This graphic is of boston city skyline home to many validation risk assessment users

Validation Risk Assessment Rationale.

Graphic for validation risk assessment use.

A properly designed and precisely executed Validation Risk Assessment (VRA) analysis has proved over and over again to be key to the expedient completion of any FDA, WHO and or EU compliant; risk based validation project. Our latest issue of this VRA document (issue 11) reflects these principles and also incorporates the very latest in regulatory mandates and legislative guidance document comments. The execution of this VRA not only defines and documents the scope of your validation activity; it also prompts you into documenting how each Part 11 record is evaluated and how it will be managed. This brings you into compliance with the mandate in the latest Part 11 clarification documentation. This is now a mandatory requirement and these justifications form regulatory reviewable documents.

This new found freedom to assess records and set justified management of them would appear to mean that the original all embracing approach to all electronic records is to be dropped and the full rigors of part 11 applied only to the data that directly affects product quality, safety, and records (of the product) integrity.

"For those records that are to remain the subject of part 11, we will apply discretion in the validation of audit trails, record retention, and record copying."

This would appear to mean that if your in-house document control is secure and robust; then it will be acceptable in the matter of audit trail / record retention and record copying.

"We will enforce all predicate rule requirements, including predicate rule record and record keeping requirements."

This is a statement to the effect that in all other ways 21 CFR Part 11 will be enforced.


Accordingly, we recommend that, for each record required to be maintained under predicate rules, you determine in advance whether you plan to rely on the electronic record or paper record to perform regulated activities. We recommend that you document this decision (e.g., in a Standard Operating Procedure (SOP), or specification document).


This is a new requirement for a database of predicate (all) data records, giving a documented and approved justification for the method of storage.  Basically separating them into section such as number:

1.         It is not a predicate data.

2.         It is a predicate data, but does not require to be stored in compliance with Part 11.

3.         It is predicate data that must be stored in compliance with current Part 11 requirements.


New Interpretation:

A predicate data record does not required to be Part 11 compliant; unless it is the master copy of the predicate data and is stored in an electronic format. 


I.E. if the record is derived from an electronic source and is downloaded into a hard copy format; which then becomes your master copy of the record.  This paper copy is not subject to Part 11 requirements; but must comply with all the other rules and regulation governing the management of predicate data records.

VRA Introduction.

The question - How much validation? - has been an open subject for many years. Numerous companies brought in validation consultants, and or regulatory compliance experts, to guide them through these problems, but every so often, there would be clashes, or at least variations in opinion, in what the appropriate scope and depth of validation was. It was understood and accepted by the regulators that there was equipment in use, that full validation was inappropriate for, yet the design or misuse of that piece of equipment could affect product quality, so some degree of validation was required.

The more typical production equipment is mainly mechanical (but often intricate and complex), but frequently uses electronics to monitored and or managed it’s functionality and or record retention systems. Then at the very pinnacle of validation we have the mainly electronic systems running extremely complex sophisticated software programs or systems where the software manipulates data and accepts or rejects product quality base on the outcome of the data manipulation. All these systems play a major role in the product manufacturing process, they all require thorough validation using the existing framework of IQOQ - PQ, but they do not all require the same level of validation. How do we define the appropriate level?

Risk Based Validation

When we move away from these simple devices, to the average type of production equipment. Here we find a range of equipment varying from purely mechanical (but often intricate) equipment, to mechanical equipment assisted and or monitored and or managed by some degree of electronics. Then at the very pinnacle of risk based validation we have the mainly electronic systems running extremely complex sophisticated software programs. All these systems play a major role in the product manufacturing process, they all require thorough validation eiak assessment using the existing framework of IQOQ - PQ, but they do not all require the same level of validation. How do we define the appropriate level?

First we have to look at validation and how the level of validation can be varied independently of the scope. If we list all the tasks we consider essential to complex software driven equipment validation, then drop off the tasks we consider inappropriate to the next level of equipment complexity, and so on. We appear to have four levels, with a significant step change between each of them.

  • Mechanical/electronic/electrical/full life cycle software, validation.
  • Mechanical/electronic/electrical/software, validation.
  • Mechanical/electronic/electrical/software, calibration.
  • None

The requirement for 21 CFR Part 11 compliance, can occur at all three of the upper levels of validation and so is addressed in the Validation Risk Assessment protocol as a separate requirement. To find that a piece of laboratory equipment requires the same degree of validation as a Distributive Control System may be disquieting, however any equipment that uses software alone, to automatically derive whether the product passes, or fails to pass, an inspection stage, must be subjected to FLCV. The laboratory equipment may have one such stage, the DCS will have many, however, one or many, the software lineage for each system, must follow similar methodologies.

Our Validation Risk Assessment (VRA) takes you through this assessment process and enables you to make a documented and justified decision as to the level of validation each piece of equipment will receive. This fulfils your obligation to ensure that all software is assessed, as to FLCV applicability.

Validation Risk Assessment Scope.

This VRA will take you through the under listed points and allow you to make accurate justifiable assessments of risk for any system or piece of equipment. This will enable you to adjust your level or scope of validation effort and deliver soundly based risk based validation.

  • Outline.
  • Approvals.
  • Determination of Classification.
  • Prospective Validation.
  • Retrospective Validation.
  • Impact Assessment.
  • Impact Assessment Process.
  • Risk Scenario.
  • Likelihood.
  • Impact Severity.
  • Probability of Detection.
  • Impact Priority.
  • Impact Mitigation.
  • Assessment of Change.


Click here to view

Search Our Store

To find a specific document enter full details in Search Box Below. The more defined the search is the more precise the search findings will be.

When assistance is required please contact us TOLLFREE at 1-877-462-4048. When out of office hours please leave a voice message.

Select Preferred Language

Validation Master Plan (Issue 7) -- $115.00

This document follows our proven practice of supplying an interactive generic document with an automatic method of populating it. Once populated, all you need to do is follow the prompts in the attached SOP. They will take you through the completion process section, by section. At the end of this process your generic document has progressed into a detailed, referenced, bespoke company document. The document follows our three level URS system that ensures functionality traceability from the URS to the various testing protocols. This document interfaces with our Validation Risk Assessment (VRA), Validation Project Plan (VP), User Requirements Specification (URS), giving a seamless flow from your VMP through the VP - IQ - OQ - PQ, while integrating flawlessly with the URS - DQ - VRA.



Validation Documentation Matrix (Issue 6.) -- $29.00

This Matrix must sit along-side your VMP or PVP and together with these documents give a very concise overall picture of your validation program. This four part matrix allows you to list all the equipment and systems that must be qualified. Each entry is allocated a row in the matrix. The row consists of eleven separate headings, these may be edited as required (but come with all the standard documentation titles inserted). In this matrix there is room to enter the document number, prefixed by, A to D. The document number gives you an instant cross reference to the current documents.  The A to D prefix shows the progress stage.



Combined IQ/OQ/PQ Protocol (Issue-2) -- $159.00

This combination protocol has been produced in response to several hundred reader suggestions we received in our ‘Suggestions Section’. It has been carefully designed to make it the preferred choice for Process and Laboratory stand-alone equipment. It is interactive, easy to use and suitable for all mixes of equipment with and without software.
The IQ section establishes documented verification that key aspects of the equipment adhere to approved design intentions and that the recommendations of the manufacturer have been suitably considered. The OQ section establishes that there is documented verification that the installed system functions as specified and that there is sufficient documentary evidence to demonstrate this. The PQ section gives documented verification that the equipment performance in its normal operating environment is consistently exactly as specified in the URS.



Vendor Audit Document (Issue 4) -- $89.00

This document should be customized using the find and replace word feature. The document can then be re-focused to reflect your project priorities. The fifteen chapters all contain 10 questions, the total scored is then weighted to reflect your priorities. By assessing the importance of each of the chapter subjects in your project, the weighting is altered taking points from one and adding to others. For example in a recent audit, after weighting, order of priorities became; delivery number one, validation number two, and price trailing at number nine. The document has been used to audit major and minor manufacturing and support companies. It is a very searching audit tool, and completely removes the possibility of suggestions that personal biases and opinions influenced the final audit decision. When you audit with this document; they know they have been audited.