Biofilm and Rouging in Pharmaceutical Water Systems: Investigation and Recovery

The third alert level excursion in six months at the same point of use on the Purified Water loop was closed exactly like the two before it: isolated result, conforming resample, operator retrained on sampling technique. None of the three investigations looked at the other two. During the inspection the question came in under a minute: show me the trend for that point over the last two years. The chart did not show three isolated spikes, but a baseline that had drifted slowly upward with the spikes sitting on top of it. This was not a sampling problem: it was a system that was failing.

Annex 1 of EudraLex Volume 4 (C(2022) 5938 final, in operation since 25 August 2023) asks for exactly this distinction: under 6.14, alert level excursions must be documented, reviewed and investigated, and the investigation must establish whether the event is isolated or indicative of an adverse trend or system deterioration. Short clause, heavy consequences: if the conclusion is "isolated event", it has to be demonstrated, not assumed because the resample came back in.

Behind most recurring excursions sit two distinct phenomena: biofilm and rouging. Confusing them produces two mirror-image mistakes: sanitising a system that has a corrosion problem, and repassivating a system that has a microbiological problem. What follows is the investigative path that separates them, characterises them and supports a proportionate intervention, within the wider framework of design, qualification and lifecycle management of pharmaceutical water systems.

Two phenomena that sampling tends to blur

Biofilm is a community of sessile microorganisms attached to the internal surface of the system and embedded in an extracellular polymeric matrix they produce themselves. That matrix is not a detail: it is a barrier that slows the penetration of sanitising agents, hosts microenvironments different from the bulk and retains nutrients. A water sample measures, by construction, the planktonic phase, which in the presence of a mature biofilm is fed by intermittent detachment rather than by uniform growth. Hence the typical signature of a biofilm-driven excursion: results that oscillate, conforming resamples taken hours later, and a slow baseline drift visible only over a long trend. PDA Technical Report No. 69 (2015), on bioburden and biofilm management in pharmaceutical manufacturing operations, identifies systems handling fluids as precisely the setting where biofilm matters most.

Rouging, by contrast, concerns the surface of stainless steel: the formation or deposition of iron-bearing oxides and hydroxides on the passive layer. It is not a single disease with a single cure. It can originate elsewhere in the system and be carried and redeposited by the fluid; it can develop in situ where the passive layer is locally weakened; it can take the stable, adherent forms typical of surfaces exposed to high temperature over long periods. Technical literature commonly describes these forms using a three-way split into "types". This needs saying plainly: that split is a technical-literature convention, useful for organising observation, not a regulatory classification. No pharmacopoeia, no GMP annex and no standard cited here defines regulatory categories of rouge.

The two interact: an irregular surface, or one carrying adherent deposits, offers anchoring sites for microbial attachment, and an established biofilm creates local oxygen and pH gradients that can contribute to attack on the passive layer. Coexisting does not make them the same problem: corrective actions and effectiveness checks rest on different evidence.

Before the hypothesis: ruling out artefacts

The first question is not "what is in the system" but "is the result real". Closing an excursion by attributing it to an artefact without demonstrating it is a serious defect; failing to look for the artefact is just as serious, because it leads to dismantling a healthy system. The sequence is documentary before it is physical, and it has to be completed quickly, because much of the evidence perishes.

Isolate identification is the most underused tool at this stage. An organism typically associated with human handling, appearing once in a rarely used point with clean laboratory controls, tells a different story from a recurring hydrophilic organism appearing at different points on the same branch. Sampling discipline and the rationale behind sampling points are covered in the article on sampling plans and sampling points; enumeration and identification methods in the one on microbiological and endotoxin control in PW and WFI.

Read the trend before the single result

Annex 1 6.13 requires regular ongoing chemical and microbiological monitoring, with alert levels based on initial qualification data and periodically reassessed in light of requalification, routine monitoring and investigations; 6.14 requires the distinction between an isolated event and an adverse trend. Together they imply that a single result cannot be interpreted on its own.

A trend that serves this purpose is stratified by point rather than aggregated across the loop, because the system average hides the point that is deteriorating. It covers a horizon long enough to capture seasonal variation, which Annex 1 6.8 requires to be taken into account when qualifying water systems and for which the EMA Q&A on non-distillation methods (EMA/INS/GMP/443117/2017) expects, in the initial phase, data covering approximately one year. It considers non-conforming results and conforming results that are rising, because baseline drift is the early signal. And it includes non-microbiological events: sanitisations performed and skipped, maintenance, replacements, shutdowns, approved changes.

The most delicate point concerns limits. When a system drifts, the temptation is to revise alert and action levels "on the basis of recent historical data". EMA is explicit: increasing of such limits is not good practice and may mask a failing system. The periodic review foreseen by Annex 1 6.13 exists to make levels more representative of the qualified system's capability, not to chase a degrading system upward. USP <1231>, an informational and therefore non-binding chapter, gives reference action levels and leaves users to establish in-house specifications: that freedom is exactly what makes a documented justification mandatory whenever levels change.

Interrogating the system: the conditions that make biofilm possible

If the result holds and the trend points to a real problem, the investigation moves to operating conditions. Biofilm is not an accident: it is the predictable outcome of surface, hydraulics, temperature, nutrients and time.

• Has flow remained turbulent everywhere? Annex 1 6.9 requires flow to remain turbulent in order to limit microbial adhesion and biofilm formation, and the flow rate established during qualification to be routinely monitored. To verify: actual against qualified flow rate, behaviour in branches, pump degradation, points of use added after qualification.
• Has operating temperature been maintained? In hot systems what matters is the actual temperature in every section, not the one in the tank; Annex 1 6.10 cites, as an example for WFI, constant circulation above 70 degrees Celsius. In ambient-temperature systems the margin is narrower: the EMA Q&A notes that RO units typically operate at ambient temperature and are therefore an ideal environment for biofilm formation. The choice between hot, cold and ozonated systems determines which control strategy is realistically available.
• Are there new dead zones? Annex 1 6.7 requires piping slope for drainage and the avoidance of dead legs. The ones that matter in investigations are rarely by design: they are branches of decommissioned points of use left in place, instruments on stubs, fittings for temporary uses. Geometry and materials are covered in the article on dead legs, slopes, materials and hygienic design.
• Were sanitisations performed as qualified? Annex 1 6.12 foresees sterilisation, disinfection or regeneration on a predetermined schedule and as a remedial action following out-of-limit or out-of-specification results. To verify: late or skipped cycles, parameters achieved at every point and not only at the control point, points excluded, valves not operated.
• What changed upstream? Source water, pretreatment, regenerations, membrane changes, tank vent filters: Annex 1 6.11 requires that hydrophobic bacteria-retentive vent filters not be a source of contamination, with integrity testing before installation and after use, and prevention of condensation.

Physical inspection: when to open the system

The system is opened when documentary evidence has narrowed the field to one portion of the plant, or when the trend indicates a deterioration that process data do not explain. Opening is itself a contamination event: defined sequence, points photographed and mapped, surface and deposit samples collected before any cleaning, with qualified restoration and sanitisation already foreseen in the plan.

The items to look at first are those where evidence concentrates: the liquid-vapour interface in the tank, shadow zones of the spray pattern, point-of-use valves and their seats, heat exchangers, gaskets and joints, terminal sections of branches, surfaces downstream of weld defects. Where direct access is impossible, endoscopic inspection of selected sections is often the only way to obtain evidence without cutting. For membrane units the EMA Q&A explicitly mentions destructive membrane analysis as a means of confirming the absence of biofilm: strong, non-repeatable evidence, to be decided with criteria set beforehand and read together with that membrane's history, not as a verdict on the whole system.

Rouging: characterise before deciding

When an abnormal discolouration appears, the instinctive reaction is to plan a repassivation. It is the wrong reaction, because it skips the step that determines whether and which intervention is needed. Not every case of rouging requires repassivation. Some are stable and non-progressive, some release no particulate under operating conditions, some are the visible consequence of an upstream cause that must be removed first and independently of any surface treatment.

• Extent and location. A widespread phenomenon, one localised downstream of a component and one confined to the hottest zone tell different stories.
• Appearance and adherence. Removable deposit or continuous adherent film; colour and uniformity; visible attack on the substrate.
• Nature of the deposit. Elemental and morphological analysis on a traceably collected sample, to distinguish transported and redeposited material from oxidation developed in situ.
• Progression over time. Comparison with previous inspections, dated photographs, sanitisation history, age of the system and of the component.
• Measurable impact. Controlled parameters, particulate where monitored, evidence of release toward the product.
• Construction history. Materials and surface finish, weld treatment, documented initial passivation, subsequent modifications. ASME BPE addresses metallic materials, surface finishes and system design in dedicated parts: the applicable edition must be fixed contractually and numerical criteria read from that edition, not from memory.

The output is not a label but the answer to three questions: is the phenomenon progressing; does it affect water or product quality; is there an active cause that will keep acting even after the surface is treated.

The repassivation decision is not automatic

Repassivation is a chemical intervention on an operating plant, with risks of its own: attack on gaskets and non-metallic components, damage to instrumentation, incomplete rinsing, effluent to manage, production downtime, and the need to requalify before returning to service. The technical framework comes from ASTM A967/A967M-25 for chemical passivation of stainless steel and ASTM A380/A380M-25 for cleaning, descaling, pickling and passivation: both define practices and verifications, not when to intervene on a given system. That decision belongs to the site, within the risk management framework of ICH Q9(R1) and the action management logic of ICH Q10. The matrix below is supplied with the weighting column empty: weights are assigned by the site according to the product, the criticality of water use and the plant configuration.

There are not only two options. Between "do nothing" and "repassivate the whole system" lie instrumented surveillance with defined review criteria, treatment of the affected section only, replacement of the component, and correction of the upstream cause. If you intervene, you need a verification plan defined beforehand and proportionate requalification: an unverified repassivation moves the problem, it does not close it.

Biofilm remediation: why a shock sanitisation does not close the case

Annex 1 6.12 recognises sanitisation as a remedial action after out-of-limit or out-of-specification results, and it is the correct first response. It is not correct, however, to claim that a shock sanitisation permanently eliminates a mature biofilm. The reasons are mechanical, not theoretical.

The first is penetration: the matrix slows diffusion of the agent and consumes part of it by reaction, so the concentration reaching the deeper layers can be appreciably lower than in the bulk and the contact time required differs from the one sufficient for planktonic cells. The second is distribution: the cycle reaches the system unevenly, and low-velocity points, terminal branches, valve seats and shadow zones receive less than the control point suggests. The third is that killing is not removing: an inactivated but unremoved matrix remains a conditioned surface, ideal for recolonisation, and can continue to release organic material and endotoxins. The fourth is the survival of residual fractions in protected niches, enough to restart colonisation.

Three operational consequences follow. Effective remediation combines removal and inactivation and is not exhausted by a single treatment. If the qualified cycle was not enough, the action is not to repeat it unchanged indefinitely but to revisit its parameters and its qualification: the article on qualification of sanitisation cycles covers how that adequacy is demonstrated. And it is removal of the cause that decides the outcome: if velocity stays low, the dead leg stays where it is or temperature stays outside the qualified profile, recolonisation is only a matter of time. The EMA Q&A mentions thermal treatment above 75 degrees Celsius as an approach to biofilm control in non-distillation systems, leaving contact times to the manufacturer's validation: confirmation that effective parameters must be established and demonstrated on the specific system.

Verifying recovery: evidence over time, not one conforming result

A single conforming result after sanitisation is the weakest evidence available, because it is the expected behaviour even when the biofilm has merely been disturbed. Recovery verification is a plan approved before the intervention, defining which points to sample and at what increased frequency, how long to maintain the intensified regime, which physical parameters to follow in parallel, which quantitative criterion defines recovery and which evidence authorises the return to routine.

None of the sources cited fixes that criterion, that duration or that number of samples: they must be established, justified and documented by the site, on verifiable elements such as the capability demonstrated at initial qualification, the historical variability of the system under control, the horizon within which recolonisation has historically appeared in that system, seasonal variation and the criticality of water use. A robust criterion looks at the distribution of results and the stability of the baseline rather than at an isolated value, considers several points on the affected branch, and states what to do if the drift resumes after the return to routine.

The same logic covers the continuous monitoring that Annex 1 6.15 requires for WFI systems, such as TOC and conductivity: during recovery those signals, read together with microbiological data, give continuity to evidence that is otherwise discrete. The EMA Q&A also sets, as a minimum, an annual assessment of monitoring effectiveness: after an event of this kind, that is where you check whether the plan could have caught the drift earlier.

CAPA: close on the cause, not on the event

ICH Q10 places corrective and preventive actions among the elements of the pharmaceutical quality system, and ICH Q9(R1) provides the risk framework that governs their proportionality. Root cause analysis has to reach a cause that explains the pattern, not just the last result: if the trend shows three excursions in six months on the same branch, the cause must explain why that branch and why that cadence. Correction, corrective action and preventive action are tracked separately: sanitising is the correction; removing the dead leg, restoring the qualified flow rate, revising the cycle or replacing the component are corrective actions; extending the check to branches with the same configuration, updating the sampling plan and introducing a trending rule that catches drift before the action level are preventive actions. Effectiveness is verified against the evidence defined in the recovery plan: the CAPA does not close before that evidence exists.

Worked example: Site Delta

Site Delta is a teaching example, not a real case. It manufactures non-sterile forms and runs an ambient-temperature PW loop with periodic chemical sanitisation. Over twelve months it records four alert excursions, three of them at two adjacent points of use on the same terminal branch; the first two had been closed as sampling error.

With the investigation reopened, the documentary review finds no artefacts: correct sampling technique, clean laboratory controls, a recurring isolate consistent with the system's hydrophilic flora. The by-point trend shows that the two points have had a higher baseline than the others for around nine months, with the drift starting close to a maintenance intervention. Review of operating conditions reveals that after that intervention a downstream point of use had been taken out of service without removing the branch, and that flow on the terminal branch was not verified separately from loop flow. Endoscopic inspection confirms a continuous deposit in the excluded branch.

The actions: sanitisation as the immediate correction; physical removal of the decommissioned branch and restoration of the qualified configuration; revision of the cycle with verification of parameters achieved in terminal branches too; intensified monitoring under a recovery plan approved before the intervention, with criteria and duration justified on historical data; extension of the check to analogous branches; a by-point trending rule that flags drift before the action level is exceeded. A localised surface discolouration is also observed: documented, sampled and placed under surveillance with defined review criteria. No repassivation is planned, because characterisation shows neither progression nor impact on controlled parameters: a decision to document and revisit, not a closed case.

Investigation checklist

1. The result is confirmed, or there is documented evidence of a sampling, transport or laboratory artefact; the isolate is identified to the level defined by the site and compared with typical system and laboratory flora.
2. The trend has been reviewed by point, over a horizon covering seasonal variation, including conforming results.
3. Flow rate, temperature, TOC, conductivity, alarms, maintenance, changes and sanitisations performed or skipped have been correlated, with qualified conditions verified in the affected section and the current configuration compared against the qualified one.
4. Physical inspection is planned with a defined sequence, deposit sampling before cleaning, qualified restoration and sanitisation; any surface discolouration is characterised for extent, adherence, nature, progression and impact before any decision.
5. The recovery verification plan is approved before the intervention, with justified criteria, points, frequency and duration.
6. The CAPA separates correction, corrective action and preventive action, and closes only after effectiveness verification.

Common mistakes and red flags

• Repeatedly closing excursions as "isolated events" without reviewing the earlier ones: this is the pattern Annex 1 6.14 asks you to rule out, and it is visible to anyone who looks at the trend.
• Attributing an excursion to sampling error without documentary evidence, using the conforming resample as proof.
• Raising alert and action levels to realign them with recent data from a drifting system.
• Declaring a biofilm problem resolved on the strength of a single conforming result after sanitisation.
• Repeating the same sanitisation cycle after it has already failed, without revisiting its parameters and qualification.
• Planning repassivation as an automatic response to any discolouration, without characterisation and without weighing the risks of the intervention.

If you want analyses like this one on qualification, monitoring and the lifecycle of GMP systems, you can subscribe to the The Pragmatic GMP newsletter: technical content, no promotions.

Key takeaways

• Annex 1 6.14 requires the isolated event to be distinguished from an adverse trend: the "isolated event" conclusion has to be demonstrated.
• Biofilm and rouging often coexist but call for different actions and verifications; the investigation starts with sampling and laboratory artefacts, moves to the by-point trend and reaches physical inspection only once the field is narrow.
• Raising limits to chase a drifting system is not good practice and may mask a failing system.
• Rouging must be characterised before deciding: repassivation is not automatic and is itself an intervention with risks and a need for verification.
• A shock sanitisation does not guarantee permanent elimination of a mature biofilm: penetration, distribution, removal and removal of the cause decide the outcome.
• Recovery is demonstrated with evidence over time under a plan approved before the intervention, not with a single conforming result.

Regulatory and technical references

• EudraLex Volume 4, Annex 1 (C(2022) 5938 final), in operation since 25 August 2023: clauses 6.7-6.15.
• EMA Q&A "Production of WFI by non-distillation methods - reverse osmosis, biofilms and control strategies" (EMA/INS/GMP/443117/2017), effective 1 August 2017; EMA Guideline on the quality of water for pharmaceutical use (EMA/CHMP/CVMP/QWP/496873/2018), effective 1 February 2021.
• USP <1231> Water for Pharmaceutical Purposes, official since 1 December 2021: informational, non-binding chapter.
• WHO TRS 1033, Annex 3 (2021).
• ICH Q9(R1) (Step 4, 18 January 2023) and ICH Q10 (Step 4, 4 June 2008).
• PDA Technical Report No. 69 (2015), Bioburden and Biofilm Management in Pharmaceutical Manufacturing Operations.
• ASTM A967/A967M-25 (chemical passivation of stainless steel) and ASTM A380/A380M-25 (cleaning, descaling, pickling and passivation).
• ASME BPE, parts on metallic materials, surface finishes and system design (applicable edition to be fixed contractually); ISPE Baseline Guide Vol. 4, Water and Steam Systems, 3rd ed., September 2019.
• FDA, Guide to Inspections of High Purity Water Systems (1993): reference material for investigators, non-binding.