Validation of special processes via IQ/OQ/PQ protocols with defined revalidation criteria — 820.75 framework preserved under ISO 13485 7.5.6.
Sterilization and sterile-barrier processes have explicit separate validation requirements (7.5.7); FDA's lifecycle Stage 1/2/3 approach remains an inspection expectation.
Revalidation trigger documentation and continued process verification records — Stage 3 ongoing monitoring is the most common gap after IQ/OQ/PQ.
Maps to
QMSR / ISO 13485: §820.75 Process validation.
ISO 13485: §7.5.6 Validation of processes for production and service provision
Requirement text
Processes where the output cannot be fully verified by subsequent monitoring or measurement shall be validated.
Why this clause exists
Process validation applies specifically to special processes — those whose output conformance cannot be fully verified after the fact through inspection or testing alone. Sterility is the canonical example: a finished sterilized device cannot be tested for sterility without destroying it, so the manufacturer must demonstrate, in advance, that the process reliably produces sterile product whenever run within defined parameters. The same principle applies to welding, adhesive bonding, potting, aseptic filling, and software-executed manufacturing processes: the product's conformance is determined at the time of processing, not at the time of inspection. Requiring validation before these processes enter production protects against a failure mode where manufacturing runs proceed under untested conditions with no reliable basis for confidence that output meets specification. The IQ/OQ/PQ structure (Installation Qualification, Operational Qualification, Performance Qualification) provides a staged framework: confirm the equipment is installed as specified, confirm it operates as specified across its qualified range, and confirm it produces conforming output at production scale using production materials and personnel. Revalidation criteria are part of the original validation package, not an afterthought, because equipment changes, process parameter drift, and significant volume changes can all move a validated process outside its demonstrated capability — without pre-defined revalidation triggers, organizations have no systematic basis for recognizing when a previously validated process state has been departed.
What changed
§820.75 — Part 820 (legacy)
"Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures. The validation activities and results, including the date and signature of the individual(s) approving the validation and where appropriate the major equipment validated, shall be documented. Each manufacturer shall establish and maintain procedures for monitoring and control of process parameters for validated processes to ensure that the specified requirements continue to be met. (1) Each manufacturer shall ensure that validated processes are performed by qualified individual(s). (2) For validated processes, the monitoring and control methods and data, the date performed, and, where appropriate, the individual(s) performing the process or the major equipment used shall be documented. When changes or process deviations occur, the manufacturer shall review and evaluate the process and perform revalidation where appropriate. These activities shall be documented."
§7.5.6 — ISO 13485:2016 (current)
"The organization shall validate any processes for production and service provision where the resulting output cannot be or is not verified by subsequent monitoring or measurement and, as a consequence, deficiencies become apparent only after the product is in use or the service has been delivered. Validation shall demonstrate the ability of these processes to achieve planned results consistently. The organization shall document procedures for validation of processes, including: a) defined criteria for review and approval of the processes; b) equipment qualification and qualification of personnel; c) use of specific methods, procedures and acceptance criteria; d) as appropriate, statistical techniques with rationale for sample sizes; e) requirements for records (see 4.2.5); f) revalidation, including criteria for revalidation; g) approval of changes to the processes. The organization shall document procedures for the validation of the application of computer software used in production and service provision. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application. The specific approach and activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software, including the effect on the ability of the product to conform to specifications. Records of the results and conclusion of validation and necessary actions from the validation shall be maintained (see 4.2.4 and 4.2.5)."
Δ Validation procedure must now enumerate acceptance criteria, statistical technique rationale, and explicit revalidation criteria; software used in production requires risk-proportionate validation as a standalone requirement.
Common gaps (what we see in audits)
- Missing Lifecycle Approach to Process Validation — Many Part 820-era QMS libraries treat process validation as a one-time IQ/OQ/PQ event with no ongoing monitoring. ISO 13485:2016 and the FDA's 2011 Process Validation Guidance require continued process verification (Stage 3) with defined statistical methods for ongoing process monitoring. Without this, validated processes may drift out of control undetected.
- No Statistical Techniques for Process Capability — Process validation protocols often lack statistical rationale for sample sizes and do not demonstrate process capability (Cpk/Ppk). ISO 13485 clause 7.5.6 requires use of specific methods and procedures, and FDA guidance expects statistical evidence of process capability.
- Inadequate software validation (CAM/PLC) — Software used in production (e.g., PLC logic or CAM files) was never validated for its intended use. ISO 13485 §7.5.6 requires validation of such software.
- Incomplete Personnel Qualification Records — ISO 13485 clause 7.5.6 explicitly requires qualification of personnel performing validated processes. Many Part 820-era systems document equipment qualification but fail to maintain evidence that operators are trained and competent specifically on validated processes.
- Undefined Revalidation Triggers — Revalidation criteria are often vague or missing entirely. Companies may revalidate after equipment changes but lack defined triggers for material changes, supplier changes, process parameter deviations, or facility moves.