Periodic Review and Retrofit of Pharmaceutical Water Systems

An inspector asks for the long-term microbial count trend on the WFI loop. The data is there, no point ever exceeded the action level, no OOS in the period. Then come two questions that chart does not answer: how many sanitisations were carried out over that interval, and how many the schedule called for. The former far outnumber the latter, because the team added unplanned cycles every time a result crept towards the alert level. The system is within specification. It is within specification because someone keeps it there, not because it is under control.

This is what periodic review exists to catch, and what no monitoring dashboard shows on its own. A plant rarely moves from compliance to failure in a day: it loses margin over months, compensates with reactive maintenance and extra sanitisations, and keeps producing acceptable results until a seasonal variation, a prolonged shutdown or a rise in demand consumes what is left. This article covers two linked decisions: how to build a review that demonstrates the state of control rather than restating compliance, and how a defensible retrofit decision emerges from it.

Compliance is not a state of control

Compliance is a judgement on a single result: the measured value sits inside the limit. State of control is a judgement on behaviour over time: the distribution of results is stable and consistent with the one observed at qualification, and the actions needed to keep it there are the planned ones, not improvised ones. A system can be fully compliant and simultaneously out of control: when the median microbial count rises while staying below the action level, when recovery after sanitisation shortens, when the real interval between two cycles is shorter than the approved schedule, when unplanned corrective interventions grow while preventive ones remain formally completed. None of these signals generates a deviation; together they describe a system consuming its own margin.

EudraLex Volume 4 Annex 1 requires regular and continuous chemical and microbiological monitoring, with alert levels based on initial qualification data and periodically reviewed on the basis of requalification, routine monitoring and investigations (6.13), and requires alert excursions to be documented, reviewed and investigated, distinguishing an isolated event from an adverse trend or deterioration of the system (6.14). That distinction is the central question of periodic review, and it cannot be answered from a single result: it needs a time window, a population of data and a reading method declared in advance.

Where the periodic review obligation actually sits

This has to be stated plainly, because it is a common misconception in gap assessments: the Guideline on the quality of water for pharmaceutical use EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021, contains no periodic review clause and no periodic revalidation clause. It defines the minimum water grade as a function of intended use, recognises WFI production by purification processes equivalent to distillation, and requires prior notification to the supervisory GMP authority before introducing reverse osmosis; it sets no alert or action limits, prescribes no sanitisation frequencies and imposes no review cadence. Citing it as the regulatory basis of your periodic review SOP is a documentation error a prepared inspector spots immediately. The obligation does exist, but it is spread across several documents with different scopes.

• Annex 1 — the periodic review of alert levels (6.13) and the reading of excursions in terms of adverse trend (6.14) amount in practice to a mandate for continuous review. Annex 1 also requires qualification that accounts for seasonal variation (6.8), turbulent flow with a flow rate established at qualification and monitored routinely (6.9), sanitisation on a predetermined schedule and as a remedial action after out-of-limit results (6.12), and continuous monitoring such as TOC and conductivity on WFI systems (6.15): parameters the review must re-verify, not inherit from qualification.
• Annex 15 (2015 revision, operational since 1 October 2015) — the qualification, change control and requalification framework: this is where the obligation to assess whether a change requires requalification, and to what extent, lives. A concept paper on the EU/PIC-S revision of Annex 15 was published on 9 February 2026, with a corrigendum on 16 July 2026 and consultation closed on 9 April 2026: Annex 15 has not been revised, and the concept paper must be cited as a concept paper, never as a requirement.
• EMA/INS/GMP/443117/2017, Q&A on the production of WFI by non-distillation methods, in force since 1 August 2017 — within its own scope it calls for routine review of alert levels and, as a minimum, an annual assessment of the effectiveness of monitoring. It also contains the statement worth remembering whenever a trend worsens: increasing such limits is not good practice and may mask a failing system.
• Annex 11 — the version in force is the January 2011 one (operational since 30 June 2011), and it provides for periodic evaluation of computerised systems to confirm they remain in a validated state and GMP compliant: the PLC, the SCADA and the water system data historian fall within that perimeter. The draft revision consulted from 7 July to 7 October 2025 has not been adopted, has no published date of application and must not be used as a basis for requirements.
• ICH Q10 for continual improvement and management review: it justifies escalating the outcome of the water system review to management review level, with resources assigned. ICH Q9(R1) for the risk assessment that sets scope, depth and frequency.
• WHO TRS 1033, Annex 3 — covers system review and restates that alert and action levels derive from historical data and system knowledge (§4.3.8, §12.8). PIC/S PI 009-4, the Inspection of Utilities aide-memoire in force since 1 January 2021, describes how inspectors look at utilities.

The full picture of these interdependencies is gathered in the Pharmaceutical Water & WFI Systems hub.

Frequency and scope: the only citable cadence

No text in force sets a general periodicity for periodic review of water systems. The only citable cadence is the one in Q&A EMA/INS/GMP/443117/2017 — as a minimum, an annual assessment of the effectiveness of monitoring — with that document's own scope, namely WFI production by non-distillation methods. Writing in an SOP that "GMP requires an annual periodic review of the water system" is an unsupported extension of that sentence.

Frequency must therefore be set on a risk basis and justified in writing, using site-specific elements: criticality of the water relative to the products served; generation technology and operating temperature, because a cold membrane system and a hot loop have different microbiological risk profiles; maturity of the dataset, with a tighter cadence in the first operating cycles after qualification or after a major intervention; deviation history and open CAPAs; plant age and obsolescence of critical components. The defensible rule is that the frequency is declared, justified and revisited when conditions change. A symmetrical principle applies to scope: the review covers the whole system, even when the signal that triggered it concerns a single branch.

The input dossier: what goes into the review

The value lies not in the individual datasets, which the site already holds, but in putting them on the same time axis and looking for correlations no single function sees alone.

Chemical and microbiological trends

Conductivity and TOC give the fastest signal on chemical drift; microbial count and endotoxins give the slower and more meaningful signal on system health. They must be read as distributions: central position, dispersion, movement over time, behaviour by sampling point, seasonality. An increase in dispersion at an unchanged median is often the first useful signal, and goes unnoticed in any report that shows only the monthly maximum. Online instrumentation is covered in the article on TOC and conductivity monitoring.

Deviations, investigations, sanitisations

For deviations, what counts is recurrence of the same failure mode, closure time, verified CAPA effectiveness and the share of investigations closed as "cause not determined": a system with many investigations lacking a root cause is not a lucky system, it is a system whose behaviour is not understood. For sanitisations, three quantities must be compared — predetermined schedule, cycles actually run, and cycles run as a remedial action after an out-of-limit result — because the ratio between the last two is among the most honest indicators of system status. The recovery profile matters too: an ever faster return to baseline points to a cycle acting on the planktonic population but not on the adherent fraction. Cycle qualification and requalification are developed in the article on sanitisation cycles.

Maintenance, spare parts, obsolescence

The ratio of preventive maintenance completed on time to unplanned corrective maintenance says more than a failure count. Obsolescence requires information almost nobody collects systematically: components out of production or with announced end of support, lead times for critical spares, parts held in stock versus parts available only to order, availability of service competence on the installed model. A critical component with no available spare is a continuity risk that turns into a quality risk the moment pressure to restart the plant outweighs the rigour of restoration.

Calibration, instrumentation, software and alarms

On instrumentation, what matters is out-of-tolerance outcomes with the retrospective assessment of data already released, systematic drift of the same instrument between two calibrations, repeated probe replacements at the same point, and consistency between online measurement and offline verification: a probe that goes out of tolerance always in the same direction is not a calibration problem, it is information about the installation or the process. The periodic evaluation required by the Annex 11 version in force must then actually be performed, not declared: operating system and application support status, patches, access and profile management, audit trail review and whether it is practicable at all, verified backup and restore, critical parameters compared against the approved baseline. For alarms, the statistics matter — how many per month, how many recurring, how many acknowledged without action, how many disabled and under whose authorisation: a plant generating more alarms than an operator can assess is not monitored, it is noisy. The topic is covered in the article on automation, SCADA and data integrity.

Capacity against real demand

This is the most frequently missing section and the one that most often generates a retrofit. The system was sized against a demand assumed years earlier; since then the portfolio, formats, washing cycles and shift patterns have changed. The questions are concrete: real peak consumption against generation capacity and storage volume; actual simultaneity of draw-offs; tank recovery time; loop behaviour at maximum delivery, where return flow must still guarantee the turbulent regime established at qualification; residual margin before the system can no longer be sanitised within the available window. That last point is decisive: a system can lose the state of control simply because production no longer leaves it time to be sanitised.

Recognising the loss of margin

The most common real case is not the out-of-specification plant: it is the still-compliant plant that has stopped having margin. Recognising it requires a reading method declared before looking at the data, otherwise the assessment becomes a discussion of opinions about a chart.

Documenting these signals calls for two cautions. First, comparison between periods must use the same analytical method, the same sampling plan and the same rule for non-quantifiable results, otherwise an undeclared change produces fictitious trends in both directions. Second, if the trend worsens, the answer is not to revise limits upwards. An alert level is recalculated when the data shows the system has stabilised better than expected, or when the data baseline changes after an improvement; not when it is needed to bring awkward results back inside. Every recalculation must be documented with the reference dataset, the statistical method, the rationale and Quality Unit approval.

Retrofit triggers: questions, not thresholds

There is no regulatory threshold stating when a water system must be modified, and every generic numerical criterion in circulation is somebody's convention. The defensible way to build triggers is to phrase them as questions, attach the evidence needed to answer each one, and define in advance what happens when the answer is no.

The last row is the trigger sites discover late. In the Ph. Eur., the TOC test has replaced the oxidisable substances test in sterilised water for injections: monographs 0169 and 0008 and chapter 2.2.44 were updated in Issue 12.3, applicable from 1 July 2026, with 0169 and 0008 further revised in Issue 13.1 (implementation 1 January 2027). These changes do not touch the plant but they do touch methods, instrumentation and specifications: they must surface in periodic review, not in an audit. The same applies to standards referenced in URS and contract documents: ISO 22519:2019 was withdrawn on 4 April 2023 and replaced by the second edition ISO 22519:2023, while ISO/DIS 25413 is still under development and must be cited only as a draft project.

A retrofit is a change control, not an intervention

The fastest way to turn an improvement into an inspection observation is to run it as maintenance work. A retrofit on a qualified water system almost always touches product-contact surfaces, hydraulic conditions, control strategy and data. It belongs inside the Annex 15 framework, with a sequence that must be visible in the documents.

1. The real perimeter of the change: not just the component replaced, but everything that depends on it — instrumentation, control logic, alarms, sanitisation recipes, sampling points, as-built documentation.
2. Risk assessment per ICH Q9(R1), establishing which attributes may be impacted and with what severity, and driving the depth of subsequent verification.
3. Impact on existing qualification: which DQ, IQ, OQ and PQ documents remain valid, which need supplementing, which must be re-executed. Argued attribute by attribute, not declared wholesale.
4. Proportionate requalification plan: the extent follows the assessed risk — replacing a probe with an equivalent model and rebuilding the generation branch do not produce the same plan. Phase structure and FAT/SAT/IQ/OQ/PQ logic are in the article on water system qualification.
5. Transition period: how production is served during the works, which water is usable and under what additional controls, how the sections under intervention are separated from those in operation.
6. Surface restoration: cutting, welding and dismantling require cleaning and passivation to be replanned according to recognised practice — ASTM A380/A380M-25, ASTM A967/A967M-25 — with execution and verification documented. Skipping this is a common cause of rouging appearing right after a retrofit; the topic is explored in the article on biofilm and rouging.
7. Rebuilding the data baseline: after a significant intervention, alert levels derived from previous data may no longer describe the system. Decide in advance whether they remain applicable as a precaution and when they will be recalculated, with how much data and over what window. Annex 1 requires qualification to account for seasonal variation, and the EMA Q&A, for membrane systems, refers to data collected over about a year precisely to capture it: closing microbiological requalification within a short window must be explicitly justified.
8. Computerised system update: changes to logic, setpoints, alarm thresholds or data architecture require the corresponding CSV activity and an update to the Annex 11 periodic evaluation.
9. Prior notification where due: if the retrofit introduces reverse osmosis for WFI production, the EMA guideline requires prior notification to the supervisory GMP authority before introduction. Build it into the plan from the start, because it drives the schedule.

A science- and risk-based approach such as the one described in ASTM E2500-25 helps focus verification on what genuinely affects product quality, provided it stays clear that this is a voluntary standard: the GMP obligation remains Annex 15.

Worked example: Site Delta

Site Delta is a teaching example, not a real plant: sterile and non-sterile forms, a hot WFI loop and a cold PW loop fed by a common pretreatment. The team brings three observations to the review. On the PW loop, two terminal points of use show a rising microbial median across several monitoring cycles, always below the action level, with recurring isolates of the same type, and they receive additional unscheduled sanitisation cycles. On pretreatment, the corrective-to-preventive ratio has grown and two components have been declared end of support, with spares available only on the secondary market. Finally, after a new washing line started up, the PW tank no longer fully recovers between two peak draw-offs and the window for thermal sanitisation has shrunk to weekends.

Taken individually, none of the three is a non-conformity. Read together they describe a system that has used up its margin: insufficient capacity reduces sanitisation time, reduced sanitisation favours colonisation of the terminal zone, reactive maintenance increases invasive interventions. The review does not close with "system compliant", but with a risk assessment, a recommendation for a two-phase retrofit — first capacity and the sanitisation window, then rebuilding the terminal branch and eliminating two sections made poorly drainable by earlier modifications — and a brought-forward review date. All of it under change control, with qualification impact assessed attribute by attribute and a requalification plan that, for the rebuilt branch, includes intensified monitoring before alert levels are recalculated.

Decision matrix for the intervention option

The options are almost always more than two. The matrix makes the reasoning explicit; it does not produce a number. Weights are assigned by the site according to its own context and are deliberately left blank.

Periodic review checklist

• Scope, period covered and frequency declared, with the risk assessment rationale that justifies them.
• Comparison of scheduled, executed and remedial sanitisations, with recovery profiles.
• Deviations, OOS/OOT, investigations closed without a root cause, verified CAPA effectiveness.
• Preventive and corrective maintenance status, critical components and their lifecycle status.
• Outcome of the computerised system periodic evaluation and alarm statistics.
• Documented comparison of installed capacity against real demand, including available sanitisation windows.
• Review of alert levels with rationale, dataset and approval, or an explicit confirmation that they remain unchanged.
• An explicit conclusion on the state of control, actions with owner and date, and the date of the next review.

Common mistakes and red flags

• The review as a bundle of attachments: a hundred pages of charts without a signed conclusion on the state of control prove nothing.
• Limits revised upwards in response to a worsening trend, with a statistical justification built after the fact: the most serious red flag, and explicitly named bad practice in the EMA Q&A.
• Water system review and Annex 11 periodic evaluation run separately, with conclusions that never meet.
• No capacity section: without comparing real demand against the sizing basis, the review cannot catch the most common retrofit trigger.
• Retrofit handled as maintenance, with no change control, no qualification impact assessment and no proportionate requalification.
• Restart after an intervention with no documented restoration of cleaning and passivation on the surfaces worked on.
• Periodic review frequency quoted as a general regulatory requirement: it does not exist, and must be defined and justified by the site.

If you work on these topics, you can get practical GMP engineering analysis by subscribing to The Pragmatic GMP.

Key takeaways

• Guideline EMA/CHMP/CVMP/QWP/496873/2018 contains no periodic review or revalidation clause: the obligation comes from Annex 1 (6.13, 6.14), Annex 15 for change control and requalification, the January 2011 Annex 11 for computerised systems and ICH Q10 for continual improvement.
• The only citable cadence is the at-least-annual assessment of monitoring effectiveness in Q&A EMA/INS/GMP/443117/2017, within the scope of WFI production by non-distillation methods. Any other frequency must be set on a risk basis and justified.
• The most common case is the still-compliant system that has lost margin: it is recognised from the distribution of the data, the ratio of remedial to scheduled sanitisations and the recovery profile, not from a count of exceedances.
• Raising limits in response to a worsening trend is not good practice and may mask a failing system.
• Retrofit triggers are not numerical thresholds: they are questions with attached evidence and a predefined decision for a negative answer.
• A retrofit requires change control, qualification impact assessed attribute by attribute, requalification proportionate to risk and, if it introduces reverse osmosis for WFI, prior notification to the supervisory GMP authority.

References

• EMA, Guideline on the quality of water for pharmaceutical use, EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021 — ema.europa.eu; EMA, Q&A Production of WFI by non-distillation methods, EMA/INS/GMP/443117/2017, in force since 1 August 2017.
• EudraLex Volume 4: Annex 1, operational since 25 August 2023; Annex 15, 2015 revision operational since 1 October 2015; Annex 11, January 2011 version operational since 30 June 2011 — health.ec.europa.eu
• PIC/S PI 009-4, Inspection of Utilities aide-memoire, in force since 1 January 2021 — picscheme.org; WHO TRS 1033 Annex 3 (2021) — who.int
• ICH Q9(R1) (Step 4, 18 January 2023) and ICH Q10 (Step 4, 4 June 2008) — ich.org
• Ph. Eur., monographs 0169 and 0008, chapters 2.2.38 and 2.2.44. ASTM E2500-25, A380/A380M-25, A967/A967M-25. ISO 22519:2023 — iso.org; ISO/DIS 25413 (under development). FDA, Guide to Inspections of High Purity Water Systems (1993), non-binding — fda.gov