ICH Q7 clause 5: Process equipment

Equipment selection must consider multiple factors: capacity sized for intended batch sizes (not over or under-sized), location that enables maintenance access and prevents cross-contamination, construction materials compatible with the API and processing conditions. Auditors verify equipment specifications match production requirements and that contact surfaces are constructed from non-reactive materials (e.g., stainless steel 316L for most chemistries).

This is a critical quality control — contact surfaces must be inert to the process chemistry. Common issues include: rouging of stainless steel at elevated temperatures, extractables/leachables from elastomer gaskets and O-rings, reactive metal surfaces (aluminum, copper) with acidic APIs. Auditors will check MOC documentation and may request extractables/leachables data for high-risk contact materials.

Lubricants at bearings, seals, and mechanical interfaces can contact the product stream if seals fail. Food-grade (or NSF H1) lubricants must be used anywhere contamination is possible. Double-seal configurations with barrier fluid provide additional protection. Auditors verify lubricant specifications and check equipment design for contamination pathways.

Closed systems reduce contamination risk and operator exposure. When open processing is necessary (e.g., charging, sampling, discharging), controls include laminar flow protection, dedicated clothing, short exposure times, and cleaned work surfaces. Current equipment drawings (P&IDs, instrumentation loops) must be maintained as part of the change control system.

Unique equipment identification enables traceability in batch records, logbooks, and maintenance systems. Identification should be permanent, visible, and match documentation. Every major equipment item needs a unique ID that appears in: equipment logbook, batch records, validation documents, calibration records, and maintenance history.

Beyond lubricants (5.12), this clause covers heat transfer fluids, coolants, hydraulic fluids, and similar substances. Risk-based approach: direct contact risk = food-grade required; jacket-only contact = lower risk but still should minimize migration risk. Drains must prevent cross-contamination between systems through air gaps or equivalent.

Defective equipment must be immediately tagged OUT OF SERVICE and physically segregated where practical. Clear, tamper-evident tagging prevents inadvertent use. Return to service requires verification of repair effectiveness, often with re-qualification. Auditors check equipment status tags during plant walkthroughs.

Preventive maintenance is essential for consistent equipment performance. The program must cover all major equipment with defined frequencies (often hours-based, calendar-based, or condition-based). Maintenance should be planned to avoid campaign contamination — typically performed during changeover or shutdown. Records must show planned vs actual completion.

Cleaning SOPs must be specific enough that different operators get consistent results. Key elements: disassembly sequence, cleaning agent concentrations, mechanical action (scrub, flush, spray), temperatures, contact times, rinse sequences, and visual inspection criteria. Each piece of equipment should have a dedicated cleaning SOP or a master SOP with equipment-specific annexes.

This clause emphasizes reproducibility — the same operator or a different qualified operator should achieve the same cleaning outcome every time. Reproducibility comes from specificity: exact quantities of cleaning agents, specific equipment settings (agitator speed, pump rates), measured contact times, standardized rinse volumes. Protection from recontamination during storage is also required.

Visual clean/dirty status identification prevents accidental use of unclean equipment or reprocessing of cleaned equipment. Typical systems use color-coded tags (green=clean, red=dirty) or electronic status displays. The tag or indicator must include the cleaning date and signature. For dedicated equipment, simpler approaches may be used but status identification is still required.

Cleaning frequency is risk-based. Between batches of the same product: typically minor cleaning sufficient (minor product buildup allowed if validated). Between different products: full cleaning validation required. Between campaigns: full validated cleaning. Between potent and non-potent products: enhanced cleaning with verification. The risk assessment and cleaning frequency decisions must be documented.

Two hold times matter: dirty hold time (post-production to cleaning start) and clean hold time (post-cleaning to next use). Both require validation. Dirty hold time validation shows that residues dry but remain removable. Clean hold time validation shows cleaned equipment doesn't become recontaminated before use. Both times must be documented in cleaning SOPs and batch records.

Non-dedicated (shared) equipment is the highest cross-contamination risk in API manufacturing. Cleaning validation must demonstrate effective residue removal to scientifically justified limits (PDE or dose-based calculations). Sampling typically uses swabs at worst-case locations plus rinse samples. The worst-case product determines the cleaning challenge. Every product pair must be covered, often using a matrix approach.

Calibration is the metrological foundation of quality — if instruments aren't calibrated, all measurements are suspect. The program must cover all quality-critical instruments (balances, thermometers, pH meters, HPLC detectors, etc.) with written procedures and defined frequencies. Traceability to certified standards (NIST, national metrology institutes) is required. Current calibration status must be easily verifiable on every instrument.

Traceability to certified standards (typically NIST in the US, NPL in UK, PTB in Germany, etc.) provides the chain of measurement from the factory floor back to internationally accepted reference values. Each working standard used for calibration must have a current traceability certificate. When no certified standard exists (rare for common measurements), in-house primary standards require characterization documentation.

Calibration records must provide complete audit trail for every calibration event. Key content: instrument ID, calibration date and due date, standards used with serial numbers, as-found values (before adjustment), as-left values (after adjustment), acceptance criteria, pass/fail, technician signature, reviewer signature. As-found data is critical for assessing impact on previously tested batches if drift is found.

Visible calibration status enables operators to verify at-use that instruments are in-tolerance. Labels should show: last calibration date, next due date, calibration ID (linking to the record). Out-of-tolerance instruments must be immediately removed from service and impact assessment performed on all measurements since the last known-good calibration. This impact assessment may require batch-level investigation.

This is one of the most significant clauses for data integrity. When an instrument is found out of tolerance, all measurements taken since the last successful calibration are potentially suspect. The impact assessment must identify all affected batches and evaluate whether quality conclusions could change based on the magnitude of the deviation. For critical instruments (assay balances, critical process monitors), this can trigger significant retroactive investigation.

This clause covers deviations in the calibration process itself — e.g., using wrong standards, skipping calibration points, adjustment techniques not per procedure. Such deviations may invalidate the calibration. Investigation determines whether the calibration was actually successful, whether batches tested since the last valid calibration are affected, and what corrective action prevents recurrence.

Computerized systems validation (CSV) follows a risk-based approach per GAMP 5. Systems categorized by complexity: Category 1 (infrastructure), Category 3 (off-the-shelf), Category 4 (configured), Category 5 (custom). Higher categories require more extensive validation. Commercial software (e.g., commercial LIMS) benefits from vendor qualification but still requires IQ/OQ in the user's environment. The depth of validation must match the criticality to GMP.

IQ covers hardware installation (correct computers, network, peripherals per specification) and software installation (correct version, configuration, access controls). OQ tests system functions across the operating range — data entry, calculations, reports, alarms, security. OQ is often the largest part of CSV documentation. Both should be pre-approved protocols with defined test cases and acceptance criteria.

Commercial software (LIMS, MES, ERP, etc.) benefits from the vendor's development and testing, but the user organization must still verify fit for purpose in their environment. Vendor assessment (often via questionnaire and audit) documents the vendor's quality system. User acceptance testing (UAT) verifies configuration and integration. Leveraging vendor documentation is acceptable but not a replacement for user-specific validation.

Access control is foundational to data integrity. Controls include: unique user IDs (no sharing), strong passwords with expiration, role-based permissions, automatic logout, physical access control to servers. Data integrity requires that data cannot be deleted, only marked as corrected with full audit trail. Periodic review of access rights is critical, especially for departed employees.

Data backup protects against loss from hardware failure, software corruption, or disaster. Standards include: regular automated backups (daily typical), offsite or cloud backup for disaster recovery, documented restore procedures, periodic restore testing to verify backup integrity, retention matching record retention requirements. Backup alone is insufficient without verified restore capability.

Audit trails are the cornerstone of data integrity for electronic records. They must capture: original value, new value, who made the change, when (timestamp), and why (reason). Audit trails themselves must be tamper-evident and protected from deletion. Periodic review of audit trails is a critical regulatory expectation — not just for anomalies but to confirm the audit trail function is working and being used correctly.

This clause reinforces audit trail requirements with emphasis on review as part of batch record review. The review is not optional — it must happen as part of QA batch review. Key questions during review: were all data entries made contemporaneously? Are there suspicious patterns (e.g., all entries by one user late at night)? Are reasons for changes appropriate? Documented review by QA closes the compliance loop.

Manual data entry is error-prone. Critical data (product IDs, batch numbers, quantities, test results) entered manually should be verified by a second person or automated means. Common approaches: second-person verification with electronic signature, double-key entry (same data entered twice and compared), barcode scanning where possible. The verification must be documented at the point of entry.

Computerized system incidents include: system crashes during data capture, software errors producing wrong calculations, hardware failures losing data, unauthorized access discovered, audit trail gaps. Each incident must be logged, investigated for root cause, and assessed for impact on data and quality. Critical incidents may trigger OOS investigations or batch impact assessments.

Computerized systems drift out of validation without change control. Every change (software updates, configuration changes, hardware replacements, interface modifications) must go through the quality change control process. Impact assessment determines revalidation scope — some changes require full revalidation, others only targeted testing. The goal is maintaining the validated state throughout the system lifecycle.