Microbiological and Endotoxin Control of PW and WFI Systems

A PW loop that has returned counts close to zero for eighteen months is not necessarily a clean system. It may be a system in which biofilm is already mature and stable, and in which the routine sample only intercepts the water passing by. When an inspector asks how you demonstrate the absence of biofilm, the answer "we have always had low counts" is not an answer: it is precisely the data a mature biofilm produces in most samples. Microbiological and endotoxin control of a PW or WFI system is not about collecting low numbers, but about building evidence that supports a documented statement that the system is under control and stays that way.

Why a low planktonic count does not prove the absence of biofilm

This is where the credibility of the whole strategy is decided, and it needs to be understood before discussing limits, media and frequencies. In a water system the microbial population exists in a planktonic form, suspended in the fluid, and a sessile form, attached to surfaces within a matrix of extracellular polymeric substances. The routine sample measures only the former, for reasons that are cumulative.

• Surface-to-volume ratio. The internal surface of a distribution loop, the tank, the valves and the points of use is enormous compared with the volume of sample taken at a single moment. Even a significant detachment of biomass is diluted into a circulating water volume orders of magnitude larger.
• Detachment is discontinuous. Biofilm releases cells through continuous low-rate erosion, but above all through episodic sloughing triggered by flow variations, pressure transients, start-ups and shutdowns, thermal shocks, and the opening of points of use that have been idle. A sampling plan with a fixed frequency may systematically miss these events.
• Aggregation. Cells often detach as aggregates held together by the matrix. An aggregate of many cells produces a single colony on the plate and is counted as one colony-forming unit. The count underestimates the released biomass, and does so unpredictably.
• Physiological state. The flora of water systems is adapted to oligotrophic conditions. Released cells are frequently stressed, metabolically slowed, or in a viable but non-culturable state. A culture method not optimised for this flora recovers them poorly: the result is a low number that reflects the method, not the system.
• Location. Biofilm develops where velocity is low and the surface irregular: rarely used branches, areas downstream of valves, gaskets, tank surfaces above the liquid level. Many of these points cannot be sampled, while the points that are sampled are often the ones best swept by flow. Annex 1 clause 6.9 requires flow to remain turbulent precisely to limit microbial adhesion and biofilm: that is a preventive barrier, not proof of absence.
• Effect of sanitisation. A sanitisation cycle reduces the planktonic load and the surface layers of the biofilm, but does not necessarily remove the attached matrix. In the following days counts return to low values while the base of the biofilm survives and recolonises. A series of low results immediately after every sanitisation, rising progressively before the next one, is a pattern that deserves interpretation, not filing.

A low planktonic count is therefore a necessary but not sufficient condition. Demonstration of control is built by combining the count with its behaviour over time, the point-by-point map, continuous process parameters, the sanitisation history and, where needed, direct evidence. It is no coincidence that EMA Q&A EMA/INS/GMP/443117/2017 mentions destructive analysis of the membrane to confirm the absence of biofilm: when proof is needed, a water sample is not enough.

What lives in a water system

Purified water is a nutrient-poor environment and selects a specific flora: predominantly Gram-negative bacteria able to grow at very low organic carbon concentrations, frequently non-fermenting, with a strong tendency to attach to surfaces. The literature on pharmaceutical water systems recurrently reports genera such as Pseudomonas, Ralstonia, Burkholderia, Sphingomonas, Methylobacterium, Stenotrophomonas. The actual flora of an individual plant, however, cannot be inferred from the literature: it is determined by identifying the site's own isolates.

The dominance of Gram-negatives has a direct consequence: their cell wall contains lipopolysaccharide, that is, endotoxin. Microbiological control and endotoxin control are not independent programmes but two readings of the same phenomenon with different dynamics. The industry technical reference on this subject is PDA Technical Report No. 69 (2015) on bioburden and biofilm.

What the regulations require and what they do not

The USP monographs for Purified Water and Water for Injection control conductivity and TOC. On the microbiological side USP is explicit: "Because of the various uses of these waters, microbial requirements are not included in these monographs". There is therefore no compendial microbiological limit in the PW and WFI monographs.

USP general chapter <1231> Water for Pharmaceutical Purposes, official since 1 December 2021, is a general chapter numbered above 1000: it is informational and not binding. It indicates action levels of 100 cfu/mL for Purified Water and 10 cfu/100 mL for Water for Injection, described as levels above which the water is unfit for use and which trigger an investigation. In the same chapter USP states that it is for users to establish in-house specifications or microbial fitness for use levels. Those two numbers are therefore not a requirement: they are a reference the site must deliberately adopt, tighten or justify differently in the light of the intended use of the water.

Annex 1 of EudraLex Volume 4, in operation since 25 August 2023, sets no numbers but sets a method. Clause 6.13 requires regular and ongoing chemical and microbiological monitoring, with alert levels based on initial qualification data, periodically reviewed on the basis of requalification, routine monitoring and investigations. Clause 6.14 requires alert excursions to be documented, reviewed and investigated, distinguishing an isolated event from an adverse trend or deterioration of the system. Clause 6.12 provides for sterilisation, disinfection or regeneration according to a predetermined schedule and as a remedial action following out-of-limit results. Clause 6.11 requires the bacteria-retentive vent filters of the WFI tank not to be a source of contamination, with integrity testing before installation and after use. Clause 6.8 requires qualification to take account of seasonal variation.

WHO TRS 1033 Annex 3 (2021) follows the same logic: §12.8 states that alert and action levels are established from reported historical data, and §4.3.8 that for bulk purified water alert and action limits derive from system knowledge and data trending.

EMA Q&A EMA/INS/GMP/443117/2017 adds two operational messages: reverse osmosis typically operates at ambient temperature and is therefore an ideal environment for biofilm formation; and, verbatim, "increasing of such limits is not good practice and may mask a failing system". It also calls for extended testing in the initial phase, including daily testing of critical points, data over approximately one year to capture seasonal variation, and at least an annual assessment of the effectiveness of monitoring.

On the FDA side, 21 CFR 211.113(a) and (b) require written procedures to prevent objectionable microorganisms in non-sterile products and microbiological contamination of sterile products; no official list of objectionable organisms exists, because the classification is product-specific. The Guide to Inspections of High Purity Water Systems (1993) is reference material for investigators, not binding.

From informational levels to in-house specifications

The logical chain that stands up in an inspection is: intended use of the water, qualification data, historical data, risk assessment, in-house levels. Not the reverse. Three thresholds are distinguished, with different functions and different consequences.

• Alert level. A statistical threshold derived from the demonstrated performance of the system: under Annex 1 clause 6.13, from initial qualification data and then maintained through routine monitoring. It is not a water quality criterion but an early signal of drift: exceeding it requires documentation, review and assessment.
• Action level. The threshold above which a defined action is triggered, typically investigation and intervention on the system. This is where the USP <1231> reference sits, if the site adopts it.
• Fitness for use specification. The level tied to the suitability of the water for the downstream use: dosage form, route of administration, presence of bioburden reduction steps, terminal sterilisation, use as excipient or as final rinse. This is where a sterile site may have to be more restrictive than the informational references.

The justification is built from verifiable elements: qualification data per point of use with the seasonal variability observed, historical data and demonstrated system capability, criticality of the point relative to the product served, recurrent isolates, recovery performance of the method. An unjustified level is as open to criticism as an exceeded one.

The analytical method: the variables the site must fix

For pharmaceutical water there is no microbiological method prescribed by monograph. There are method variables that change the result by orders of magnitude: they must be selected, justified and kept constant, because trending is only meaningful when the method does not change.

None of these values should be copied from another site or from an article: they must be established, demonstrated and documented. Rapid microbiological methods are a concrete option for shortening time to result, which with culture methods is the real operational limitation of water control; they do, however, require demonstration of equivalence against the reference method and management of the discontinuity in the historical data series. USP chapters <61>, <62> and <1111> remain applicable for enumeration and tests for specified microorganisms.

Sampling: two purposes that must not be confused

A sample answers one question only, and the question depends on how it is taken. The sample representative of the water as used is taken from the point of use under the same conditions in which water is drawn for the process, including the hose or fitting used in production: it answers the question of the suitability of the water delivered. The sample representative of the state of the system is taken with sanitisation of the sampling point and a defined flush, to exclude the contribution of the point itself: it answers the question about the loop. Using the first to judge the system, or the second to release a batch, leads to wrong conclusions. The plan must state the purpose of each point, a subject covered in the article on sampling plans and sampling points.

Endotoxins: why they do not track the count

Endotoxin is a structural component of the Gram-negative cell wall. It is released during growth and, in larger amounts, on cell lysis. This produces two counterintuitive behaviours that must be managed in the strategy.

First: an effective thermal sanitisation kills cells but does not depyrogenate, and lysis can release endotoxin previously contained in cells and in the biofilm. A count that collapses accompanied by an endotoxin signal that does not collapse, or that rises, is coherent information, not an analytical anomaly. Second: the relationship between colony-forming units and endotoxin is neither linear nor stable, because it depends on the composition of the flora, on the share of non-culturable biomass and on the lysis history of the system. For this reason endotoxin control of WFI is an attribute in its own right, with its own frequency and its own in-house levels.

The operational variables of endotoxin sampling differ from those of microbiological sampling: endotoxin-free containers and materials, sample storage times and temperatures, adsorption onto container surfaces. Here too the values must be set and justified by the site. On methods, Ph. Eur. accepts recombinant factor C (rFC) for the bacterial endotoxins test in the water monographs: decision of the 175th session (March 2023), published in Supplement 11.4 with implementation from 1 April 2024. The change still requires validation on the actual matrix and change control with an assessment of the regulatory impact on dossiers.

In-house endotoxin levels, like microbiological ones, must be derived from intended use and system data, not copied. The implications of the generation technology choice are covered in the comparison between membrane-based WFI generation and distillation, where biofilm on ambient-temperature systems is a central theme.

Identification and objectionable organisms

Counting is not enough to investigate. Identification serves three purposes: distinguishing sample contamination from system contamination, locating the source by comparing isolates across points and over time, and assessing the relevance of the organism to the product.

The level of identification should be graded by risk: genus for routine monitoring and to build the typical site flora, species with higher-resolution methods for isolates associated with excursions, recurrent isolates, and isolates from points serving critical products. The site isolate library is what makes it possible to state that a finding is new, or that it is the same population reappearing after every sanitisation: without a library that distinction cannot be demonstrated.

Classification as objectionable is not an intrinsic property of the organism but the result of an assessment considering at least: route of administration and patient population, the organism's ability to survive or proliferate in the formulation, the robustness of downstream bioburden reduction steps, pathogenic potential, production of endotoxin or of metabolites that degrade the product. The same genus may be irrelevant for one product and unacceptable for another, and the assessment must be written before the excursion, not during it.

Trending: the reading that separates an isolated event from a failing system

Annex 1 clause 6.14 asks for exactly this distinction. To make it possible, trending must produce at least: behaviour per individual sampling point and not only in aggregate, because a local problem disappears in the average; identification of shifts and drifts; correlation with system events, that is sanitisations, maintenance, shutdowns, modifications; comparison between seasons, consistent with clause 6.8 and with the roughly one-year horizon indicated in the EMA Q&A; recurrence of the same microbial identification at the same point.

The opposite phenomenon also needs watching: a series that becomes progressively lower and more uniform may indicate a genuine improvement, or a loss of sensitivity of the method or of the sampling. Data that are too clean deserve the same scrutiny as out-of-limit data. Continuous monitoring of TOC and conductivity, required by clause 6.15 for WFI, does not replace the microbiological result but is the only signal available in real time between one sample and the next: it is covered in the article on TOC and conductivity monitoring.

Managing an excursion

The sequence must be defined in a procedure before it is needed, with responsibilities and timings.

1. Verification of analytical integrity: sample contamination, method deviations, traceability of the sampling. This is not a way to invalidate the result: a result is invalidated only with a demonstrated and documented analytical cause.
2. Assessment of product impact: which batches used water from that point between the last acceptable result and the excursion, with what intended use and what downstream reduction step, if any. This comes first when the level exceeded is an action level.
3. Containment: isolation of the point or branch, restriction of use, increased sampling frequency at adjacent points to delimit the extent.
4. Identification of the isolate and comparison with the site library.
5. Root cause investigation: recent interventions, flow and temperature parameters, sanitisation history, integrity of the tank vent filters under clause 6.11, condition of rarely used points of use.
6. Remedial action, typically sanitisation, which Annex 1 clause 6.12 explicitly provides for both on a predetermined schedule and as a remedy after out-of-limit results.
7. Effectiveness check with intensified sampling and return-to-normal criteria defined in advance, and assessment of whether the event constitutes an adverse trend under clause 6.14.

Repeated excursions each managed as an isolated event are, in themselves, an adverse trend. The recovery path for a colonised system is covered in the article on biofilm, rouging and recovery; demonstrating the effectiveness of interventions is covered in qualification of sanitisation cycles.

Worked example: Site Delta

Site Delta is a fictitious example. Delta manufactures non-sterile forms with an ambient-temperature PW loop fed by RO. After two years of consistently low counts, three points of use out of nine show rising results over six weeks, but always within the in-house action level: no formal excursion, therefore no automatic investigation.

The signal is nonetheless already there: three points, the same period, a monotonically rising trend, and the three points share the terminal section of the loop. Trending per point makes it visible; aggregate trending would have hidden it. Delta opens an assessment before the excursion, identifies the isolates and finds the same population at the three points, checks the flow rate and discovers that a layout change has reduced velocity in the terminal section, and correlates this with the seasonal rise in ambient temperature. The actions are on the system, not in the laboratory: restoration of flow conditions, review of the sanitisation schedule, intensified sampling with predefined return-to-normal criteria. What Delta does not do is raise the action level to bring the data back within limits.

Decision matrix for responding to an adverse trend

Weights are to be assigned by the reader according to their own context: criticality of the product served, required system availability, age and condition of the plant.

Common mistakes

• Treating USP <1231> levels as monograph specifications, without any documented in-house justification based on intended use.
• Changing medium, incubation time or temperature without change control and continuing to trend as if the series were homogeneous.
• Always sampling on the same weekdays and always after sanitisation, producing a historical series that describes the system at its best moment.
• Treating online TOC and conductivity monitoring as a substitute for the microbiological result.
• Never identifying isolates, and therefore being unable to distinguish a reappearance from a new contamination.
• Sanitising more often as a permanent response to a rising trend, without ever tracing the cause.

Inspection red flags

• In-house levels revised upwards after a series of excursions, justified on the basis of recent system performance.
• Alert levels not traceable to initial qualification data and never reviewed, contrary to Annex 1 clause 6.13.
• Repeated excursions each closed as an isolated event, with no trend assessment under clause 6.14.
• Points of use never sampled because they are "rarely used", which are statistically the most exposed to stagnation.
• No evidence of method recovery studies on the actual site flora.

If this level of operational detail is useful to you, The Pragmatic GMP is the newsletter where we publish technical and regulatory analyses on GMP systems. The full picture of this subject is in the Pharmaceutical Water & WFI Systems hub.

Key takeaways

• A low planktonic count does not prove the absence of biofilm: it measures a small fraction, released discontinuously, aggregated and physiologically stressed, sampled where flow is best.
• The USP PW and WFI monographs contain no microbiological requirements; the USP <1231> levels are informational and not binding, and must be translated into justified in-house specifications.
• Annex 1 imposes no numbers but imposes the method: alert levels from qualification data, periodic review, investigation of excursions distinguishing isolated events from adverse trends, sanitisation on schedule and as a remedy after out-of-limit results.
• Volume, technique, medium, temperature, time, neutralisation and hold time are not compendial requirements: they are choices to be justified with site data and kept stable.
• Endotoxin control is a standalone attribute: it does not track the count linearly and is not resolved by thermal sanitisation. Ph. Eur. has accepted rFC in the water monographs since 1 April 2024.
• Raising limits when the system exceeds them is the practice the EMA Q&A identifies as not good practice and potentially able to mask a failing system.

References

• EudraLex Volume 4, Annex 1 (2022), clauses 6.8-6.15 — health.ec.europa.eu
• EMA/INS/GMP/443117/2017, Q&A on production of WFI by non-distillation methods, biofilms and control strategies
• EMA/CHMP/CVMP/QWP/496873/2018, Guideline on the quality of water for pharmaceutical use — ema.europa.eu
• WHO TRS 1033, Annex 3 (2021), §4.3.8 and §12.8 — who.int
• USP, Purified Water and Water for Injection monographs; general chapter <1231>; chapters <61>, <62>, <1111>
• Ph. Eur., monograph 0169; acceptance of rFC for the bacterial endotoxins test in the water monographs, Suppl. 11.4, from 1 April 2024
• 21 CFR 211.113 — ecfr.gov
• FDA, Guide to Inspections of High Purity Water Systems (1993), non-binding — fda.gov
• PDA Technical Report No. 69 (2015), Bioburden and Biofilm Management in Pharmaceutical Manufacturing Operations
• PIC/S PI 009-4, Aide-Memoire Inspection of Utilities — picscheme.org