Process Validation for Medical Devices: What FDA Requires and How to Do It

Process validation is the documented evidence that a manufacturing process can consistently produce product meeting its predetermined specifications and quality attributes. That is the FDA's definition. The emphasis is on two words: "consistently" and "documented." A process your team runs correctly every day without deviation for two years is not validated unless you have the records to prove it.

This matters because an inspector cannot observe two years of production. The records are the only available evidence that the process was in a state of control. If the records do not exist, from a regulatory standpoint, the validation did not happen. The FDA's 2011 process validation guidance makes this explicit: process validation is not a one-time event but a lifecycle activity with three stages of data collection and analysis.

What processes require validation under FDA rules

The regulation is in 21 CFR 820.75: any process whose output cannot be fully verified by subsequent inspection and test must be validated. The practical interpretation is that if 100 percent of your output can be nondestructively inspected and the inspection is sufficient to confirm conformance to all specifications, validation may not be strictly required. In practice, for most manufacturing processes, 100 percent nondestructive inspection is either not feasible or not sufficient.

Sterilization is the clearest example of a process requiring validation. You cannot verify sterility by inspecting or testing the finished product without destroying it. The sterilization cycle parameters are validated to demonstrate that the cycle produces the required sterility assurance level, and then the cycle is monitored using biological indicators on a scheduled basis. The inspection of finished product does not verify sterility. The validated process is the only mechanism that provides assurance.

Injection molding requires validation because internal structure, weld lines, void content, and molecular orientation cannot be inspected nondestructively on every part. The dimensional inspection of external features does not verify the structural properties of the part. A validated process with controlled melt temperature, injection speed, pack pressure, and cooling time is the mechanism that provides assurance of consistent internal structure.

Welding, both ultrasonic and thermal, requires validation because weld strength must be demonstrated by destructive testing. You cannot destructively test every unit. The process is validated to demonstrate that controlled parameters produce consistently acceptable weld strength, and then periodic destructive testing is used to monitor process stability.

Coating and adhesive bonding, packaging seal integrity, and any process where the critical quality attribute is only assessable by destructive or statistically sampled testing all fall into the same category. Processes where 100 percent nondestructive inspection is feasible may not require validation but are often validated anyway to reduce the inspection burden, improve yield, and provide a documented basis for process control.

The three phases of process validation

Installation Qualification confirms that the equipment is installed as specified by the manufacturer's requirements and your own installation specifications. The IQ documents the equipment serial number, model number, installation location, utility connections, calibration of all instrumentation, and a comparison of the as-installed condition to the installation requirements. For detailed protocol content, see the full guide at IQ OQ PQ validation.

Operational Qualification confirms that the equipment operates within its specified parameters across its full operating range under worst-case conditions. The OQ is where you challenge the equipment rather than run it at nominal setpoints. If the validated range for melt temperature is 220 to 240 degrees Celsius, the OQ tests performance at 220, 230, and 240 degrees to confirm the equipment reaches and holds each setpoint within the required accuracy across the full range.

Performance Qualification confirms that the process, operating within its validated parameters using production materials and production operators, consistently produces product meeting its acceptance criteria across multiple runs. The PQ is the stage where all elements of the production system come together: equipment, personnel, materials, and environment. The PQ uses production conditions, not laboratory or prototype conditions.

All three phases must be completed and approved before the process is considered validated. Skipping from IQ to PQ without completing OQ, or combining OQ and PQ without a clear boundary between the two, creates a validation file that will not survive an inspection.

The validation master plan

The Validation Master Plan is the overarching document that defines the validation strategy for a facility or product line. It is not a protocol and it does not contain test data. It describes the framework within which validation activities are conducted.

A complete VMP defines the scope of what requires validation across the facility or product line, the approach and rationale for how validation requirements are determined, the schedule of planned validation activities, the numbering system used for protocols and reports, the acceptance criteria basis for each category of validation, and the roles and responsibilities of personnel involved in validation activities.

The VMP also addresses how changes to validated processes are managed, what triggers revalidation, and how validation status is maintained over time. A VMP that covers validation execution but not ongoing maintenance creates a gap that becomes a finding during audits. Validation is not complete when the final PQ report is approved. It is maintained through a combination of process monitoring, change control, and periodic revalidation.

The VMP is a living document that is revised when the scope of validation activities changes, when new equipment categories are added, or when regulatory requirements change. It should reference the current versions of the underlying procedures for protocol execution, data analysis, and change control. An outdated VMP that references procedures that no longer exist in their current form is a documentation gap even if all the individual validation reports are complete.

How to write a process validation protocol

The purpose statement defines exactly what process and parameter set are being validated. "This protocol validates the heat sealing process for model XR-400 packaging on sealer SL-001 and SL-002 within the range of 185 to 195 degrees Celsius dwell temperature and 2.8 to 3.2 seconds dwell time." This is specific enough that anyone reading the protocol knows exactly what was validated and what was not.

The scope section identifies which equipment is covered, which process parameters are being validated, which product variants are within scope, and which facility or manufacturing line the validation applies to. If the validation covers two sealers but not a third installed sealer of the same model, the scope must say so explicitly and a separate validation must be planned for the third sealer.

The equipment list identifies all equipment used during protocol execution, including calibration status and calibration due dates at the time of execution. If a piece of equipment comes out of calibration during execution and must be recalibrated, the event must be documented as a deviation with an impact assessment. Equipment used in an out-of-calibration state invalidates the data collected with it.

Critical process parameters and their specified ranges must come from development data and process characterization studies. A parameter range that is defined by arbitrarily choosing a setpoint and calling plus or minus 5 percent the validated range is not a scientifically justified range. The range must be supported by data showing that product produced anywhere within the range meets its specifications. If the characterization data does not exist, process characterization must be completed before the validation protocol is executed.

The sampling plan specifies the number of units to be tested, the number of runs, the time points for measurement within each run, and the statistical rationale for the sample size. A sample size of three units per run based on convention is not a statistically justified sample size. The sample size must be calculated based on the required confidence level, the required reliability, and the expected variability. For a process with high variability, a larger sample size is required to achieve the same confidence level as a process with low variability.

Acceptance criteria must be objective and measurable. "Acceptable appearance" is not an acceptance criterion. "No visible voids, tears, or contamination on any seal surface when inspected under white light at 500 lux from a distance of 30 cm" is an acceptance criterion. Every criterion must be stated in terms that allow a pass or fail determination without subjective judgment. If criteria require judgment, the judgment criteria must be defined with reference standards.

The deviation procedure defines what happens when a test result falls outside acceptance criteria during execution. Does execution halt immediately? Does it continue while the deviation is documented for later assessment? Who has authority to make that call? These decisions must be made before execution begins, not during execution when time pressure and sunk cost bias affect decision-making.

What the validation report needs to contain

The executive summary states the overall conclusion: the validation was successful and the process is validated within the specified parameter ranges, or the validation was not successful and the specific criteria that failed are identified. The summary includes the scope of the validation, the dates of execution, the equipment covered, and any deviations that occurred during execution. It is written for a reader who needs to understand the outcome without reading the full report.

Test data tables present all measurement results from all runs. Every data point collected during execution must appear in the report. Selective reporting of data, where results that look unfavorable are excluded from the report, is a data integrity violation. All data collected under the protocol is part of the validation record.

Statistical analysis covers process capability expressed as Cpk for each critical quality attribute, confidence intervals around the capability estimates, and batch-to-batch variation. A Cpk of 1.33 or greater is the minimum acceptable for most medical device applications. A Cpk below 1.33 does not automatically invalidate the process, but it requires a documented justification and typically triggers a requirement for increased monitoring. A Cpk below 1.00 means the process is producing product outside its specification limits at a predictable rate and the validation should not be approved.

The deviation log covers every deviation observed during execution, with an impact assessment for each deviation. An impact assessment answers: does this deviation affect the validity of the data collected? Does it affect the conclusion of the validation? If the impact is determined to be none, the rationale must be documented. Stating "deviation has no impact" without a rationale is not an impact assessment.

The conclusion section states whether the process is validated. If all acceptance criteria were met and all deviations were closed with assessments showing no impact to the validation conclusion, the process is validated. If any acceptance criteria were not met, the conclusion must state that the process is not validated, identify the failed criteria, and describe the path forward, whether that is process modification followed by revalidation or acceptance of reduced validated range.

Revalidation triggers

Any modification to validated equipment that could affect process output is a revalidation trigger. The threshold is "could affect," not "is likely to affect." A change to the sealing jaw geometry of a heat sealer could affect seal integrity. The fact that the manufacturer believes the change is minor does not eliminate the requirement to assess the impact and revalidate where indicated.

Any change to the validated parameter ranges requires revalidation of the affected ranges. If the validated dwell temperature range was 185 to 195 degrees Celsius and the process engineer wants to operate at 200 degrees to improve cycle time, 200 degrees is outside the validated range. Operating at 200 degrees without revalidation is operating an unvalidated process.

A facility move requires revalidation even when the equipment is physically identical and is moved intact. The utility connections, environmental conditions, maintenance team, and operator population at the new facility are different from those at the original facility. These are not trivial differences. The FDA's 2011 guidance is explicit that process validation does not transfer automatically with equipment.

A new supplier for a critical material is a revalidation trigger when the material property affects process output. Changing the supplier of a packaging film to a vendor whose film has different thickness variation and different surface energy can affect seal integrity even if the specification on the drawing is the same. The process was validated with the original film. The new film must be assessed and the validation extended to cover it.

Sustained process performance degradation is a revalidation trigger. If process capability falls below Cpk 1.33 for multiple consecutive batches without an assignable cause that has been corrected, the process is no longer performing at its validated capability level. The investigation and corrective action may restore capability, but if the corrective action changes the process parameters or equipment, the changes must be validated. Revalidation demonstrates the process is back in a state of control at an acceptable capability level.

Process validation vs design validation

Design validation answers the question: does this device, as designed, meet user needs and intended use? It is conducted with finished devices, typically through simulated use testing with representative end users or through clinical study. Design validation demonstrates that the design is correct. For more on design validation in context, see the guide on the Design History File.

Process validation answers the question: does the manufacturing process, as validated, consistently produce devices that meet the design outputs? It is conducted on the production line under production conditions. Process validation demonstrates that the production system can reliably reproduce the validated design.

They are complementary and both are required. A device that passes design validation proves the design works. Process validation proves the production process can reproduce that design consistently at scale. A device with a successful design validation and no process validation is a device where you know the design is good but you have no documented evidence that the production process reliably produces it. That gap is the basis for a 483 observation.

For related guides, see process FMEA for manufacturing and the Aptibot documentation service for validation protocol development and review.