A completed skid test does not release a cleaning process
A CIP skid can pass its factory tests while the installed return circuit leaves one vessel partly flooded. A SIP sequence can complete without proving that a remote valve cavity received the required treatment. These are different failures, but they share a cause: acceptance was attached to a machine rather than to the intended operation and its boundaries. Qualification must connect the approved requirements to the equipment actually installed, the operating configurations actually used and the evidence needed for the manufacturing decision.
This article covers qualification of pharmaceutical CIP and SIP systems, including interfaces with product equipment, utilities and automation. It separates system qualification from cleaning validation and sterilisation-process validation. The same project may coordinate these activities, but each answers a different question. A supplier certificate, a successful commissioning run or an approved FAT report cannot independently answer all three.
Establish the regulatory and engineering basis
EU GMP Annex 15, effective since October 2015, provides the qualification and validation framework. Its sequence connects user requirements, design qualification and testing through operational and performance qualification. Evidence may be combined or reused where justified; this does not remove the need to demonstrate suitability for the installed application. Cleaning validation has its own considerations in section 10.
For sterile applications, Annex 1, particularly sections 8.58 and 8.63, adds relevant SIP expectations. ASTM E2500-25 and the ISPE Commissioning and Qualification guide offer technical approaches; they are not independent GMP legislation. PIC/S PI 006-4 has been published with an effective date of 1 October 2026. At this article's September 2026 review, its future status must remain explicit.
Define boundaries before defining tests
Draw the system boundary on current piping and instrumentation diagrams. Include CIP supply and return, dosing connections, routing valves, equipment drains, spray devices, sample points and utilities that can influence cleaning. For SIP, identify the sterilisation boundary, vents, condensate paths, filters, seals and every connection capable of breaking integrity after the cycle. Mark which elements belong to the skid supplier and which are delivered by the site or another contractor.
A boundary also has operating dimensions. Record simultaneous demands, vessel configurations, minimum and maximum fill arrangements, removable parts and manual interventions. Identify equipment that is cleaned separately. An omitted hose or valve seat does not become covered because the main vessel appears in the qualification protocol. Resolve ownership at these interfaces before the testing schedule makes changes expensive.
Convert the URS into a verification plan
Each significant requirement needs an identifier, rationale, acceptance criterion, verification method and evidence location. “The system shall clean effectively” is an objective, not a testable specification. Separate functional requirements, such as preventing selection of an incompatible route, from process outcomes, such as demonstrating removal of the relevant residue. Link both to the process knowledge and risk assessment that explain their importance.
Use the traceability matrix to choose the most informative verification stage. A material certificate can be reviewed before delivery, while installed drainability requires site evidence. A simulated alarm at FAT may demonstrate software logic but cannot prove that the field sensor is correctly installed. Define what can be accepted early and what must be reconfirmed after installation, transport, integration or configuration changes.
| Critical question | Useful evidence | Typical stage | Remaining boundary |
|---|---|---|---|
| Is the selected circuit correctly routed? | Valve-state challenge and independent route inspection | FAT, then integrated OQ | Actual field connections |
| Can the equipment drain? | Installed inspection and representative drainage challenge | Commissioning and qualification | Operating orientation and configuration |
| Are critical measurements reliable? | Calibration, loop checks and range challenges | IQ/OQ | Location and response time |
| Does cleaning remove the target residue? | Approved sampling and analytical results | Cleaning validation | Products, soils and process conditions |
| Does SIP treat the whole boundary? | Thermal studies and justified sterilisation evidence | SIP qualification and validation | Cold locations and post-cycle integrity |
Use design qualification to prevent predictable failures
Design review should examine how the proposed architecture meets the URS, rather than merely checking that drawings exist. Challenge supply and return balance, chemical addition, temperature measurement, drainage, spray-device access and the consequences of utility variation. Consider contamination transfer through shared returns or recovery tanks. For SIP, scrutinise air removal, condensate disposal, thermal expansion and whether instruments can represent the locations that are hardest to heat.
Record assumptions requiring later confirmation. Supplier calculations and device operating envelopes may justify design choices, but their applicability depends on the complete circuit. A pump curve alone does not prove cleaning at the destination. Resolve critical design gaps before fabrication where possible, and carry justified residual questions into the verification plan with an owner and a defined closure criterion.
Make FAT expose functional weaknesses
Factory acceptance testing should challenge the supplied package under agreed conditions. Review construction records, instrument lists, software versions, recipe structures and alarm definitions. Demonstrate sequence transitions, route selection, chemical-dosing permissions, abort behaviour, restart restrictions and failure responses. Where real process conditions cannot be reproduced, document the simulation, its limitations and the additional site testing needed.
Tests should include credible adverse conditions, not only a successful demonstration cycle. Examples include loss of a return signal, an unavailable valve feedback, communication interruption and a user attempting an unauthorised parameter change. Define the expected safe state and the record produced. Do not introduce destructive challenges without planning; select controlled simulations that preserve equipment and still establish the behaviour being assessed.
Distinguish SAT from commissioning and qualification
Site acceptance testing confirms delivery and integration against the contractual acceptance plan. Commissioning establishes that the engineered installation operates as intended and can be handed over safely. Qualification provides approved evidence of suitability for the GMP use. These purposes overlap, so well-controlled tests can support more than one objective, but changing the title of a commissioning record does not make its evidence adequate.
Before reusing a test, assess the protocol, instrument suitability, configuration, raw data, deviations, witnesses and approval history. Determine whether shipment or installation could invalidate the result. Repeating every factory test wastes effort; omitting every repeated test leaves integration risks unexamined. The justified decision is specific to each requirement and its exposure to change.
IQ establishes the configuration being qualified
Installation qualification should identify the as-built equipment, piping, instruments, utilities, software and documents that define the system. Verify critical materials and component identities against the approved design, and confirm that calibration records correspond to the installed instruments. Check identification, flow direction, accessibility, connections and the availability of operating and maintenance information.
Document discrepancies rather than silently updating the expected configuration to match whatever was installed. A substitution in a valve, gasket or spray device may affect cleanability, compatibility or thermal behaviour. Assess its impact before acceptance. The deliverable is a reliable installed baseline against which subsequent operational evidence can be interpreted.
OQ tests the operating range and failure behaviour
Operational qualification challenges the functions and operating conditions that matter to the approved use. Test recipe permissions, phase transitions, alarms, interlocks and records together with relevant process measurements. Select upper, lower and adverse conditions from development knowledge and risk assessment. There is no universal CIP velocity, chemical concentration or SIP holding condition suitable for every installation.
Integrated challenges should follow the consequence chain. If inadequate return flow is detected, does dosing stop, does the cycle fail correctly, and can an operator restart without an approved recovery route? Verify the data needed to reconstruct that event. A screen message alone is insufficient if the permanent cycle report records the cycle as successful.
PQ connects performance to the intended application
Performance qualification should demonstrate that the system performs reproducibly for the approved operating application. Identify representative and challenging equipment configurations, utilities, demands and operating practices. Explain why the selected cases support the scope claimed. If a substitute medium is used, establish which behaviours it represents and which product-related questions remain for cleaning validation.
Keep the outcome distinctions visible. A stable CIP temperature profile supports system performance; it does not establish residue removal. Spray coverage supports understanding of contact and shadow areas; it does not replace chemical or microbiological evidence. SIP thermal performance must support the defined sterilisation strategy rather than a generic promise of sterility based on the cycle-complete message.
Protect the meaning of digital evidence
Automation qualification must account for how records are created, stored, reviewed and retrieved. Verify time alignment, identification of the equipment and recipe version, access permissions, changes to critical parameters, and the completeness of cycle records. Challenge loss of communication or power where relevant. Establish whether recorded values are raw observations, averages or calculated summaries, because that distinction can change the interpretation of short excursions.
The current Annex 11 remains the January 2011 version. Its 2025 proposed revision must not be described as effective. Supplier documentation can support the assessment, but the regulated user retains responsibility for the configured system and its GMP records.
Example: a shared CIP skid serving two vessels
Consider a project where the factory tests demonstrate correct sequencing for two destinations. At site, one vessel is farther from the skid and has a different return arrangement. The commissioning team discovers intermittent flooding during a transition. Treating this as a minor tuning issue would miss the possible effect on dilution, contact conditions and the reliability of the return measurement.
The team first records the actual configuration and deviation, then evaluates the return design and instrumentation. After the approved correction, it repeats the affected hydraulic and sequence challenges and assesses whether coverage and cleaning-development evidence remain valid. Cleaning validation subsequently challenges the relevant soil and hold-time conditions. The project accepts the corrected evidence trail, rather than relying on the original successful FAT.
Choose proportionate evidence without leaving gaps
| Situation | Decision | Required rationale |
|---|---|---|
| Unchanged packaged software function already challenged at FAT | Consider controlled reuse | Version, configuration and test quality remain applicable |
| Field instrument or piping changed after FAT | Repeat affected integration tests | Identify downstream consequences and boundaries |
| New product added to a qualified CIP circuit | Assess cleaning strategy and validation impact | Equipment qualification alone does not represent new soil |
| SIP boundary extended by a new branch | Reassess thermal design and sterilisation evidence | Air removal, condensate and cold-location representation |
Release only with an intelligible handover
- Confirm that critical requirements have traceable, approved evidence.
- Resolve deviations or document justified conditions and restrictions through the quality system.
- Approve operating, cleaning, maintenance and calibration procedures for the verified configuration.
- Train the people who execute, review and maintain the process.
- Define recipe ownership, access management and change approval.
- Specify routine monitoring, review triggers and the basis for requalification.
- Identify cleaning-validation and sterilisation-validation obligations separately from equipment release.
Frequent mistakes include accepting undocumented supplier demonstrations, treating all installed branches as represented by one test, confusing design pressure with validated process conditions, and closing deviations without examining their effect on prior results. Equally problematic is a release dossier that contains every report but does not explain what the system is authorised to do. State the permitted scope and remaining restrictions plainly.
What the qualification package should let you decide
The package should support a practical answer: this configuration, operating within these justified conditions and controls, is suitable for this intended use. It should also show when that answer needs review. Changes to equipment, recipes, utilities, products or the sterile boundary may affect different evidence sets. Link those triggers to the pharmaceutical quality system and assess cumulative changes, not just isolated modifications.
Use the Pharma Engineering overview to place the project in its wider engineering context. For utility interfaces consult Pharmaceutical Water & WFI Systems; for downstream sterile boundaries consult Aseptic Fill-Finish & Barrier Systems. The qualification decision remains anchored to the cleaning and sterilisation application actually being delivered.
Related decisions
- URS for Cleaning, CIP & SIP Systems: Requirements, Structure and Checklist
- Cleaning Validation in GMP Manufacturing: Swab, Rinse, Recovery and Acceptance Strategy
Explore all decisions in Cleaning, CIP & SIP Systems.
