Second of a two-part article published in Pharmaceutical Technology magazine in January 2006.
Part 2 describes protocol development and implementation (including advice and lessons learned), preparation of turnover packages, and the evaluation and management of deviations.
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...
Essentials of Validation Project Management - Part 2
1. DATA AND REVIEW
Essentials of Validation
Project Management
Part II
William Garvey
A
ll pharmaceutical validation projects are labor and
capital intensive, and each must be planned and man-
aged carefully. Numerous tasks and activities must be
identified early and then scheduled to support the
project completion date. Stakeholders such as the Quality As-
surance (QA) and Calibration–Metrology departments must
be alerted to impending increased workloads under com-
pressed time frames. Standard operating procedures (SOPs)
and protocol formats must be developed, test equipment must
be purchased or rented, and contractors must be evaluated
and hired. Managers must decide whether the US Food and
Drug Administration will participate in the design review
process, and if so, what will be the agency’s exact involvement
and participation. Considering the set of activities and pro-
grams that require timely completion, pharmaceutical vali-
dation projects must be carefully organized, managed, and
PFIZER INC.
monitored.
Part I of this article covered the following four critical com-
ponents common to all successful validation projects: design
In the second half of this two-part series, the review to ensure GMP compliance, project scope definition,
project labor and cost estimating, and validation master plan
author suggests that to qualify and validate a
development (1). Part II of this article introduces three ad-
pharmaceutical manufacturing facility, one must
ditional programs, thereby providing validation project man-
coordinate protocol and SOP development,
agers and participants the knowledge to plan and execute a
scheduling and implementation, turnover project properly, no matter how difficult or complex. This
package preparation, and the management and final article also examines activities that are initiated well after
resolution of deviations and discrepancies. In project inception and often continue to project completion
and operations:
combination with the programs described in Part
• protocol and SOP development, scheduling, and imple-
I, these activities will help deliver projects on
mentation;
schedule, at estimated cost, and with quality
• turnover package preparation;
assured. • deviation and discrepancy management.
This article does not present a detailed discussion of
system-specific validation technologies because preparation
William Garvey is Validation Consultant at
and field execution of protocols are usually highly customized
Millipore Corporation (Billerica, MA).
by system and are beyond the article’s scope. General guide-
Phone: (781) 533-2407.
lines that are useful for protocol development and execution
Email: William_garvey@millipore.com
are described, however.
Submitted: Sept. 1, 2005. Accepted: Oct. 10, 2005.
The concept of turnover packages (TOPs) as applied to
8
2. pharmaceutical projects also are discussed. TOPs for biophar- mat has evolved in such a way that many once obscure fea-
maceutical projects were first described in the late 1980s and tures are now standard from company to company and from
have evolved into systems used by many engineering firms consultant to consultant. Although no regulatory expectations
and manufacturers. Finally, this article reviews the manage- or requirements exist for protocol format, all protocols must
ment and resolution of protocol deviations. Deviations are provide the documentation that proves the system or equip-
commonplace and tend to increase in frequency with increas- ment was installed and operates according to design. Conse-
ing equipment complexity. These three programs, when com- quently, the following guidelines and lessons learned are note-
bined with those described in the preceding article, can assist worthy and should be considered during protocol
project managers to deliver a validated facility on time and at development.
Preparing protocol forms. By definition, validation is the es-
budget. Equally important, quality will be evident, the tran-
sition time to operation will be shortened, and regulatory ex- tablishment of documented evidence that provides a high de-
pectations will be satisfied. gree of assurance that a specific process will consistently pro-
duce a product that meets its predetermined specifications
Protocol and SOP development, and quality attributes (2). Emphasis has been added, because
scheduling, and implementation nowhere in the regulations is it stated that the validation of
Protocols and SOPs are fundamental to all validation proj- equipment and systems must be absolute. Absolute assurance
ects, and are required by all regulatory agencies for compli- is impossible to attain and attempts to reach this level of con-
ant facilities. Protocol and SOP development usually makes fidence come at high cost, both financial and labor related (3).
up 30–40% of all labor on a typical validation project, and Applying this basic principle to protocol preparation, docu-
therefore, document quality and efficient preparation can- ments should be prepared with the following considerations.
not be understated. In general, approved protocols and draft For installation qualification (IQ), carefully manage the
SOPs must be delivered to coincide with certain milestones breadth and depth of equipment and system inspection and
in the facility construction schedule, and therefore, careful verification. For example, a typical piping and instrumenta-
planning and scheduling are essential. tion diagram (P&ID) for a sterilizer or water-for-injection
One overriding principle that is central to all validation (WFI) system literally contains hundreds of individual pieces
projects is that construction will not wait for protocol prepa- of field-verifiable information. These pieces can range from
ration, review, and approval. The validation team must de- the obvious (e.g., pump manufacturer and model number)
liver field-ready protocols that are suitable for implementa- to less critical items (e.g., the size of electrical conduit) to the
tion when mechanical systems are installed and started. The least important (e.g., type of covering on pipe insulation).
construction schedule must be interpreted and fully under- Although confirming that the proper centrifugal pump is in-
stood. Late protocol delivery often means that verifications stalled will ensure product quality, an exhaustive inspection
and inspections will become more complicated, or even of pump subcomponents will not provide the same benefit.
missed entirely. System access is reduced or eliminated, and It must be remembered that most pharmaceutical equipment
the personnel responsible for installation and start-up may is supplied and installed by reputable vendors and contrac-
have left the site. Unfortunately, failure to deliver protocols tors (4). Therefore, the opportunity to detect and correct er-
on time usually extends the validation schedule far beyond rors occurs long before the item is shipped and installed. The
the established completion date, thus adding cost and creat- tendency and temptation in validation is to over-specify and
ing conflicts for resources and personnel. Neither of these over-inspect. This should be avoided because all inspections
outcomes are desirable, but they can be avoided with proper must be meaningful and contribute to the high degree of as-
planning and management. surance described previously.
Very early in the project, protocol and SOP formats must One way to manage IQ tests and verifications is through
be standardized and approved for use. In general, the SOP the careful design of protocol forms and attachments. In the
format is usually well established at project inception; there- early history of pharmaceutical validation, engineers and sci-
fore, companies rarely need to modify document templates entists often inspected equipment and systems with design
for project purposes. Protocol format, however, is often a dif- specifications in hand. Although this method always achieved
ferent matter. Historically, protocol content and arrangement IQ objectives, validation personnel were frequently hindered
have varied widely within the industry, although some har- by the large number of individual specifications contained
monization is now evident. Employing different contractors in these design documents. Many specified features were not
on projects, each with different standard offerings, can lead verifiable or were verifiable only with much difficulty and ex-
to format inconsistency. Many equipment vendors now sup- pense (e.g., pump impeller material of construction).
ply very detailed protocols that differ considerably from those To avoid this dilemma, protocols have evolved to contain
prepared in-house or by consultants. And within companies, forms, similar to those in batch records, that force the compar-
preferences of individual departments and divisions often ison between actual and design information. These forms sat-
cause protocol layout and content to deviate from the ac- isfy regulatory requirements and provide a concise and organ-
cepted standard. Fortunately, however, industry protocol for- ized document when implemented. In general, validation
9
3. DATA AND REVIEW
Figure 1: Suggested form for installation qualification verification. Figure 2: An example of an installation qualification verification form.
Companies should create a form for each major piece of equipment, This form is for an air-handling unit chilled water supply and return.
instrument, or utility. In this example, the form applies to a large Shading indicates that the specification is unavailable.
central station air-handling unit. Shading indicates that the
specification is unavailable. be easily duplicated and customized for similar systems, and
implementation is organized and expedited. Furthermore,
personnel should create a form (see Figures 1 and 2) for each IQ acceptance criteria are easily stated and completely un-
major piece of equipment, instrument, or utility. Protocols for ambiguous: Information contained in actual column corre-
complex systems (e.g., WFI) will contain dozens of forms. sponds with information contained in specified column.
Separating IQ, OQ, and PQ documents. Many companies com-
Major components requiring inspection can be identified on
drawings by the assignment of unique numbers (e.g., Trans- bine IQ and operational qualification (OQ), or OQ and per-
mitter PIT-XXX, Fan EF-XXX, Pump P-XXX). Minor compo- formance qualification (PQ), into one document. Although
nents with an assigned tag number (e.g., hand valves, heating, this approach is sometimes practical, it is not always advis-
ventilation, and air-conditioning volume dampers, drains) can able for several reasons:
usually be omitted. Forms also may be correlated with critical • It is far easier to manage document review and approval
components and subsystems identified in the system TOP. when each validation phase (i.e., IQ, OQ, and PQ) is de-
The first column of each form (see Figures 1 and 2) lists at- scribed in its own protocol. Combined protocols for com-
tributes that require inspection and verification. The next col- plicated systems could be several hundred pages in length.
umn contains specifications and data. The third column,“Ac- • IQ implementation can begin while the OQ is being reviewed
tual,” is used to record actual data. Contents of each cell in and approved. Likewise, OQ can begin while the PQ proto-
columns 1 and 2 are determined by carefully reviewing design col is under review. Remembering that construction will not
documents, specifications, and submittals. Again, the attrib- wait for protocol review and approval, separating protocols
utes chosen for inspection are those that provide high assur- will improve the likelihood that documents are available for
ance of delivery and installation according to design. If a spec- implementation at critical construction milestones.
Omitting QA approval of IQ. Validation is a systematic and mul-
ification is unavailable, the corresponding cell is shaded and
actual data are entered for record purposes during execution. tidisciplinary undertaking comprising two predominating fields:
By carefully designing forms in this manner, the breadth engineering and science. Usually, IQ is the engineer’s responsi-
and depth of system inspection are controlled, protocols can bility, and PQ is the scientist’s specialty. OQ serves as a transi-
10
4. DATA AND REVIEW
tion between IQ and PQ and often has both engineering and with the facility construction schedule. This task is not easy.
scientific components. Because IQ is largely an engineering Validation commonly deals with mechanically complete sys-
function, some companies omit the QA approval of IQ proto- tems, while system construction proceeds in stages and by
cols entirely. Furthermore, acceptable OQ and PQ outcomes building sections. Manufacturing facilities should be turned
will often reinforce that systems were installed as designed. The over to the owner system by system, but this usually happens
regulatory risk associated with the exclusion of QA approval is only on fast-track projects. The construction manager should
low and will often expedite IQ review and approval. be encouraged to turn over each system in the order needed
Eliminating unnecessary or complicated tests. As described by validation (e.g., supporting systems first, followed by
previously, all validation inspection and testing should be process equipment). Rarely are individual systems and equip-
meaningful and demonstrate system or equipment compli- ment installed in their entirety and started. Usually, a section
ance with an approved design. Labor- and resource-intensive of a building is constructed, with each building trade being
inspections and tests that yield only a marginal increase in scheduled to perform a specific job. For example, riggers will
quality assurance should be avoided. This can include tripli- set a pump skid while pipefitters concurrently fabricate as-
cate testing of alarms and operational sequences when only sociated piping. Then, this work is followed by electricians,
a single verification is sufficient. Other marginal tests include who install conduit and pull conductors, followed by insula-
autoclave-jacket temperature uniformity (unless used for di- tors and the instrumentation and calibration teams. The out-
agnostic purposes) and the operation of hot WFI systems at come is that qualification, particularly IQ, is discontinuous
subprocess temperatures ( 70 C) for extended periods of with many starts and stops. Although 60 hours may have been
time. In addition, do not risk damage to systems and equip- allocated to implement a system’s IQ and OQ, the entire du-
ment to test an alarm. Running pumps dry to activate low- ration could be weeks or months, depending on the construc-
pressure or low-flow alarms is not a good practice. Chang- tion schedule (see Figure 3). It is the validation project man-
ing setpoints or equivalent methods can often simulate these ager’s responsibility to carefully review the construction
conditions. Above all, avoid specifying inspections and tests schedule to determine when systems will be mechanically
that are difficult to perform or implement, unless there is a complete, started, and turned over to the owner. On the basis
regulatory requirement or other compelling, beneficial need. of this review, a validation schedule can be prepared that may
Preparing acceptance criteria. All acceptance criteria must be synchronized with the construction schedule.
be based on system and equipment design, not arbitrarily as- Foremost, validation deals with complete systems, not sec-
signed or determined. Designs are based on both quantita- tions or portions, and the validation schedule must be
tive (numerical) and qualitative user requirements and in- arranged as such. System completion dates must be projected
dustry standards. If a certain quality or output is expected from the construction schedule and added to the validation
from an engineered system, the system is designed accord- schedule. Project management software such as Microsoft
ingly. Common examples include: Project (Microsoft Corporation, Redmond, WA) is commonly
• terminal high-efficiency particulate air (HEPA) filtration used to develop and maintain this schedule, although other
and high room air change rates, resulting in low airborne software is available and equally useful. Dependencies be-
particulate levels; tween construction and validation must be created in the val-
• high recirculating velocity ( 5 ft/s) and temperature ( 80 idation schedule to allow for construction delays or improve-
C), resulting in low bioburden in WFI systems; ments. When preparing a validation schedule from the
• full and segmented jackets on steam sterilizers to ensure underlying construction schedule, the following points should
and maintain chamber temperature uniformity. be considered:
Acceptance criteria should be set equal to, and in some • Target IQ approval and start of implementation to coin-
cases broader than, the underlying specification. It is a seri- cide when system or equipment construction is approxi-
ous, but common, mistake to assign acceptance criteria to a mately 25–50% complete. This timing will provide an ad-
system that exceeds the system’s capability or intent. Such an equate opportunity to perform all required inspections
error will lead to test failures and excessive, wasteful testing. while system access and construction personnel are still
Examples include particulate counting in compressed gas sys- available. Consequently, the preparation of the IQ proto-
tems for which filters are nonexistent or particle-additive, and col should begin 6–8 weeks before the target date to per-
using high population, high D-value bioindicators when low mit comprehensive review and approval by all participants.
F0 sterilization cycles (liquids) are validated. When design spec- Allow 5 days after system mechanical completion to com-
ifications may be unknown (e.g., for legacy systems), testing plete the majority of IQ inspections.
for information and baseline development (for future valida- • Schedule OQ approval and start of implementation to co-
tion needs) are the preferred acceptance criteria and avoid the incide when systems or equipment are started for the first
problems and deviations described previously. time, often during precommissioning. Again, allow 6–8
All successful validation projects are characterized by care- weeks minimum for protocol review and approval to en-
ful planning and scheduling of project activities. Early on, sure on-time availability. Except for minor, open items, IQ
validation deliverables must be identified and coordinated should be nearly complete before OQ implementation is
11
5. DATA AND REVIEW
Figure 3: A partial validation schedule integrated with a facility construction schedule.
started. Historically, OQ protocols have always been the price, it is unlikely that the construction team will delay fab-
most difficult to prepare, so planning is imperative. rication, installation, or start-up because protocol develop-
• Schedule PQ approval and the start of implementation ment and approval are late. It is essential to deliver approved
when commissioning is completed and the system is de- documents on time for implementation. Any delay results in
livered and accepted. IQ and OQ should be substantially opportunity lost, added expense, and a prolonged schedule.
complete and any open items should not affect system per- Equally important is the development of forms for record-
formance. These include common punchlist items such as ing data and information in IQ protocols. All protocols must
valve tagging, labeling, insulation, and the completion of be based on design information. Because specifications can
as-built drawings. PQ for supporting systems such as WFI be seemingly limitless for complex sanitary and process sys-
and clean-steam systems should start as soon as possible be- tems, the breadth and depth of inspection and testing must
cause these systems provide inputs to critical process systems be carefully managed. Acceptance criteria also must be based
such as sterilizers and washers. Delays in supporting and an- on design, not arbitrarily established when no specifications
cillary systems will only delay the qualification and valida- exist. Incorrect acceptance criteria often lead to test failures,
tion of equipment these systems were designed to support. unnecessary investigations, and needless expenditure of re-
• Concurrent with IQ protocol preparation, prepare corre- sources. Validation personnel should remember that valida-
sponding system and equipment SOPs such as operation, tion provides a high degree of assurance—not absolute as-
maintenance, and cleaning. SOPs should be available in surance—that a system was installed and operates according
draft form at IQ start and verified and validated during to design. Assurance approaching absolute comes at substan-
OQ. Ideally, each SOP should be approved for use when tial cost, usually manifested by unnecessary, irrelevant test-
PQ is completed to ensure that a fully compliant system is ing, numerous deviations, and schedule delays.
placed into routine service.
Turnover package (TOP) preparation
This section has addressed the preparation, scheduling, im-
plementation, and verification of protocols and SOPs. For an TOPs for pharmaceutical and biopharmaceutical facilities is
average facility, it is common to have 30 or more qualified and an optional, but important, program that was first described
validated systems, each with its own required documentation. formally around 1987 (5), although the concept originated
Clearly, careful upfront planning is required to ensure that all several years before then. In the late 1980s, the TOP program
validation activities are coordinated with the facility construc- was instituted at several new facilities, mainly biopharma-
tion schedule. Because most construction projects are fixed ceutical, by one large engineering firm specializing in biotech
12
6. DATA AND REVIEW
facility design, construction, and validation. Other compa-
nies quickly adopted the program. The objective then, as it
still remains today, is to shorten the duration required to com-
pletely validate a manufacturing facility. More specifically,
TOPs were designed to replace 90% of typical IQ inspec-
tions and verifications recorded in protocols, while still achiev-
ing the same degree of regulatory compliance. When a TOP
is properly planned and implemented, these objectives are
accomplished, with the added benefit of consolidated system
documentation available to the maintenance team at project
completion. In this respect, the TOP is the precursor for much
of the current industry effort to commission, rather than val- Figure 4: Boundary between two validated systems: purified water
idate, pharmaceutical facilities today. Nonetheless, the TOP system and fluidized-bed dryer make up air unit.
is still relevant, because it provides a definitive system base-
line for all validation activities, facility operations, and main- piping, and so forth, included in one system but excluded
tenance requirements that follow. from the other. The following suggestions may be useful when
TOP planning and development should begin early in the establishing system boundaries:
facility design process, preferably when P&IDs and airflow • Identify logical groupings of equipment (usually clustered
diagrams (AFDs) are approved. The TOP is a prevalidation on a single P&ID or AFD).
activity that continues until a system or piece of equipment • Verify independent operation. One system operates inde-
is transferred to the owner. The construction manager must pendently from an adjoining or supporting system (5).
be made aware of TOP requirements during the bidding It is the TOP coordinator’s responsibility, in consultation
process, not after, because the TOP may add to construction with other project team members, to define system and equip-
cost and schedule. Before beginning a comprehensive and or- ment boundaries. Once boundary drawings have been pre-
ganized TOP program, the following elements must be ad- pared, copies are transmitted to the construction manager
dressed or compiled: for reference purposes and the validation team to support
• A TOP coordinator is needed. This person is often a de- protocol preparation. The original highlighted drawing is in-
greed engineer or equivalent. serted into the corresponding TOP binder.
• System and equipment boundary drawings that demar- Concurrent with system boundary development, a list of
cate system–system interactions must be prepared. required forms, reports, certifications, drawings, and submit-
• TOP matrices that identify tests, inspections, and docu- tals for TOP inclusion is prepared by the coordinator and for-
mentation requirements for each validated system and warded to responsible parties, including equipment vendors,
piece of equipment must be prepared. Instrumentation–Calibration Departments, and the construc-
• Standardized, preapproved forms for documenting inspec- tion manager and subcontractors. Project participants may
tions and test results are required. be allowed to use their own standard documents (e.g., pres-
• All project stakeholders, particularly the construction man- sure test forms, cleaning certifications, calibration data sheets),
ager and subcontractors, must accept the program (5). provided these forms supply the detail and authentications
It is advisable that TOP implementation be integrated with required by GMPs. All vendor and contractor standard forms
and managed as part of the validation program, if possible. should be reviewed in advance, if possible. If these documents
There are several reasons for this. TOPs directly benefit the are unacceptable, test forms that meet both project and GMP
validation team because each TOP contains system drawings, requirements should be prepared and offered as replacements.
specifications, and manuals that are useful for protocol de- After boundary drawings and the document list have been
velopment and execution. Furthermore, the TOP contributes distributed, a matrix is prepared for each system or piece of
to overall facility GMP compliance. Most validation person- equipment where TOP is required. A spreadsheet is commonly
nel have QA backgrounds, with the attendant attention to de- used to organize the matrix. The left column of the spread-
tail and knowledge of GMP. sheet is subdivided into the following areas and disciplines:
A three-ring binder is allocated for each system or piece of • general information (e.g., submittals, purchase orders, and
equipment scheduled for TOP development. Multiple binders as-built drawings);
may be required for large or complex systems with many sub- • equipment (e.g., pumps, motors, tanks, AHU, and fans);
systems and components. Then, system boundaries are es- • piping;
tablished for each identified system (see Figure 4). Bound- • electrical (e.g., motor control centers, transformers, and
aries are usually designated by highlighting system drawings grounding);
(i.e., P&IDs and AFDs) to demarcate systems. Because utili- • instrumentation (e.g., temperature, level, and pressure
ties interface with or support other process systems and equip- transmitters);
ment, it is important to identify components, instruments, • controls and programmable logic controllers (PLC) (e.g.,
13
7. DATA AND REVIEW
so that missing items and other
important information can be
determined and identified by
simple review.
After matrices have been pre-
pared for all selected systems
and equipment, each matrix
must be approved by the con-
struction manager, facility
owner, TOP coordinator, and
QA department. Approval
demonstrates the importance
of TOP as a partial replacement
for IQ and helps reinforce the
value of TOP for expediting
project completion.
Each matrix is placed into the
corresponding system binder
along with the boundary draw-
ing. It is now the TOP coordi-
nator’s responsibility to moni-
Figure 5: Typical turnover package (TOP) matrix (1 of 6 total pages). tor construction progress and
to collect and file the documents
control valves, displays, PLC components, and input–out- identified in each matrix. Some of these documents relate to
put checkout); common inspections such as motor–pump alignment, pip-
• HVAC (e.g., air balance report and high-efficiency partic- ing pressure testing, and air balancing. In many instances, the
ulate air [HEPA] filter efficiency testing); TOP coordinator, along with the owner and a QA specialist,
• other (5). should witness field testing as performed. The product of this
Each area and discipline is further subdivided by the docu- testing (e.g., reports, certifications, and test forms) should be
ment type required to prove acceptable system installation and reviewed, approved, and added to the TOP binder. It is im-
precommissioning. Using process piping as an example, doc- portant to get construction manager agreement early that
uments to be assembled and filed with the TOP may include: tests and verifications will be witnessed because this may cause
• material certification; a momentary delay in the construction schedule while indi-
• piping pressure test; viduals are assembled to witness the test (5).
• line slope verification; In addition to test forms and certifications, equipment spec-
• cleaning verification. ifications, manuals, factory reports, and so forth should be in-
Similar documents that provide proof of satisfactory instal- cluded in each system TOP. Copies of red-lined drawings also
lation and operation also are identified for each of the disci- should be added until redrawn as-built drawings become avail-
plines (e.g., general and equipment) described previously. able. Because system TOPs may be consulted numerous times
The matrix is completed by reviewing each boundary draw- while construction is underway, control of incomplete binders
ing and then recording equipment numbers, instrument num- is essential. Validation staff often refer to information (e.g.,
bers, or line numbers in the cells in the top row (one num- manuals) in each TOP to prepare protocols and SOPs. Orig-
ber per cell) (see Figure 5). Only major, numbered items inal documents and test reports must not be accidentally re-
should be recorded (e.g., pumps, tanks, control valves, fans, moved and lost.
instruments, and filters). Hand-operated valves and other When all TOP matrix requirements have been satisfied for
minor components should be omitted. With the basic ma- a particular system or piece of equipment, the binders are au-
trix completed, the project team then must decide which doc- dited for completeness. When properly planned and executed,
uments, certifications, and reports are required to substan- the TOP binder is essentially complete when the system is
tiate satisfactory installation. Some document types will be turned over to the owner for OQ and PQ. Individuals who ap-
required for some systems but not others. Ordinarily, cells in proved the matrix initially approve the completed TOP. Once
the body of a matrix are crossed or shaded to indicate where approved, it is common to prepare three copies of each binder—
a specific document is required. Later, as documents are re- one for maintenance, one for operations, and a third for archive
ceived and added to the TOP, the corresponding cell can be purposes. IQ completion then becomes an academic exercise
darkened or crossed again to indicate that the requirement that is basically limited to certifying TOP approval and docu-
has been fulfilled. In this way, the matrix acts as a punchlist, mentation of system SOPs. Finally, as systems undergo change
14