Medical Device Validation Explained: Process Validation and the IQ, OQ, PQ Stages

"Validation" is one of the most used and least consistently explained words in medical device quality. People use it for testing a design with users, for qualifying a machine, for checking a software tool and for proving that a sterilization cycle works. These are related ideas, but they are not the same activity, and mixing them up leads to gaps in documentation and confusion between engineering, quality and regulatory teams.

This article explains the common meanings, then focuses on the one that most often puzzles newcomers: process validation and its three stages, installation qualification (IQ), operational qualification (OQ) and performance qualification (PQ). It is general information about published guidance. It is not regulatory advice and it does not replace the standards that apply to a particular product.

Verification and validation: the basic split

Quality guidance for medical devices separates two questions.

• Verification asks: have the specified requirements been fulfilled? The Global Harmonization Task Force (GHTF) guidance on process validation defines verification as "confirmation by examination and provision of objective evidence that the specified requirements have been fulfilled."
• Validation asks: does the process consistently produce a result that meets its predetermined requirements? The same guidance defines process validation as "establishing by objective evidence that a process consistently produces a result or product meeting its predetermined requirements."

The word "consistently" is the heart of validation. A single good result shows that something worked once. Validation is about showing it will keep working.

Medical device quality systems use validation in more than one place:

1. Design validation concerns the design of the device itself. The GHTF process validation document says that specific recommendations for verification of design output and for design validation are covered in a separate GHTF document on design control.
2. Process validation looks at a manufacturing, servicing or installation process and asks whether it will reliably produce conforming product.
3. Software validation is a further kind of validation. The GHTF process validation guidance explicitly says that, although software may be an integral part of a computer-controlled process, it does not cover software validation.

The rest of this article concerns process validation.

When does a process need validation?

The GHTF guidance explains that some regulatory requirements state that every process that cannot be verified by subsequent monitoring or measurement must be validated. The guidance says process validation is vitally important where the predetermined requirements of the product can only be assured by destructive testing, and that processing deficiencies may only become apparent after an intermediate component is further processed or the finished product is in use. Sterilization is listed among its examples of processes that should be validated.

If the output can be verified and verification alone is sufficient to eliminate unacceptable risk and is cost effective, the guidance's decision model points to verifying and controlling the process rather than validating it. The guidance also notes that a manufacturer may decide to validate a process to improve overall quality, eliminate scrap, reduce costs or improve customer satisfaction, and that a validated process combined with properly controlled design and development activities may reduce time to market. The guidance includes a decision tree for deciding whether a process needs validation.

The three stages: IQ, OQ, PQ

The GHTF guidance describes validation in three phases: an initial qualification of the equipment and the services it needs, a demonstration that the process produces acceptable results with limits established for its parameters, and establishment of long-term process stability. These are the familiar IQ, OQ and PQ.

Installation qualification (IQ): is it installed correctly?

The guidance defines IQ as establishing by objective evidence that all key aspects of the process equipment and ancillary system installation adhere to the manufacturer's approved specification, and that the supplier's recommendations have been suitably considered. The document sums it up simply: is it installed correctly?

Considerations it lists include:

• Equipment design features, such as materials of construction and cleanability.
• Installation conditions, such as wiring, utilities and functionality.
• Calibration, preventive maintenance and cleaning schedules.
• Safety features.
• Supplier documentation, drawings and manuals.
• Software documentation and spare parts lists.
• Environmental conditions, such as cleanroom requirements, temperature and humidity.

The guidance adds an important caution. Equipment suppliers sometimes run tests at their own site before shipment, and copies of those qualification studies can be used as guides and to supplement IQ, but it is usually insufficient to rely solely on the supplier's validation results. Each device manufacturer is ultimately responsible for evaluating, challenging and testing the equipment and deciding whether it is suitable for its own device.

Operational qualification (OQ): what are the limits?

OQ is defined as establishing by objective evidence process control limits and action levels which result in product that meets all predetermined requirements. In this phase the process parameters are challenged to show they produce acceptable product under all anticipated conditions of manufacturing, including worst-case conditions.

Considerations listed in the guidance include process control limits such as time, temperature, pressure and line speed; software parameters; raw material specifications; operating procedures; material handling; change control; training; short-term stability and capability; and potential failure modes and worst-case conditions, for which methods such as failure mode and effects analysis can be used. The guidance adds that screening experiments can be used to establish key process parameters and statistically designed experiments to optimize the process.

In plain terms, OQ finds out how far the process can be pushed before it stops producing acceptable product, and sets the operating window and the action levels that keep production well away from the edge.

Performance qualification (PQ): does it hold up in real production?

PQ is defined as establishing by objective evidence that the process, under anticipated conditions, consistently produces a product which meets all predetermined requirements. The key objective is to demonstrate that the process will consistently produce acceptable product under normal operating conditions, using the actual product and the parameters established during OQ.

PQ considerations include the acceptability of the product, process capability, repeatability and long-term stability. The challenges to the process should simulate the conditions met in actual production.

The validation protocol and the final report

None of these stages works without a plan. The GHTF guidance describes a process validation protocol as a document stating how validation will be conducted, including test parameters, product characteristics, manufacturing equipment and decision points on what constitutes acceptable test results. It also says that records of all validation activities should be kept and the final outcome documented.

A typical validation package therefore contains a plan or master document, individual protocols for IQ, OQ and PQ, executed test records with any deviations explained, and a final report that summarizes and references the protocols and results and states conclusions about the validation status of the process.

Keeping a process validated

Validation is not a one-time event. The guidance observes that small, unnoticed changes in raw materials or processes can cumulatively affect the validation status, and that periodic revalidation should be considered for such processes. It lists examples of reasons for revalidation, including:

• changes in the actual process that may affect quality or its validation status;
• negative trends in quality indicators;
• changes in product design that affect the process;
• transfer of the process from one facility to another;
• a change in the application of the process.

Revalidation does not always mean repeating everything. The guidance gives the example of buying a new machine for an already validated process: the IQ must be repeated, most of the OQ may already be established, and some PQ elements may need to be repeated depending on the impact.

Where this sits in today's US framework

In the United States, the FDA's Quality Management System Regulation (QMSR) took effect on February 2, 2026. It amends 21 CFR Part 820 by incorporating the international standard ISO 13485:2016 by reference. The GHTF document predates this change (it is dated January 2004, Edition 2, and was revised to align with ISO 13485:2003), is guidance that says it must not be used to assess compliance with quality management system requirements, and was written against earlier quality system language, so it is best read as a well-established explanation of the concepts, not as the current legal text. Anyone preparing real procedures should check the current regulation, the applicable clauses of ISO 13485 and any product-specific standards.

Practical tips for small teams

• Write down which processes you validate and why, and keep the decision record.
• Qualify the equipment before you challenge the process. An unqualified machine makes OQ data hard to interpret.
• Define acceptance criteria before running tests, not afterwards.
• Include worst-case conditions in OQ, not only the comfortable middle of the range.
• Make change control and revalidation triggers part of the procedure from the start.

The short version

Verification checks that requirements were met. Validation shows that a result is consistently achieved. For a manufacturing process that means IQ (installed correctly), OQ (the limits are known and the process is robust inside them) and PQ (it performs consistently under real conditions), supported by a protocol, documented evidence and a plan for revalidation.

This article is general information for readers interested in medical technology quality. It is not regulatory, legal or medical advice.

Sources

• GHTF Study Group 3, Quality Management Systems - Process Validation Guidance, GHTF/SG3/N99-10:2004 (Edition 2), January 2004. PDF copy: https://gmp-compliance.org/files/guidemgr/ghtf-sg3-n99-10-2004-qms-process-guidance-04010.pdf
• FDA, Quality Management System Regulation (QMSR): https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr