Recommendations on VMP, Installation and Operational Qualification, Process Validation, Cleaning Validation

PI 006-3 read like four standalone recommendations stapled together, each with its own principle statement and its own logic. It's title reflected that; "VALIDATION MASTER PLAN, INSTALLATION AND OPERATIONAL QUALIFICATION, NON-STERILE PROCESS VALIDATION, CLEANING VALIDATION"

The new title: "QUALIFICATION AND VALIDATION" feels more coherent. PI 006-4 reads more coherent as well. Sections 1 and 2 set up purpose, scope, terminology, change control, responsibilities and quality risk management. Everything after that inherits those principles.

The scope is also drawn more deliberately. It applies to APIs, intermediates and finished dosage forms, and it steps back from GMP computer system validation, from analytical method validation and from anything already covered elsewhere in the PIC/S library such as PI 007 on aseptic processes.

Section 2.2 states that the document is not intended as a barrier to technical innovation, which reads as an invitation to justify a different approach rather than copy the text.

Section 2.2.1: the principles "equally apply to the manufacture of active pharmaceutical ingredients (APIs), intermediates as well as finished dosage forms."

Distributors of medicinal products.

Qualification & Validation Stages

PI 006-3 gave us IQ and OQ. PI 006-4 puts four prequalification stages in front of them:

1. URS (4.2.1), which should distinguish which requirements are essential and which are flexible.
2. DQ (4.2.2), verifying that what was selected actually meets the URS.
3. FAT (4.2.3), at the vendor site, useful for catching missing documentation before delivery.
4. SAT (4.2.4), confirming performance against the URS once installed.

Then IQ, OQ and, newly named as a distinct stage (in this guidance, obviously well known within the industry and other guidances), PQ (4.3.3), run with actual or appropriately simulated production materials under normal operating conditions. The guidance is quite specific on this topic and what the PIC/S expects as normal operating conditions: adjustments, stoppages, personnel changes, material replenishment. Not a quiet Sunday with your best operators.

Systems are to be reviewed at predetermined intervals, and the interval itself has to be justified using risk management principles including equipment criticality.

Three-batch Process Validation Requirement Replaced

PI 006-3 proposed: three consecutive batches within the agreed parameters would generally constitute proper validation. 

PI 006-4 proposes: a number of batches that is scientifically justified, driven by a risk assessment grounded in existing product and process understanding.

When your existing data is weak or incomplete the weakness must be compensated by additional testing during subsequent ongoing process verification. You can still run three batches. You now have to explain why three?, and accept a heavier monitoring burden if the justification is thin.

Continuous Process Verification (CPV)

Continuous process verification (5.5.3 to 5.5.7) covers real-time monitoring using on-line, in-line or at-line controls with multivariate analysis, and it is explicit that the multivariate models themselves need validating.

The hybrid approach (5.5.8) validates part of a process traditionally and part by CPV, which is aimed squarely at legacy products and at changes to existing processes.

Prospective validation now has a prerequisite list (5.3.1) that PI 006-3 didn't contain: QTPP, CQAs, CPPs, development and scaleup reports, the control strategy, qualified facilities and utilities, validated test methods, trained personnel, and a risk assessment that sets the scope and depth of the study.

Periodic Revalidation 

PI 006-3 said periodic revalidation of non-sterile processes was a lower priority than for sterile ones, and that a data review could often be enough if nothing had changed. 

PI 006-4 recommends ongoing process verification to start after initial validation concludes and to continue until the product is discontinued.

Sampling and testing are set by risk assessment and may be reduced over time on the basis of statistical analysis, from validation levels down towards routine release testing.

Results are reported regularly, normally at least once a year, with a conclusion on whether the process remains in a state of control. PIC/S allows this to be combined with the Product Quality Review.

Periodic revalidation is still mentioned in PI 006-4 but as a change driven activity. Scope can be reduced relative to the original study where production history and risk assessment support it.

Changes to Cleaning Validation (CLV)

PI 006-3 set the carry-over limits as follows:

• No more than 0.1% of the normal therapeutic dose in the maximum daily dose of the following product,
• No more than 10 ppm in another product,
• And no visible residue, whichever was most stringent.

This was, unfortunately, below the limit of detection for penicillins, cephalosporins, potent steroids, cytotoxics and allergens.

PI 006-4 sets the extent of cleaning validation according to a toxicological risk assessment based on health-based exposure limits (HBEL), and expresses acceptance criteria as HBEL-derived maximum allowable carry-over. Several practical requirements follow from that:

• Cleaning verification and cleaning validation are defined as different things.
  • Verification is the ongoing assessment across the lifecycle;
  • Validation is the formal demonstration of consistency.
• Non-contact parts from which residue can migrate are in scope, with seals, flanges, mixing shafts, oven fans and heating elements named.
• Worst-case product selection needs documented justification, and more than one worst case may be required depending on HBEL values, cleaning difficulty and residue solubility.
• Where HBEL values are low, section 7.3 says the required consistency may not be achievable by manual cleaning, and points to dedicated parts, automation, or verification at every product changeover.

That last point is the one to cause a lot of work if this applies to you. It puts a (recommended) ceiling on how far manual cleaning can be defended for high-potency products.

New Sections / Items in PI 006-4

Verification of transportation (6.1)
Shipping conditions from the manufacturing site to the distribution site have to be verified against a test protocol, informed by a risk assessment of variables such as weather, customs delays, staff shortages and vehicle breakdowns, with previously unknown variables fed back into an updated assessment. Where data loggers are used, the document asks for device location within the shipment, traceability of each device to its data, and procedures for downloading it with integrity intact.

Packaging validation for solid dose (6.2)
Blister and sachet seal integrity gets its own treatment: vary pressure and temperature at constant machine speed to find the effect on integrity, then repeat across machine speeds to confirm the selected parameters sit in an optimum range rather than near the failure point. Cumulative heat exposure after stoppages or repeated passes through a shrink wrap tunnel has to be evaluated.

Qualification of supporting utilities (6.3)
The full URS to PQ sequence is applied to utilities. Water gets the three-phase PQ pattern and specific attention to tanker-supplied water, including technical agreements naming a single source and control of activities around the borehole. Clean steam requires testing of user points for non-condensable gases, superheat and dryness, and lower grade steam used for heating requires a failure mode assessment of the barrier between steam and product. Compressed gas systems must not introduce particulates, oil, hydrocarbons, micro-organisms or humidity, with filter integrity checked before and after replacement.

Change control and data integrity (2.6, 2.5.8)
Change control is treated as the mechanism that keeps qualification and validation status meaningful, with quality oversight over the whole programme and QRM used to assess impact. Data integrity appears as a stated expectation across all validation activity, and the VMP content list asks for verification by personnel who did not execute the work.