Position Paper: Are We Abandoning IQ and OQ?

It has been quite apparent to some of us in the pharmaceutical and medical-device industries that there appears to have been a directed effort over the past number of years to eliminate the concept of and need for the installation qualification (IQ) and the operational qualification (OQ). These two techniques were developed by the industry in answer to the validation requirement mandated by the US Food and Drug Administration (1). The purpose of IQ and OQ was to verify that equipment and systems were able to perform as intended.

Over the years, with the need to compress the timeline for products to be marketed and to decrease the cost associated with the build-out of a new facility or process, IQ and OQ documents have been massaged and varied in complexity and content. The IQ and OQ were also combined into a single-document format to save on paperwork as well as review and approval time. This new combination became known as the IOQ.

Industry over the years has been pushing FDA for acceptance regarding a cutback on the apparent redundancy associated with the validation process. It was argued that those validating were conducting tests that had already been performed during equipment design and installation. Quality assurance (QA) was also to blame since they were reviewing aspects of the installation and qualification that were not necessary. They were a bottleneck due to the time required for review, intrusive question and answer sessions, minuscule document oversights, and unessential general approval.

Today many companies still follow the premise of IQ and OQ, but the introduction of other terms has downsized the importance of these activities. In particular, the term commissioning was introduced into the vernacular of the industry. The purpose of commissioning was actually threefold:

• Commissioning was used to capture the pre-installation Factory Acceptance Test (FAT) and installation testing that was being performed on the equipment and systems being installed.

• Commissioning was viewed as taking the place of the need to qualify those systems and equipment that were not deemed critical but supportive in nature. Systems such as plant steam, vacuum, and heat transfer no longer required qualification. Commissioning allowed them to stand on their own documentation merits and any associated verification would reside in the associated commissioning documentation. New terms such as good engineering practices (GEP) would ensure that these documents were correct and usable.

• The third purpose of commissioning was to bridge the gap between design and installation, which was start-up. Using the information afforded through a commissioning program would reduce the apparent redundant information gathering and testing that validation was being accused of performing.

Over the same period of time, practitioners of commissioning were including more and more of the then-understood IQ and OQ tests as part of the commissioning exercise. This practice has been altered to such an extent that the IQ and OQ have been reduced to lists indicating that prior commissioning test had been properly completed. In essence, documents (IQ and OQ) that were quite large in size in the past now are the smallest in volume. This occurred to such an extent that the IQ and OQ are now understood by some in the industry as useless documents because they had been reduced to simple lists of prior test results.

These same criticisms did not mention other qualification test requirements such as the handshaking between equipment, the testing of narrowed specificity of operational parameters associated with the particular process in mind, or the added computer-related programming or interfacing that may be necessary. It has also become acceptable to have the pretreatment aspects of critical utilities commissioned only and the final purification or critical process steps considered for qualification.

Role of QA

QA was always to be the independent reviewer and approver. QA personnel had no direct role in the design or manufacturing processes. Their reporting structure also was to be independent and separate from engineering and manufacturing. They were mandated with maintaining quality and an independent status through the regulations.

During the same timeframe, we have seen the erosion of QA in the qualification effort. Validation, which originally resided in QA, was moved to either engineering or technical services. The reason for this was that only those disciplines could properly test the equipment and systems because they had the necessary experience and education. Logically this may be justified, and many companies today have already made the move. In some cases, even the performance qualification (PQ) and process validation (PV) aspects of validation have also been removed from the QA umbrella.

With the original IQ and OQ, QA personnel reviewed and approved each document. They also reviewed the summary reports that followed regarding these activities. With the onset of commissioning, the role of QA in the overall qualification scheme came into question. Nowhere in industry guidelines was it stated that QA should review commissioning tests and commissioning-related documentation. Again, the commissioned systems and equipment would stand on the merit of their respective commissioning documentation.

Some firms introduced the term commissioning closeout reports as an effort to include QA review and involvement. Other firms included QA as a team player in the overall process, but the approval status was removed. QA was only to substantiate that critical systems were properly tested, qualified, and approved.

The concern with all of this shifting of responsibilities as well as approvals was that QA personnel were still the ones defending the company activities to the FDA and other regulatory bodies. QA is typically the group defending the company's practices and applications during an FDA inspection and not those who commissioned or reduced the involvement of QA in the overall facility-qualification effort.

FDA

What is more intriguing is that FDA and even the European Union (EU) agree with these concepts of commissioning and the de-emphasizing of IQ and OQ—but not their elimination. This conclusion has been reached following FDA's participation in the very industry committees that have written these concepts into industry guidelines. FDA not only participated, but reviewed the documents from these committees and also tacitly approved them as well. Tacit approval was achieved by not making any statement pro or con with regard to the implementation of these practices over time. Most of the industry moved ahead and instituted the new methodologies.

The present situation

We now have two new documents regarding equipment and system suitability and qualification. These are recent additions, but we need to review them and once again adapt our understanding of the word qualification. ASTM, in cooperation with the International Society for Pharmaceutical Engineering (ISPE) has developed a new standard for the verification of equipment and system performance. This document is entitled "E2500-07 Standard Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment" (2).

The other document that also has been introduced for our use is FDA's Draft Guidance for Industry: Process Validation: General Principles and Practices (3). Both of these documents have been made public over the past year. Granted, we have known about their development for some time now.

Both documents have been tacitly approved by FDA. The agency reviewed and participated in the development of the ASTM standard, which is an issued document that can be purchased from the ASTM website. The FDA guidance is still in draft form but will certainly be issued as official guidance once FDA addresses the comments and finalizes the guidance document.

The most striking aspect of the documents is that they both deemphasize IQ and OQ. Neither document mentions these activities as installation qualification and operational qualification. The ASTM standard does not even mention the word qualification. The FDA draft guidance discusses qualification, but does not specifically mention the terms IQ or OQ. The draft guidance does expect performance and process qualification as an aspect of the overall process validation. Process validation is the sum total of all qualification activities performed.

It can be argued that the two documents address two different but related subjects within the scope of validation. The ASTM standard is geared to the acceptance of equipment and systems prior to performance qualification. The FDA guidance document emphasizes PQ but does have a major section devoted to the same subject matter as the ASTM standard.

GEP, risk assessment, and subject matter experts

The ASTM standard emphasizes verification, GEP, risk assessment, and subject matter experts (SMEs). Though the standard discusses documented verification and SME review, it is not clear what that documented evidence will look like. Certainly, QA or the quality unit is not being held responsible for review or approval of this verification activity. Criticality aspects of equipment and systems is reserved for QA review. Risk assessment is emphasized in the standard but it is not clear how that is to be achieved. Other than mentioning that the extent of verification and level of detail of documentation should be based on risk, not much else is said.

The FDA draft guidance also mentions risk assessment. It only references ICH Q9 in a footnote, but it does reference FDA's 21st Century Risk-Based Approach document (4, 5). The ASTM standard also references this FDA program. Though each document emphasizes risk and risk assessment, neither one indicates how it is to be achieved. The FDA guideline talks about risk in the sense of "control of variation and to combine conditions that pose a high risk of failure." The ASTM standard, however, requires that risk management be used throughout every aspect of the process and with every decision.

As stated above, the FDA draft guidance emphasizes qualification and only speaks to verification in the sense that it is to be achieved through qualification and continued process verification after process validation is completed.

The draft guide does not mention GEP, but interestingly it does mention commissioning and the "need to reduce redundant information gathering." It appears FDA through this draft document has finally given recognition to the practice of commissioning by mentioning it in the document.

The subject matter expert

The role of the SME is emphasized in the ASTM standard. This is a role that has been described in other industry articles and documents but the consequences are not well defined. First and foremost, who are the SMEs? How do we pick them or justify them? Are SMEs to be consultants or a separate group with a different reporting structure within a company, since it is also stated that for certain functions, they are to be independent?

The FDA draft guidance makes no mention of subject matter experts but does speak of an integrated team using expertise from a variety of disciplines and the use of a statistician for continual process monitoring.

Quality by design and design of experiment

In compliance with another FDA initiative for the pharmaceutical industry, the ASTM standard discusses quality by design (QbD). The current FDA validation guidance makes no mention of the subject but does discuss design of experiment (DOE). It is not clear if DOE is the same as QbD. For QbD, the ASTM standard does emphasize critical aspects, assurance of fit, and GEP. The FDA guidance indicates that risk-analysis tools are to be used with DOE.

On another note, and in addition to the term quality by design, the ASTM standard discusses design review (DR). Design reviews are to incorporate risk assessments. They are to be performed by the SME. Nowhere is it apparent that the quality unit is to play a part in the review or approval of the DR. The relationship between the DR and the FDA DOE is also not explained in either document.

Plans

The FDA has always stressed the need for plans. Among the plans were those for compliance, remediation, and qualification. The plans have always been implemented as a means of expressing to the regulatory bodies the intent of the validation exercise and to logically, deterministically, and intelligently convey that the qualification process is under control and that the desired end result of regulatory compliance would be achieved.

With these two documents, we have a number of plans introduced. Words such as verification plan, project plan, and qualification plan are mentioned. The later two items in the previous sentence can be found in the FDA validation guideline. Neither document mentions the validation master plan (VMP), which was introduced by the industry to satisfy the need for a plan in qualification and validation and to control the cost and schedule of the qualification and validation activities. The question that emerges is what is the role of the VMP, or has it, too, been discarded? In today's pharmaceutical and medical-device industries, an entire hierarchy of plans has arisen around the VMP. Every site has endeavored to have an overall site-validation plan with the individual project and process validation plans referring to it. The site-validation plan is different from the site file, which is a European requirement. Though one would infer that verification plans and project plans are just a substitution of words, the word validation is missing in the definitions of the plans in both of these documents.

Change management

Change management is emphasized in both documents. In each document, changes during design and through the process are to be identified and evaluated. Among the differences between the documents is that the FDA guidance indicates that the project plan is to address how the evaluation of change is to take place.

Change management at one time was to be official once the production process was operational. Change control during design and validation was not handled exactly the same way. Typically once documents in design and validation were reviewed and approved by QA, official change management would then be in play. We have a situation where it is not clear what the extent of change management is to be during design and installation. Both documents stress the need for it, and most importantly the need for change management once the process in placed into operation. What is also missing from both of these documents is the mention or implementation of a corrective and preventative action (CAPA) system for which change control is very closely linked. More importantly is change management as practiced prior to manufacturing operations (i.e., engineering change management) the same and with the same stipulations as QA-supervised change management that is used during commercial manufacturing.

Science-based approach

Both documents stress good science. The ASTM standard discusses science and risk-based decisions in the same sentence. We are to apply science to risk-based decision making. xactly what this means is not readily evident. The ASTM standard also gives a reference to ICH Q8 as a definition and understanding of the science-based approach (6).

The FDA guideline discusses sound scientific methods and principles with the PQ based on sound science. Both documents do acknowledge the application and support of process analytical technology (PAT).

Between these two documents it is clear that rationalizations and decisions are to be made with good understanding of science. Other than the ASTM standard emphasizing risk, they both acknowledge the need for good science.

Current role of the quality control unit or quality unit

This term quality unit (QU) is used in both documents. The words or group known as quality assurance is lacking in both. It is commonly understood that the QU is the sum total of all quality inclusive of QA and quality control (QC). The FDA validation guidance document gives more overall responsibility to the quality unit than the ASTM standard. The QU is to approve the qualification plan, PQ protocols, and reports. The FDA guidance document does address QU approving individual equipment and system qualifications. It stipulates that the qualification plan and the summarizing report must be reviewed and approved by the quality unit.

The ASTM standard has no formal mention of the QU other than to have them approve the verification plan, verification review documents, and the decision to use vendor documents as they apply to criticality. The QU does not participate in the review or approval of the verification documents, but just the final review documents.

A question to be raised is what happens if the quality unit disapproves of the verification review documents? Does it imply that the entire verification needs to be repeated? By not involving QA at the onset and throughout the process, how is it expected for them to defend the verification activities without an intimate knowledge of these activities?

In addition, the QA group has typically been responsible for ensuring that vendors and suppliers are savvy and compliant with current good manufacturing practices. Does the decision to use vendor documents without approving them affect this particular responsibility of the QU as well? The ASTM standard does not give this responsibility to QA and it is also not implied. FDA in other documentation does give QA the responsibility for overall vendor certification.

FDA initiatives

FDA independently has rewritten the original process validation guide that was issued in 1987. Among the reasons for the rewrite were that FDA has gained additional experience through its regulatory oversight, and the rewrite reflects the agency's current thinking on process validation. In reviewing this revised process validation guide, it is apparent that the FDA has maintained their stance on the words qualification and validation, but they appear to be backing away from the practices of IQ and OQ. The new FDA guidance on the surface appears to be more aligned with the current ISPE C&Q guide Volume 5 than the ASTM E2500 standard.

Due to internal budgets and resource constraints, FDA introduced other concepts. Among these was risk assessment. In an effort to harmonize, the FDA adopted, at least in name, the ISO (International Standards Organization) standards and ICH guidance documents such as Q9. These documents are available on the FDA website and mentioned in the risk-based approach document for pharmaceutical CGMPs for the 21st century. Though the risk was couched and stressed patient safety, those in the industry were to apply it to their daily operations. In effect, what has happened is that FDA has placed upon industry the need to proceduralize and defend the management of risk. It has never been clear how the industry were to evaluate this risk. When people in industry asked, they were referred to ICH Q9. The problem is that ICH Q9 is a descriptive document and not a how-to document. It also leaves it to us to develop our own method or tools if appropriate. These of course would then have to be justified and defended should they scrutinized during a regulatory audit.

A lot of time is spent analyzing and evaluating risk. This is really done to save money and time for product manufacture and sale. If certain testing or documentation can be avoided because it is considered low risk then all the better is the thinking. On the other hand, a lot of man hours are spent justifying this risk evaluation. There are many hidden costs and it is not clear that they all have been captured in the overall evaluation.

Another program promulgated by FDA, was the system approach to facility inspection. With each inspection, which is also predicated on risk, FDA would concentrate on different quality systems. The frequency and depth of inspections would be determined by conclusions of previous establishment inspection report (EIR), the Form 483 observations, and/or warning letters a firm may have received in the past. One of the systems is facility and equipment. After reviewing the FDA validation guidance, it is apparent that there will not be an immediate surge toward adapting the ASTM standard as common practice. The risk, in this author's mind, is much too high.

Even though FDA has not abandoned the concept of qualification, it states that the verification is to be achieved through qualification. In the ASTM standard, the word qualification is not used and instead we find just the word verification. In this author's mind, verification is one step removed from qualification, and these words are not necessarily interchangeable.

Table I: Document similarities

Definitions and summary

Verification. The act of reviewing, inspecting, testing, etc., to establish and document that a product, service, or system meets the regulatory, standard, or specification requirements.

Qualification. The process of certifying that a certain product has passed performance and quality-assurance tests or qualification requirements stipulated in regulations such as a building code and nationally accredited test standards, or that it complies with a set of regulations governing quality and minimum performance requirements.

Table II: Document differences

As a summary, the Table II provides some simple comparisons regarding the major similarities and differences between these two documents. Though they may seem to be quite similar, the similarities are in word only, but not necessarily in content. The differences between these documents are even more striking. The FDA participated in the generation and review of not only the ASTM standard, but also the ISPE commissioning and qualification (C&Q) guide. In the future and once either the rewrite or the new Guide number 12 is complete, FDA will once again be called upon to give its opinion and review. Table III shows a comparison of major topics covered in both ASTM E2500-07 and the FDA draft guidance document.

Table III: ASTM E2500 and FDA draft guidance topic comparisons.

Conclusion

As a final thought, FDA has also moved away from statements made in the original 1987 guidance. Among these departures are:

• In the original document, FDA discussed IQ and OQ

• The original document contained definitions of the various validation practices such as prospective and retrospective

• There was definite link to QA by insisting on QA procedures

• It stressed the participation of QA in equipment design and selection

• There was a separate section on medical device preproduction QA activities.

These are only a few of the departures but significant ones.

Over the years, the practice of validation has been truncated, revised, and reinvented. The old standby of IQ, OQ, and PQ has been criticized by some as not being in step with current technology and evolution of practices. The industry had matured, it was argued, and to such a point that everyone now understands GXP, or good X (variable) practices, including GEP. Though the industry has matured, human nature may not have. Problems of quality still occur and recalls still happen.

Table III (continued): ASTM E2500 and FDA draft guidance topic comparisons.

There was really nothing wrong with the original practice of IQ and OQ. Granted, it was in need of improvement and standardization, especially with regard to scope of activity. FDA has not abandoned the concept of qualification as pointed out in its draft guidance. To eliminate QA (QU) and rely on verification practices that have not been independently scrutinized is not correct either. The use of the SME only complicates the practice of qualification even more by requiring another individual for document approval in place of QA and to make critical decisions. The question to be asked is why the SME could not reside in and be part of QA? Because the QU was originally intended as the independent observer and reviewer, why couldn't this be the new structure?

Our present situation is complicated by the variety of non-harmonized approaches and standards. If it is not ASTM, it's the ISO. If it is not the FDA, it's the EU or Medicines and Healthcare Products Regulatory Agency (MHRA). If it is not ISPE, it's the PDA (Parenteral Drug Association). Even within the regulations, there is inconsistency of meaning and implementation. ICH Q7A and other documents discuss IQ, OQ, and PQ, but the new guideline only mentions PQ (7).

There needs to be a halt to the reinventing of qualification and validation. Yes, technology improves, and understanding and practice move forward. In the end, we still have to properly verify through qualification.

Several ideas are listed below for harmonizing the concept and practice of equipment and system qualification and process validation.

Suggestions for improvements in philosophy

• The QA (QU) should be involved from the onset and participate in the review and acceptance of not only the use of vendor documentation but commissioning and verification-related testing. This does not necessarily mean QA will approve the all of the testing, but certain key documents will require their approval.

• If the SME concept is adopted, and they are to be independent, then these SMEs should reside in QA. QA should be populated with appropriately trained technically competent personnel and engineers.

• QA needs to review all documents and appropriately approve at critical junctions. QA need not approve every test document but should be aware and allowed to review them as well and at will.

• QA needs to qualify vendor and supplier GMP-compliance issues and documentation for all commissioning and qualification.

• The IQ and OQ should remain as the staple practices for qualification documentation with the verification steps included. The expectation of IQ and OQ should be defined and standardized to eliminate the issues of bottlenecking as well the repeat of installation and operational-related testing. If the words IQ and OQ are to be discontinued, then some sort of qualification inclusive of verification needs to be instituted to be in compliance with FDA expectations. With this QA needs to play an approval role.

• Commissioning or commissioning-like activities should remain as a practice and especially for those systems designated as noncritical and supportive in nature. FDA has to formally accept this practice and not just give it honorable mention.

• Commissioning and verification testing for each and every system where it is applied should be completed with a QA-reviewed and approved closeout report or summary. This document would legitimize the information being leveraged.

• All systems and equipment will have an aspect of commissioning or commissioning-like verification, and for those critical systems the information gathered should be leveraged for use in qualification activities.

• All equipment and system testing need not reside in commissioning or installation-verification testing. Many tests can only properly be done with documented qualification. The boundaries of commissioning and installation verification testing need to be defined and standardized.

• Critical systems, once deemed so, should be qualified as a whole if possible, and not be broken down into critical and noncritical aspects. If a system or equipment is deemed critical it should remain as such.

• Process validation and performance qualification are necessary to satisfy current regulations, and the practice should be continued.

• The role of the VMP needs to remain in place and associated with other overall facility and corporate plans for validation and compliance.

• Change control and change management need to be maintained for all approved documents and activity prior to actual production activity. This change can be performed by QA engineering, which should be an arm of QA. Once production takes place, change control now becomes more product specific and needs to be done in collaboration with the overall CAPA system.

• Above all, and in compliance with process improvement and the principles of quality, requalification and revalidation should take place as needed and when necessary. This needs to be driven by product and process change control, process review over time, and process improvements.

Louis A. Angelucci is the director of corporate validation at MedImmune, One MedImmune Way, Gaithersburg, MD 20878, tel. 301.398.2949, angeluccil@medimmune.com

References and additional reading

1. FDA, Guideline on General Principles of Process Validation, (Rockville, MD, May 1987.)

2. ASTM, E 2500–07, Standard Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment (Aug. 2007).

3. FDA, Draft Guidance for Industry, Process Validation: General Principles and Practice (Rockville, MD, Nov. 2008).

4. ICH, Q9 Guidance for Industry Q9 Quality Risk Management, June 2006.

5. FDA, Pharmaceutical CGMPs for the 21st Century: A Risk-Based Approach, (Feb. 2003).

6. ICH, Q8 (Q8R) ICH Harmonized Tripartite Guideline, Pharmaceutical Development, Q8(R1) Step 4 version, Nov. 13, 2008.

7. ICH, Guidance for Industry, Q7A Good Manufacturing Practices for Active Pharmaceutical Ingredients, (Aug 2001).

ASTM, E–2537–08 Standard Guide for Application of Continuous Quality Verification to Pharmaceutical and Biopharmaceutical Manufacturing (Feb. 2003).