine is very well known to them. 

    The SAT process follows the same overall approach as the FAT, but is performed at the manufacturing site rather than at the vendor’s facility. Whether a SAT will be performed should be defined in the C&Q plan and, preferably, specified in the URS and subsequently reflected in the contract.  SAT is led by the site, along with the vendor’s project/commissioning/service staff.  The SAT protocol is normally drafted by the vendor or the project engineering/validation team. 

    A decision that the site needs to take is whether they would like to leverage what was tested in FAT and SAT.  Most sites leverage the data from these tests.  The SAT protocol has many tests that overlap with what one would carry out under IQ and OQ protocols. 

    Accelerating FAT and SAT Efficiency with ValDoc Pro:

    ValDoc Pro is an easy to use Qualification management application that assists companies in digitizing their qualification workflow, from URS onwards through the entire lifecycle.  Its role-based access and real-time collaboration features enable vendors and manufacturers to coordinate FAT and SAT seamlessly.  Following are some of the advantages:

    • Vendor Access: Vendor can create, obtain site approval and execute FAT protocols within ValDoc Pro, with controlled access to designated folders/files. 
    • Site Review and Approval: The FAT protocol and FAT report can be submitted for review and approval online.
    • Seamless Flow: Generating the protocol by the vendor, review, execution and compilation all can be carried out seamlessly in ValDoc Pro. 
    • Sequential: ValDoc Pro ensures that the SAT protocol cannot be executed until the executed FAT report has been approved.  This ensures that the SAT protocol captures all relevant tests. 
    • Traceability Matrix: ValDoc Pro maintains a continuous link from URS through FAT/SAT to IQ/OQ/PQ, demonstrating to regulators that all user requirements were tested and all deviations addressed.

    Conclusion:

    Compared with relying solely on traditional IQ, OQ, and PQ, integrating FAT and SAT into the equipment qualification strategy allows issues to be identified earlier at the vendor and manufacturing site, limits risk, and reduces the amount of testing and troubleshooting that must be compressed into already busy commissioning windows. This upstream focus not only improves the quality of delivered assets but also frees site resources to concentrate on value-added verification and routine operation rather than firefighting late-stage gaps. ValDoc Pro-enabled FAT and SAT give pharmaceutical manufacturers a more efficient and compliant path to equipment qualification by moving protocols into a digitized, collaborative environment and enabling options such as Remote FAT, so teams can shorten timelines, reduce on-site disruption, and strengthen data integrity while maintaining full traceability from URS through lifecycle maintenance. In a landscape where each site-based role carries a greater workload, embedding FAT and SAT within a robust application like ValDoc Pro is not just an efficiency gain, but a strategic necessity for sustaining reliable, inspection-ready manufacturing.

    [1] FDA. Process Validation: General Principles and Practices. U.S. Food and Drug Administration.

    [2] “U.S. Food and Drug Administration. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals, §211.63 Equipment design, size, and location.”

    [3] European Commission. EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use, EudraLex, Volume 4, Annex 15: Qualification and Validation. In operation since 1 October 2015

    [4] PIC/S. Guide to Good Manufacturing Practice for Medicinal Products, PE 009 (current version), Annex 15: Qualification and Validation

    [5] ECA Academy. FAT & SAT not frequently used as Part of Qualification – ECA Modern Qualification Survey Results. GMP News, gmp-compliance.org (2018)

    ravi

    December 12, 2025
    Uncategorized
    Equipment Qualification, Equipment Testing, GMP Compliance, Pharmaceutical Validation, Process Validation, Quality Assurance

  • Who is actually Responsible for the URS?

    Who is actually Responsible for the URS?

    Synopsis:

    Before purchasing an equipment, software or instrument, regulatory requirement mandates that one documents what is expected of the proposed acquisition. While it may be tempting to rely on vendors for this, as they understand their product, they do not understand the business requirements. That is why the User Requirement Specification (URS) must be authored by the team responsible for this new acquisition. This article explains why a user-driven URS ensures the acquired entity genuinely matches user needs, moving it from basic functionality to real-world fit

    It All Starts with a Need

    Picture this. You have been asked to put together a URS for a new equipment/software/instrument.  If this requirement was identical or similar to one that you have purchased in the past, that makes your task easier.  But what if this is a brand-new requirement.  Where do you start? 

    Appendix D5 from the ISPE GAMP 5 guidance document says it the best when it states that each user requirement should be specific, measurable, achievable, realistic, and testable.   It is also a good practice to prioritize the requirements, typically in two or three levels: (mandatory (high), beneficial (medium), and nice-to-have (low)) Or (mandatory (high) and nice-to-have (low)).

    The Easy Way

    As a vendor, we very often get asked to provide a draft URS that the regulated company then uses as a basis to draft the requirement.  Is this the right approach?  It sounds logical, right? After all, vendors are experts in the products they sell. But here’s the catch — they are experts in their product, not your business process.

    Sometimes we receive a URS that lists a specific brand or model, even including specifications unique to that brand. This is not the intended purpose of a user requirement, which should describe what is the needed functionally, not prescribe a particular vendor or solution.  When this happens, it limits the scope of solutions, undermines competitive assessment, and can introduce bias or compliance risks. Such requirements do not reflect true user needs but rather pre-select a solution, making it harder to compare alternatives and potentially exclude options that better meet functional requirements. GAMP 5 guidelines recommend describing functional needs in clear, objective terms, avoiding references to specific suppliers unless it is absolutely necessary to do so for business reasons

      Understanding the Roles the RACI way

      How do we decide the roles of various stakeholders.  A RACI Matrix, a simple chart that outlines who does what, breaks down the roles:

      Responsible:  Team/end users responsible for the business process.  The end users or process owners are usually responsible for drafting the URS since they know the operational needs best.

      Accountable: Manager(s) responsible for the business process.  Oversees URS creation and ensures it meets desired goals

      Consulted:

      • Other departments to provide their input/expertise as the acquired product may influence their workflows
      • IT team for software/IT hardware requirements to provide input on technical feasibility and rollout implications
      • CSV team for software to include regulatory requirements
      • Vendor – provide input and give technical advice. 
      • Informed-Vendors so as to put together a function requirement specification. 

      What do the Regulators Say?

      The FDA, the EMA and others, have made their stance clear: every system must be “fit for its intended use.”  That phrase — fit for intended use — is powerful. It means the system should perform exactly as needed for your specific products and processes.

      And who defines that intended use? Not the vendor — you do.

      According to the FDA’s General Principles of Software Validation and EMA’s Annex 11 on Computerised Systems, the responsibility for defining and confirming suitability lies with the regulated user organisation for computerised systems.  But that principle doesn’t stop there. Under broader GMP guidance, such as Annex 15 on Qualification and Validation, the manufacturers are responsible for ensuring equipment is suitable for its intended purpose and for defining its requirements in a User Requirements Specification (URS) or functional specification.

      In short, the user determines what’s needed; the vendor shows how their product meets those needs.

      Why Ownership Matters?

      When the customer owns the URS, everything aligns. The equipment fits its real operational needs, and the system passes regulatory scrutiny because it was built for its true purpose. And most importantly, it saves time, money, and frustration down the road.

      When vendors take over the URS, it might seem faster, but it’s like letting someone else write your recipe — you’ll never get the exact flavour you wanted.

      ravi

      November 9, 2025
      Uncategorized
      Equipment Qualification, GMP Compliance, Pharmaceutical Validation, Quality Assurance, URS, User Requirement Specification

    Powering Quality from Lab to Label © 2025, Quascenta Pte. Ltd.