CQV in Life Sciences: A Step-by-Step Guide to Validating Facilities, Utilities, Equipment, and Processes

Commissioning, Qualification, and Validation (CQV) are essential concepts in pharmaceutical manufacturing. CQV ensures that equipment, systems, and processes function as intended and consistently produce high-quality products. To meet regulatory expectations, CQV must align with Good Manufacturing Practices (GMP), safeguarding production quality, patient safety, and compliance. As agencies such as the FDA and EMA increase scrutiny, decision-makers face the challenge of delivering compliant facilities, utilities, equipment, and processes while also managing costs, timelines, and resource constraints.

This is where Network Partners Group (NPG) provides significant value. Our experienced consultants bring deep technical expertise and industry best practices to support organizations in navigating the complexities of CQV. From strategy through execution, NPG partners with clients to ensure inspection readiness, compliance, and operational excellence. Our approach strengthens key areas such as CAPA management and medical device remediation, giving companies confidence in both regulatory submissions and day-to-day operations.

Why CQV Matters for Decision Makers

• Regulatory Compliance: FDA, EMA, and ICH guidelines require robust CQV programs to demonstrate control over manufacturing environments and processes. Non-compliance can result in delays, warning letters, or product recalls.
• Operational Efficiency: Proper CQV reduces long-term risk and rework by establishing reliable systems from the start.
• Business Continuity: Streamlined CQV ensures facilities, utilities, and processes are validated on schedule – avoiding costly production delays.
• Risk Mitigation: Effective CQV minimizes product failures, contamination, and safety risks, protecting both patients and company reputation.

Decision-makers should view CQV not as a box-checking exercise, but as a strategic investment in the long-term success of their operations. By embedding best practices in process validation and QMS implementation, organizations create a compliance framework that supports sustainable growth.

The purpose of this thought paper is to clarify the CQV lifecycle and provide a structured approach that can be applied when planning or executing CQV initiatives.

Foundation: Building a Robust CQV Strategy

It is extremely important to integrate CQV into early project planning. Doing so minimizes waste and lowers manufacturing costs through improved efficiency.

CQV ensures adherence to regulatory compliance (e.g., FDA, EMA, ICH Q8/Q9/Q10) and global quality standards. The FDA provides guidance documents that interpret federal codes and offer further context, such as 21 CFR 211. ICH Q9 stresses the importance of quality systems in the pharmaceutical industry, identifying CQV as a critical element of an effective system. By embedding CQV into these frameworks, organizations can better identify, assess, and control risks to product quality—strengthening overall compliance, consistency, and reliability in pharmaceutical manufacturing.

A robust strategy also supports QMS implementation and supplier quality, ensuring that every stage of the lifecycle is aligned with industry standards and inspection readiness.

Several validation models have been created for CQV. One example is the V-Model used in software development, also known as the Verification and Validation Model (see Figure 1). The V-Model is a software development lifecycle (SDLC) framework that emphasizes the association of a testing phase for each corresponding development stage. It is structured in a V-shape:

• The left side represents verification phases.
• The right side represents validation phases.
• The coding phase connects them at the base.

Verification is an inactive analysis method, where testing is carried out without administering the code—for instance, inspection, reviews, and walk-throughs. Validation is a dynamic analysis method, where testing is carried out by administering the code. Functional and non-functional testing systems both fall under validation.

The advantages and disadvantages of the V Model are:

• Advantages
  • Early detection and correction of defects
  • Clear and well-defined requirements
  • Structured and methodical approach
  • Ensures adequate testing coverage
  • Emphasizes verification and validation
• Disadvantages
  • High upfront planning and documentation
  • Limited flexibility and adaptability
  • Time-consuming and costly
  • May not be suitable for agile development
  • Limited stakeholder involvement

Another V-Model was later adapted for equipment and system qualification, as illustrated in Figure 2. On one side of the V are the specifications, while the other side represents the testing conducted against those specifications to formally qualify the equipment or system. At the bottom of the V is where the equipment or system is built. Commissioning testing is implicitly embedded in this model, often performed through factory acceptance tests (FATs) and site acceptance tests (SATs).

However, this model does not fully incorporate science- and risk-based elements. It lacks references to product and process understanding, which form the scientific foundation for specifications. Likewise, opportunities to simplify the testing side of the V through risk assessments are not reflected. Links to ICH Q9 and ICH Q8 are also missing.

Despite these limitations, the V-Model remains a usable framework for illustrating fundamental CQV requirements. When paired with modern approaches such as CAPA management and medical device remediation, organizations can better align validation practices with inspection readiness and long-term compliance goals.

Another model, the W Model, although not set up as a risk-based model, paved the way for a subsequent iteration that uses quality risk management (QRM) to simplify qualification efforts by bringing the commissioning elements outside of the system build box on the V-Model.

The W-Model added more granularity to what was later identified as verification testing. That is, both commissioning testing (FATs and SATs) and qualification testing (IQ, OQ, PQ).

When the FDA and International Council for Harmonization (ICH) of Technical Requirements for Pharmaceuticals for Human Use published and promoted the concept of QRM and increased awareness about product and process understanding, by promoting ICH Q8, a risk-based validation model was developed. This model was identified as “The Specification, Design, and Verification Process”. See Figure 4.

This model introduced Risk Management and emphasized the presence and involvement of subject matter experts (SMEs) with product and process knowledge – balanced with adherence to regulatory requirements and the company’s own quality procedures.

In 2019, the International Society for Pharmaceutical Engineering (ISPE) published a revised version of its Baseline Guide for Commissioning and Qualification. The model discussed in this guideline relies on having SMEs from the engineering and equipment side work alongside other experts from regulatory and quality to establish the user requirements. Once the requirements are established, each facility, utility, system, and equipment are classified as having direct or non-direct impact on product quality. The model shows an improved QRM process that feeds into a Design Review/Design Qualification process.

Regardless of the model followed, the key documents for initiating CQV are

• User Requirements Specification (URS)
• Functional and Design Specifications (FRS/DS)
• Traceability Matrix (TM)

As illustrated in Figure 5.

It is extremely important to establish a cross-functional CQV team from the outset. This team should include representatives from Quality, Engineering, Facilities/Utilities, Validation, and Regulatory, along with any other impacted departments. Involving all stakeholders early ensures clear alignment on responsibilities, timelines, and departmental impact.

A collaborative approach not only strengthens accountability but also supports QMS implementation and supplier quality. By engaging the right expertise upfront, organizations are better positioned to achieve inspection readiness, streamline process validation, and avoid costly delays later in the CQV lifecycle.

Step-by-Step Guide to Validating Facilities, Utilities, Equipment, and Processes

Step 1: Commissioning

The first step in CQV is developing the User Requirement Specification (URS). The URS acts as a blueprint that defines the intended functions, performance, and regulatory needs of equipment, systems, or facilities within regulated industries. It aligns user expectations with design, compliance, and quality assurance standards to ensure projects deliver systems that meet their intended purpose.

The URS is a clear, user-focused document that outlines what a system is expected to do, why it is needed, and how it should perform under specific conditions. In the CQV process, the URS is essential for defining risk-based requirements that concentrate on quality-critical aspects of the system. Both the European Medicines Agency (EMA) and the FDA encourage risk-based approaches, stressing that not all functions of equipment require equal validation. A URS highlights the high-risk features of equipment, ensuring CQV efforts remain focused on areas where failures could affect product quality, patient safety, or regulatory compliance.

This early stage in the CQV process is crucial, as it informs subsequent phases of system design, risk assessment, and ultimately, testing and validation. Strong commissioning practices also reinforce QMS implementation and CAPA management, creating a foundation for inspection readiness and long-term operational success.

The next step in the CQV process is the Design Qualification (DQ).

Design Qualification (DQ)

The Design Qualification (DQ) provides documented verification that the design of a new or modified direct impact system will result in a system that is suitable for its intended purpose. The primary objective of the DQ is to verify that the critical aspects (CAs) and critical design elements (CDEs) necessary to control risks to product quality and patient safety—identified during risk assessments—are incorporated into the design.

According to the ISPE Baseline Guide Volume 5: Commissioning and Qualification Second Edition, Design Review (DR) and Design Qualification (DQ) are not intended as separate activities, but rather as separate documentation. DQ focuses on CAs/CDEs and involves the Quality Unit as an approver. Duplication of work should be minimized. The final report from DR serves as a key input into the DQ process. DR is an engineering deliverable that ensures all aspects of the User Requirement Specification (URS) are checked against vendor design submissions, including quality, business, Environmental Health and Safety (EHS), and other requirements. DQ then refines this work by documenting critical design controls, typically requiring approval from the Quality Unit.

The CQV process for facilities and utility systems—such as HVAC, water systems, clean steam, and compressed gases—requires a systematic approach to ensure systems are designed, installed, tested, and maintained in accordance with operational requirements. This process is essential for regulatory compliance and product safety, following guidelines from the FDA, EMA, and others. Examples include 21 CFR 211.42 for Buildings and Facilities, Annex 15 of the EU GMP Guide, AAMI TIR52, ISO 8573, and ISO 14644. Robust oversight in these areas also contributes to inspection readiness and strengthens long-term reliability.

Another critical document in the CQV process is the Traceability Matrix (TM). The TM maps requirements to test cases, enabling comprehensive testing and verification. It enhances communication among stakeholders, supports compliance, and provides a clear, structured way to track relationships between requirements, design documents, test cases, and related artifacts. By maintaining a well-structured TM, organizations streamline CQV processes, improve quality assurance, and reinforce CAPA management and QMS implementation.

Step 2: Qualification

The Qualification step in CQV is a critical phase that ensures equipment and systems are fit for their intended purpose. It involves several stages:

• Installation Qualification (IQ): Verifying that equipment and systems are installed according to specifications.
• Operational Qualification (OQ): Confirming equipment and systems operate within defined parameters and perform as expected under normal operating conditions.
• Performance Qualification (PQ): Validating that equipment and systems perform effectively and consistently under real-world conditions.

These steps are essential for compliance with regulatory standards and for maintaining the integrity of the product and the trust of consumers.

Factory Acceptance Tests (FATs) and Site Acceptance Tests (SATs) can help streamline IQ and OQ when supported by Quality oversight and stakeholder input. However, verification tests must still be performed once equipment is installed onsite. A Master Validation Plan serves as a valuable tool, outlining the company’s validation strategy along with key roles and responsibilities.

During IQ, instrument calibration must be addressed. Calibration intervals should be risk-based, determined by instrument criticality, and supported by proper maintenance schedules in line with manufacturer recommendations.

Many systems also require Computer System Validation (CSV), often referred to as software validation. The FDA defines software validation as “confirmation by examination and provision of objective evidence that software specifications conform to user needs and intended uses, and that the particular requirements implemented through software can be consistently fulfilled.” This definition highlights the need for:

• Confirmation by examination: Defined user needs and intended uses must be documented and verified.
• Provision of objective evidence: All validation activities and test results must be documented.
• Defined user needs and intended uses: Software must be tested against these needs through reviews, testing, and inspections.
• Particular requirements implemented: Requirements must be consistently fulfilled, not just in isolated scenarios.
• Consistency – Objective evidence must prove consistent functionality for inspections.

By ensuring proper qualification, organizations strengthen inspection readiness and create a foundation for risk-based compliance that supports CAPA management and long-term operational efficiency.

Step 3: Process Validation

In 2011, the FDA published “Guidance for Industry: Process Validation: General Principles and Practice.” This guidance introduced a lifecycle approach, moving from process qualification to validation across three stages (see Figure 4):

1. Process Design: The commercial manufacturing process is defined based on development and scale-up activities.
2. Process Qualification: The design is evaluated to ensure reproducible commercial manufacturing. This includes:
   • Design of facilities, equipment, and utilities: Covers all C&Q activities for systems and infrastructure.
   • Process Performance Qualification (PPQ): Demonstrates consistent reproducibility, typically through three consecutive successful batches.
3. Continued Process Verification (CPV): Ongoing assurance that the process remains in a state of control during routine production. CPV includes:
   • Monitoring of process parameters.
   • Trending of data.
   • Change control and retraining.
   • Corrective and preventive actions (CAPA).
   • Periodic review of maintenance and calibration records, based on risk and system classification.

This lifecycle approach aligns directly with best practices for process validation and ensures companies maintain robust compliance frameworks while building resilience against deviations. It also integrates smoothly with QMS implementation to enhance oversight and continuous improvement.

In 2015, the EU published “Annex 15, Qualification & Validation” as part of the EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use. The next year, EMA published two process validation guidelines that were aligned with the lifecycle approach by the FDA. By combining these guidelines, a fully integrated CQV operational lifecycle model was developed.

The Integrated CQV Lifecycle Model

The Integrated CQV Lifecycle Model is not applied uniformly across every type of validation. Instead, CQV projects should be divided into distinct workstreams depending on the type of validation—facility, utility, system, equipment, or process—and whether the system has direct or indirect product contact. Complex CQV projects often require multiple parallel workstreams and careful oversight at each step. For these projects, it is best practice to establish a detailed project plan that incorporates the most effective model for the situation.

Key elements of the integrated model include:

• Integration with equipment qualification.
• Ensuring traceability from URS → PQ.
• Emphasis on critical quality attributes (CQAs) and critical process parameters (CPPs).
• Leveraging statistical tools and sampling strategies.

Common Pitfalls During CQV

Despite its importance, CQV efforts often fail due to recurring pitfalls:

• Skipping or under-documenting URS/DQ: Collecting comprehensive user requirements is challenging in complex projects with many stakeholders. Incomplete requirements can result in redesigns, operational inefficiencies, or compliance gaps. URS documents must be detailed enough to provide clarity without limiting design flexibility, and they should be continuously updated.
• Incomplete traceability matrix: Failing to link URS and DQ to validation activities can cause costly errors and gaps in regulatory compliance.
• Treating CQV as a checklist: CQV should be managed as a lifecycle, not a one-time exercise.
• Failure to engage Quality/Regulatory early: These stakeholders are critical for ensuring validation aligns with compliance and submission requirements.
• Neglecting risk-based approaches: Without risk assessment, organizations miss opportunities to streamline efforts while maintaining quality.

Avoiding these pitfalls requires strong alignment with QMS implementation, proactive planning, and early involvement of regulatory experts.

Best Practices and Lessons Learned

Organizations can strengthen their CQV framework by applying industry best practices, including:

• Early stakeholder involvement: Engage subject matter experts (SMEs) from the start for clear guidance and direction.
• Risk-based approaches: Align with frameworks such as ASTM E2500 and ISPE to ensure work is value-added and efficient.
• Digital tools: Use digital solutions for documentation and traceability to simplify reviews, approvals, and change control.
• Strong change control: Maintain a documented history of alterations and their rationale to ensure traceability and provide a foundation for continuous improvement.

Embedding CAPA management and medical device remediation within these practices further enhances inspection readiness and resilience.

Key Takeaways for Successful CQV

• Audit your current CQV approach regularly to identify gaps.
• Leverage experienced CQV consultants for major projects, such as facility expansions or tech transfers.
• Align validation activities with risk-based models to ensure compliance without overspending.

Conclusion

Establishing a robust CQV framework is only the beginning. Success comes from applying these principles consistently across your facilities, utilities, equipment, and processes. Early planning, risk-based approaches, and cross-functional collaboration are all essential to staying compliant and avoiding costly delays.

NPG supports life sciences organizations at every stage of the CQV lifecycle—from strategy and planning through execution and remediation. Whether your project involves facility expansions, tech transfers, or process validation, our team provides the expertise and leadership you need. Contact NPG to learn how we can help move your CQV program forward with confidence.

Frequently Asked Questions (FAQ)

1. What is the purpose of CQV in pharmaceutical and medical device manufacturing?

CQV ensures that facilities, utilities, equipment, and processes are designed, tested, and validated to meet regulatory standards. This safeguards product quality, patient safety, and compliance with agencies such as the FDA and EMA.

2. How does CQV support inspection readiness?

By documenting activities such as URS, DQ, IQ/OQ/PQ, and process validation, CQV creates a clear trail of compliance evidence. This allows companies to demonstrate control over systems during inspections, reducing the risk of findings or enforcement actions.

3. What role does CAPA management play in CQV?

CAPA management is critical for addressing issues uncovered during qualification or validation. By systematically documenting and correcting deficiencies, companies can ensure long-term compliance and maintain a state of control across the CQV lifecycle.

4. How does medical device remediation tie into CQV?

Medical device remediation ensures that legacy systems or non-compliant equipment are brought up to current regulatory standards. Integrating remediation into CQV activities reduces compliance risks and helps companies avoid costly recalls or regulatory penalties.

5. Why is a traceability matrix important in CQV?

A Traceability Matrix (TM) links requirements to test cases, ensuring that no critical function is overlooked. It enhances communication between stakeholders, improves quality assurance, and supports QMS implementation.

6. What are the most common pitfalls in CQV?

Organizations often struggle with incomplete URS/DQ documentation, poor traceability, failure to apply risk-based approaches, or lack of early stakeholder involvement. Addressing these gaps is essential to avoid delays, inefficiencies, or compliance issues.