FAT, SAT, IQ, OQ and PQ of Pharmaceutical Water and WFI Systems

The PQ protocol is closed, every result is within specification, the report is signed. In an audit that is not the question. The question is why the PQ ended on that particular day. If the answer is that the plan had three phases and the third one finished, the conversation deteriorates quickly. No text in force prescribes three phases, and at that point the duration of the qualification turns out to have been set by the project schedule, not by a technical rationale.

This is where the qualification of a water system parts company with almost every other utility. A compressed air system behaves tomorrow the way it behaved today; a water system has a biological component that expresses itself over time and depends on operating temperature, feed water and season. Annex 1 says so at clause 6.8: water systems should be qualified and validated for physical, chemical and microbiological control taking account of seasonal variation. A qualification closed within a few winter weeks, with alert levels derived from those same weeks, has not answered the question Annex 1 asks.

The second problem sits further upstream: the effort goes into executing tests, not into deciding which tests are needed and why. The result is a package in which the same verification appears in FAT, IQ and OQ while a critical requirement appears nowhere. What follows covers the whole chain from the point of view of the decisions that have to be taken and documented.

What the qualification of a water system has to demonstrate

Annex 1 at clause 6.7 describes the chain in one sentence: the water treatment and distribution plant should be designed, constructed, installed, commissioned, qualified, monitored and maintained to prevent microbiological contamination. It is the only clause that names commissioning alongside qualification: commissioning does not precede the "real" phase, it is a link in the same chain and its outcome conditions what qualification can demonstrate.

At the end, the site must be able to show four things: that what is installed matches the approved design and that the design answers defined user requirements; that the system works under adverse conditions and not only at the nominal point; that over time it produces compliant water reproducibly, with enough data to set the alert levels required by clause 6.13; and that there is readable traceability between what was required and what was verified. The boundary must be declared first: the system does not start at the skid but at the delivery point of the feed water, because clause 6.10 requires WFI to be produced from water complying with specifications defined during qualification.

The applicable regulatory framework

The EU framework is Annex 15 of EudraLex Volume 4, 2015 revision, in operation since 1 October 2015: it structures qualification into stages (DQ, IQ, OQ, PQ), recognises that part of the verification can be anticipated in FAT and SAT, and imposes the principle that carries everything else — acceptance criteria approved before execution, deviations managed and resolved before a stage is declared complete. It contains no water-specific requirements: those sit in Annex 1.

The water clauses of Annex 1 (C(2022) 5938 final, in operation since 25 August 2023) turn the framework into verifiable objects. Clause 6.9 requires turbulent flow and a flow rate established during qualification and monitored routinely: that generates an OQ test and a monitoring parameter. Clause 6.13 requires alert levels based on initial qualification data, periodically reviewed — so alert levels are an output of PQ, not one of its acceptance criteria. Clause 6.15 requires continuous monitoring, such as TOC and conductivity, for WFI systems.

The EMA guideline EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021, states that validation and qualification of purification, storage and distribution systems are fundamental to GMP and an integral part of GMP inspection, but it does not fix protocol details or acceptance criteria. The EMA Q&A EMA/INS/GMP/443117/2017 on the production of WFI by non-distillation methods, in force since 1 August 2017, is the only document in the package that gives any time indications, and only within its own scope: it expects extended testing, with daily testing of all critical points in the initial phase and data over approximately one year to capture seasonal variation.

Note — concept paper on the revision of Annex 15

On 9 February 2026 a concept paper on the EU-PIC/S revision of Annex 15 was published, with a corrigendum dated 16 July 2026 and consultation closed on 9 April 2026. As at the date of this article Annex 15 has not been revised: the applicable text remains the 2015 revision. A concept paper is not a requirement and creates no obligations: it belongs in regulatory intelligence, not in a protocol, and it cannot be used to justify qualification choices.

CQV strategy is decided before the protocols

The decision that determines the cost and the defensibility of the whole package is taken at the beginning, when the site establishes how much verification each element deserves and which engineering evidence it intends to recognise. It is a risk decision, not a budget decision, and it belongs in a CQV plan approved before execution. The method is that of ASTM E2500-25 (approved 1 April 2025), which ties the extent of verification to the impact on product quality and allows engineering activities to count as verification when performed under controlled conditions, with ICH Q9(R1) (Step 4, 18 January 2023) as the underlying risk management reference and the ISPE Good Practice Guide Approaches to C&Q of Pharmaceutical Water and Steam Systems as the industry guide — useful, not normative.

Reusing commissioning and FAT activities is not free, however. For a piece of evidence to count as verification you need acceptance criteria and procedure approved beforehand, competent and identifiable executors, calibrated instrumentation, data that are intact and retrievable, and final approval resting with Quality. If a single one of these elements is missing, the activity remains good engineering practice and has to be repeated inside the GMP package: reuse is paid for in advance, in preparation.

The weight column is deliberately empty: weighting depends on the site context and on the intended use of the water, and it must be assigned and justified internally before the matrix is applied. The method is covered in the article on quality risk management for water systems.

DQ: verifying that the design answers the URS

DQ is a documentary verification that needs no hardware, and for that reason it gets postponed until it becomes useless: signed after construction it verifies nothing, because design non-conformities are no longer correctable at acceptable cost. It must close before release to manufacturing and produce a traceable outcome requirement by requirement. If the URS is generic, DQ cannot be executed, and the problem resurfaces downstream as acceptance criteria invented at protocol stage: building verifiable requirements is covered in the article on the URS for pharmaceutical water and WFI systems.

FAT, commissioning and SAT

FAT has one structural advantage — correcting in the workshop costs a fraction of correcting on site — but it has to be used knowing what FAT cannot demonstrate. The feed water is the supplier's, so the removal performance observed is not transferable and does not count as performance evidence; the loop, the site utilities and the real consumption profile are all missing. What FAT verifies well is conformity of supply and intrinsic functionality: materials and certificates, welding documentation, instrumentation and calibrations, control logic and sequences, access management, skid-level alarms, behaviour under simulated failures. It closes with a punch list classified by impact and with an explicit list of the tests deferred to SAT or OQ.

Between the arrival of the components and formal qualification lies the phase that decides whether the system will be qualifiable: initial flushing and removal of construction residues, pressure and leak testing, weld inspection and documentation, verification of slopes and drainability, cleaning and passivation of the internal surface, instrument calibration, tuning of the control loops, first sanitisation. For cleaning, descaling and passivation of stainless steel the references are ASTM A380/A380M-25 and ASTM A967/A967M-25; for dimensions, joints, materials and surface finishes the contractual reference is ASME BPE, whose applicable edition must be fixed in the contract. Compressing this phase to recover upstream delay means spending weeks in PQ investigating erratic microbiological results produced by a loop that was not properly passivated; performing it well without an approved protocol and identified executors means being unable to reuse it. SAT then covers what FAT could not: real utilities, interfaces with the existing installation, communication with supervision.

IQ and OQ: conformity of the installation and performance at the limits

IQ answers a single question: what has been installed matches the approved design and is documented. It is not a presence checklist but a conformity verification, and each entry must reference the design document against which it is verified. The elements that make the difference during inspection of water systems recur: as-built P&IDs consistent with the installation; certificates for product-contact materials, with batch traceability; welding documentation, including boroscopic inspections where foreseen; surface finish records; slopes and absence of dead legs in line with clause 6.7; instruments with traceable calibrations; tank vent filters, for which clause 6.11 requires integrity testing before installation and after use, and prevention of condensation; software version and configuration.

OQ verifies operation within the defined operating range, and above all at its extremes: at average load a system behaves well almost by construction, the problems emerge at maximum simultaneous demand, on return from a shutdown, during sanitisation, or when a point of use is opened while the loop is in a transient. What cannot be missing is flow rate and flow regime in every branch, demonstrating the conditions established during qualification in line with clause 6.9; temperature distribution in loop and tank for hot systems; set point stability under variable demand; adverse demand scenarios and the recovery sequence; continuous monitoring and diversion logic where present. For TOC and conductivity the governing documents remain USP <643> and USP <645>: chapter <643> defines a target limit response of 500 µg of carbon per litre and explicitly states that it says nothing about how often the system suitability test should be run, leaving that to the user's risk assessment.

Alarms, interlocks and failure modes

Alarm testing is often reduced to a list of thresholds forced in software. A defensible test verifies four things for each relevant alarm: that it is generated by the real condition and not only by forcing; that it is annunciated where somebody will see it on the shift in which it happens; that the associated automatic action actually takes place; and that the event remains recorded in an attributable, non-alterable way.

The failure modes to be tested, not merely described, include loss of electrical power with the restart sequence, loss of compressed air to the valves, pump failure with changeover to the standby unit, loss of communication between PLC and supervision, a sensor out of range, and failure of a sanitisation cycle. For each one, the safe state must be defined and, above all, the return-to-service conditions: after a prolonged shutdown, what does the site require before the water is used again — flushing, sanitisation, sampling, or a combination. These are established during qualification, not improvised. Configuration, audit trail and data integrity are covered in the article on automation, SCADA and data integrity.

PQ: where most protocols go wrong

PQ has to demonstrate what the earlier stages cannot: that the system produces compliant water reproducibly over time, under real operating conditions, and that the observed variability is understood and under control. A structural consequence follows: because the alert levels of clause 6.13 derive from initial qualification data, they cannot be acceptance criteria for the PQ.

Phases, durations and sample numbers: practice or requirement

Splitting PQ into successive phases, with intensive initial sampling and progressive relaxation, is widespread and reasonable industry practice, not a regulatory requirement: no text in force prescribes the number of phases, their duration, the number of samples or the sampling frequency. Anyone writing "Phase 1, Phase 2, Phase 3" is applying an industry convention, and must declare it as such and justify its parameters.

Those parameters depend on the generation technology, because a membrane train and a distillation system have different microbiological risk profiles; on the operating temperature of the loop — hot, ambient or ozonated; on the variability and origin of the feed water; on the extent of seasonal variation at the site; on the intended use of the water and the grade required; on prior knowledge, that is, on equivalent systems already qualified at the same site with available history; and on microbiological method timelines, which set the latency between sampling and decision.

The only citable time indications are those of the EMA Q&A EMA/INS/GMP/443117/2017, and they must be cited with their scope: they concern WFI produced by non-distillation methods, for which the document expects extended testing, daily testing of all critical points in the initial phase, and data over approximately one year to capture seasonal variation. This is not a general rule for every water system, and it does not authorise writing "one year" into a PW protocol without further justification. In every other case the duration has to be built: declared in the protocol, justified against the factors above, and linked to explicit criteria for moving from one phase to the next.

Water quality testing during PQ

The analytical plan has three distinct components. The compendial attributes — conductivity and TOC for PW and WFI, endotoxins for WFI — have criteria set by the applicable monograph: they are cited, not invented. Microbiological control has no compendial limits: USP states explicitly that, because of the various uses of these waters, microbial requirements are not included in these monographs. The informational chapter USP <1231> reports non-binding action levels — 100 cfu/mL for Purified Water and 10 cfu/100 mL for Water for Injection, above which the water is unfit for use and an investigation is triggered — and states that users establish in-house specifications or fitness-for-use microbial levels. The third component is the feed water, to be sampled in parallel for the whole PQ: without that data the downstream variability cannot be interpreted and the specification required by clause 6.10 remains unverified.

Sampling points and sampling technique determine the meaning of the data more than frequency does, and they are covered in the article on sampling plans and sampling points: the technique used during PQ becomes the reference for all later trending, so it must be frozen and described with the same precision as the acceptance criteria.

Verification of sanitisation

Clause 6.12 requires sterilisation, disinfection or regeneration to be carried out according to a predetermined schedule and as a remedial action after out-of-limit results. Qualification therefore has to demonstrate two different things: that the cycle reaches process conditions at every point of the system, including the unfavourable positions — an OQ verification; and that the chosen interval is sustainable, that is, that microbiological quality does not degrade before the following cycle — demonstrable only with PQ data. WHO TRS 1025, Annex 3 requires validated thermal and/or chemical sanitisation at specified intervals, leaving the intervals to the manufacturer, and the EMA Q&A mentions thermal treatment above 75 °C while leaving contact times to the manufacturer's validation: neither publishes a universal interval. The subject is covered in the article on the qualification of sanitisation cycles.

Requirement-to-test traceability and deviations

The traceability matrix is the only document that makes it possible to answer during an inspection without leafing through the entire package. For each requirement it links criticality and the risk assessment that determined it, the design solution, the stage in which it is verified, the reference to the test, the outcome and any related deviations. Two checks make it useful rather than decorative: the search for orphan requirements, critical requirements with no verification, and the search for orphan tests, tests that answer no requirement and signal protocols copied from an earlier project. A matrix rebuilt at the end for the report documents what was done, not what was needed.

A deviation must be classified by impact on water quality and on the validity of the stage, not by convenience of closure: does the result invalidate tests already executed; is the cause in the system, the analytical method, the sampling or the execution; which tests have to be repeated and from which point. The most serious red flag is retroactive revision of the acceptance criterion: a criterion changed after seeing the result is no longer a criterion. On microbiological limits the EMA Q&A is explicit: increasing such limits is not good practice and may mask a failing system. Repeated, individually minor deviations must be assessed cumulatively, because a series of excursions in the same direction is data about the system.

Releasing the system for use

Release is a Quality decision and requires a closed list of conditions: complete traceability with no orphan requirements, deviations closed or accepted with impact assessed, alert levels derived from qualification data in line with clause 6.13 and loaded into the monitoring system, an approved routine sampling plan, sanitisation and maintenance procedures in force, trained personnel, and active change control and periodic requalification.

The most delicate decision remains: whether to use the water before completing the data collection that covers the seasonal cycle. It is legitimate but not automatic: it must be taken explicitly, approved by Quality and documented with a rationale stating which data are available, which additional controls stay active, what the criteria for suspending use are, and when the alert levels will be reviewed against the complete data set. What is not defensible is de facto use, started without a formal decision because production had to begin. How the system evolves after release is covered in the article on periodic review and retrofit.

Worked example: Site Delta

Site Delta is a fictitious site, used only as an example. Delta installs a membrane-based WFI system with a hot loop, fed by mains potable water of predominantly surface origin; mechanical completion is planned for the autumn and production is asking for release at the beginning of the following year.

In the CQV plan Delta documents three decisions. The feed water specification is defined during qualification as clause 6.10 requires, with parallel sampling for the whole PQ. Flushing, passivation and leak testing are executed under an approved protocol, with predefined criteria and identified executors, so that they can be recognised as verification. The PQ protocol states that the split into phases is an industry convention and not a requirement, and justifies the duration with the membrane technology, the surface origin of the water, the absence of equivalent systems already qualified at the site, and the scope of the EMA Q&A on non-distilled WFI, which is Delta's case. Because the annual cycle completes after the date production has asked for, Delta formalises the early release with a rationale approved by Quality: initial-phase sampling maintained at all critical points until the data set closes, criteria for suspending use fixed, and recalculation of the alert levels planned under change control.

Common mistakes and red flags

• PQ duration, number of phases, number of samples and frequency presented as an industry standard, with no rationale and no link to technology and feed water.
• Alert levels used as PQ acceptance criteria, when clause 6.13 defines them as derived from qualification data.
• Feed water specification neither defined nor verified, against the explicit requirement of clause 6.10 for WFI.
• Microbiological criteria copied from USP <1231> and presented as mandatory compendial limits, without stating that the chapter is informational and the levels non-binding.
• Commissioning evidence reused in qualification without an approved protocol, predefined criteria, identified executors and calibrated instrumentation.
• Alarms tested only by software forcing; no testing of failure modes and no documented return-to-service conditions after a loop shutdown.
• Acceptance criterion changed after the result in order to close a deviation; traceability matrix compiled at the end, with critical requirements lacking verification; the Annex 15 revision concept paper cited as an applicable requirement.

Three questions to ask in an audit: why the PQ lasted exactly that long and where that was written down before it started; which requirement this test verifies and which test verifies that requirement; how the most significant deviation was closed and who assessed its impact. The whole set of topics is collected in the Pharmaceutical Water & WFI Systems hub.

If you work on decisions of this kind, The Pragmatic GMP collects technical and regulatory analysis of GMP systems with the same approach.

Key takeaways

• PQ duration, number of phases, number of samples and frequency are not regulatory requirements. The split into phases is industry practice: it must be declared as such and justified against technology, operating temperature, feed water, seasonal variation, intended use and prior knowledge.
• The only citable time indications are those of EMA Q&A EMA/INS/GMP/443117/2017 within their scope, WFI produced by non-distillation methods: extended testing, daily testing of critical points in the initial phase, data over approximately one year for seasonal variation.
• Annex 1 supplies the verifiable objects: commissioning in the chain (6.7), seasonal variation in qualification (6.8), flow rate established during qualification (6.9), feed water specification (6.10), integrity testing of vent filters (6.11), sanitisation on a predetermined schedule (6.12), alert levels from qualification data (6.13), continuous monitoring for WFI (6.15).
• Alert levels are an output of PQ, not an acceptance criterion; microbiological limits are not compendial and must be set in house, with USP <1231> as an informational, non-binding reference.
• Reusing commissioning evidence is consistent with ASTM E2500-25 but requires predefined criteria, an approved procedure, identified executors, calibrated instruments and Quality approval. The applicable framework remains Annex 15 in its 2015 revision: the concept paper of 9 February 2026 is not a requirement.
• Release before the seasonal data set is complete is legitimate only if it is explicit, approved by Quality, with interim controls, suspension criteria and a planned recalculation of alert levels. No deviation should be closed by revising the acceptance criterion after the fact.

Regulatory and technical references

• EudraLex Volume 4, Annex 15 Qualification and Validation, 2015 revision, in operation since 1 October 2015; concept paper on the EU-PIC/S revision published 9 February 2026, corrigendum 16 July 2026, consultation closed 9 April 2026 — Annex 15 has not been revised. Annex 1 (C(2022) 5938 final), in operation since 25 August 2023 — clauses 6.7-6.13 and 6.15. health.ec.europa.eu
• EMA/CHMP/CVMP/QWP/496873/2018 Guideline on the quality of water for pharmaceutical use, in force since 1 February 2021; EMA/INS/GMP/443117/2017 Q&A Production of WFI by non-distillation methods – reverse osmosis, biofilms and control strategies, since 1 August 2017. ema.europa.eu
• PIC/S PI 009-4 Inspection of Utilities, rev. 4, since 1 January 2021 (picscheme.org); ICH Q9(R1) Quality Risk Management, Step 4, 18 January 2023 (ich.org).
• WHO TRS 1033, Annex 3 (2021) and WHO TRS 1025, Annex 3 (2020) Production of water for injection by means other than distillation. who.int
• ASTM E2500-25 (approved 1 April 2025); ASTM A380/A380M-25 and ASTM A967/A967M-25 for cleaning, descaling and passivation of stainless steel.
• USP <1231> Water for Pharmaceutical Purposes (official since 1 December 2021), informational chapter; USP <643> Total Organic Carbon; USP <645> Water Conductivity.
• ASME BPE Bioprocessing Equipment, applicable edition to be fixed contractually; ISPE Good Practice Guide Approaches to C&Q of Pharmaceutical Water and Steam Systems and ISPE Baseline Guide Vol. 4 Water and Steam Systems, 3rd ed. (2019) — industry guides, not normative texts.