Qualification of Pharmaceutical Water Sanitisation Cycles

An inspector asks for the rationale behind the WFI loop sanitisation cycle. The answer comes back as a recipe: a frequency, a set point, a duration, all inherited from commissioning and never re-examined since. The follow-up questions are always the same. Why that set point. Why that duration. And how do you demonstrate that the sanitant actually reaches the last point of use on the longest branch, at the required conditions, for the required time. At that moment the conversation shifts from the recipe to the method, and that is where most dossiers turn out to be thin.

The weakness does not come from wrong parameters. It comes from the fact that the applicable texts do not provide the recipe and never intended to. They require the treatment to be carried out to a predetermined schedule and to be validated. The numbers belong to the site. This article is about how they are built.

Sanitisation, disinfection, sterilisation: the word you choose sets the burden of proof

Annex 1 of EudraLex Volume 4, at clause 6.12, refers to sterilisation, disinfection or regeneration according to a predetermined schedule and as a remedial action following out-of-limit or out-of-specification results. Three different words, three levels of claim, plus a fourth — sanitisation — that the regulatory texts do not define but that industry uses constantly.

• Sterilisation: a validated process delivering a defined probability of microbial survival. Burden of proof: heat penetration studies, biological indicators or a justified equivalent approach, lethality calculation, a declared acceptance criterion. On a loop this means SIP in practice, with PDA Technical Report No. 61 (2013) Steam In Place as the industry reference.
• Disinfection: reduction of the viable microbial population to a defined level, with a demonstrated agent and demonstrated efficacy.
• Sanitisation: the working term for the periodic bioburden-reduction treatment that does not claim sterility. It is what virtually every PW and WFI loop actually performs.
• Regeneration: not a synonym. It applies to bed units — softeners, ion-exchange resins, EDI modules — where restoring the function is also a microbial control event.

Why this matters during an inspection: if the SOP states "loop sterilisation" and the dossier contains temperature profiles with no lethality criterion, no load qualification and no indicators, the gap between what is claimed and what is demonstrated is a finding, regardless of how technically sound the cycle is. The rule is trivial and routinely ignored: URS, SOP, protocol and report must use the same word, the one that matches the evidence actually produced.

What the texts require, and above all what they do not say

Annex 1 clause 6.12 requires treatment according to a predetermined schedule and as a remedial action after out-of-limit or out-of-specification results. It names no agents and sets no temperatures, concentrations, contact times or frequencies. Clause 6.10 cites, as an example of storage and distribution that minimise microbial growth for WFI, constant circulation above 70 degrees: that is an example relating to continuous operating conditions, not a mandatory set point and not a sanitisation cycle parameter. Confusing the two is the most common error and the easiest to take apart. Clauses 6.13 and 6.14 close the frame: alert levels based on initial qualification data and periodically reviewed, excursions documented and investigated, distinguishing an isolated event from an adverse trend. It follows that sanitisation frequency is not a frozen design figure: it is a variable that trending may force you to revisit.

A point that saves time: the Guideline on the quality of water for pharmaceutical use EMA/CHMP/CVMP/QWP/496873/2018, effective from 1 February 2021 and replacing CPMP/QWP/158/01, does not set sanitisation parameters or alert and action limits. Anyone looking there for cycle parameters will not find them, and not because they sit elsewhere in the same document: that guideline deals with the minimum water grade for the intended use and with prior notification to the supervisory GMP authority before introducing RO for WFI.

Q&A EMA/INS/GMP/443117/2017, effective from 1 August 2017, is the European document that does engage with the subject: it refers to thermal and/or chemical sanitisation, mentions thermal treatment above 75 degrees and explicitly leaves contact times to the manufacturer's validation. Two qualifications matter: that figure lives in the context of WFI production by non-distillation methods and biofilm control in ambient-temperature systems, and the variable that makes a temperature effective — time — is expressly the site's responsibility. The same document warns against shortcuts: "Increasing of such limits is not good practice and may mask a failing system".

WHO TRS 1025, Annex 3 (2020), within its own scope — WFI produced by means other than distillation — requires thermal and/or chemical sanitisation that is validated at specified intervals, with the intervals set by the manufacturer and no numerical limits. The operative word is "validated", not "performed". USP <1231>, official since 1 December 2021, is an informational and therefore non-binding chapter: it covers sanitisation, ozone included. An excellent technical base and a poor citation if presented as a requirement. Among industry guides, the ISPE Good Practice Guide Ozone Sanitization of Pharmaceutical Water Storage & Distribution Systems, 2nd edition (October 2024), is the dedicated ozone text; ISPE Baseline Guide Vol. 4 and PDA TR No. 69 (2015) complete the picture. None of these documents is regulatory.

The qualification framework remains Annex 15 (2015 revision, operational from 1 October 2015): the cycle is a system function, so it falls within OQ and PQ, change control and periodic review. The concept paper on the EU-PIC/S revision of Annex 15, dated 9 February 2026 with a corrigendum of 16 July 2026, remains a concept paper: Annex 15 has not been revised. For the framing of the qualification stages, see the article on FAT, SAT, IQ, OQ and PQ of pharmaceutical water systems.

Define the cycle before you qualify it

A cycle that cannot be qualified is almost always a cycle that was poorly defined. Four documented decisions come before the protocol.

Boundaries. Which portions of the system the cycle covers and which it does not: generation, tank liquid phase and headspace, spray ball, vent filter and its jacket, supply and return, heat exchangers, point-of-use and sampling valves, in-line instruments and thermowells, by-passes, drains. Anything left outside must have a declared alternative: a different cycle, periodic replacement, or an accepted risk with a written justification. The tank vent filter is the classic omission, while Annex 1 clause 6.11 requires that it must not be a source of contamination.

Phases. Thermal: heat-up, hold, cool-down, return to operating conditions. Chemical: fill, contact with recirculation, drain, rinse, verification. Ozone: build-up in the tank, distribution, contact, destruction, residual verification. For each phase: entry conditions, criterion for moving to the next phase, expected and maximum duration, behaviour on deviation.

Parameters. Formally distinguish control parameters (what drives the cycle), monitoring parameters (what records it) and critical parameters (those whose failure invalidates the cycle). Many unmanageable deviations arise from parameters that are recorded but never classified: when the value leaves the range, nobody knows whether the cycle counts.

System state during the cycle. Position of point-of-use valves, hoses or users connected, isolation of incompatible users, handling of instruments that cannot tolerate cycle conditions. A thermal cycle run with the points of use closed does not sanitise the portion downstream of the valve: that portion must be declared out of scope or included through a prescribed, verifiable manipulation.

Worst case: chosen by criteria, not by experience

The core of the dossier is the demonstration that the sanitant reaches the worst-case location at the required conditions for the required time. That location is not chosen out of habit or ease of access: it is derived from P&IDs, isometrics and the hydraulic and thermal balance, and it is justified in writing. Criteria that survive challenge:

• hydraulic distance from the point where the sanitant enters, and cumulative pressure drop;
• low-flow or intermittently used branches, where the turbulent flow Annex 1 clause 6.9 requires in normal operation may not be achieved under cycle conditions;
• thermal mass and heat loss: large-bore valves, thermowells, uninsulated runs, polymeric components, points of use in cold areas;
• non-drainable geometries and residual dead legs, relevant to thermal and chemical cycles alike because they obstruct volume displacement (see dead legs, slopes, materials and hygienic design);
• surfaces not continuously wetted: tank headspace, vent filter housing, rupture disc, high vents;
• locations already flagged by documented surface phenomena — rouging, established biofilm — in previous investigations on the system.

There is one methodological rule: you map more locations than you declare as worst case. You measure a population of points, look at the distribution, identify the empirical minimum and check that it matches the one the rationale predicted. If it does not match, you correct the rationale, not the data.

Thermal, chemical, ozone: what changes in the evidence

The three families differ in what must be mapped, in where the weak point hides and in what remains in the system afterwards. Choosing between hot, cold and ozonated systems is an architectural decision that precedes the cycle; what matters here is what follows in the dossier.

Building the evidence: instrumentation, replicates, criteria

Instrumentation. Independent of the control instrumentation, calibrated before and verified after the study, with the drift acceptance criterion defined in the protocol before execution. Relying on the loop's own process probes as the only evidence is the most recurrent weakness: those probes tell you what happens where they are installed, which is almost never the worst-case location.

Measurement points. Number and position follow from the worst-case rationale, not from a round number. Every point needs an identifier traceable to the isometric and the P&ID: "point of use in area A" is not an identifier. The point map, with its rationale, belongs in the report.

Replicates. The number of consecutive conforming cycles must be set and justified by the site: none of the cited texts prescribes a number. What makes the choice defensible is showing that the replicates cover the realistic worst conditions — user configuration, load, system state, season. Annex 1 is explicit at clause 6.8: qualification takes seasonal variation into account. A cycle qualified only in summer on a cold loop is half qualified.

Acceptance criteria. Expressed on the worst-case location and on the population of mapped points, never on the average. And above all: contact time is counted from the moment the worst-case location reaches the condition, not from cycle start and not from the control probe reaching set point. This single definitional choice separates a demonstrated cycle from a declared one, and in many dossiers it is the only thing missing.

Automation. The cycle is almost always executed by the control system: sequence, alarms, interlocks, interruption handling and the electronic cycle record are subject to OQ and fall within the scope of the Annex 11 currently in force (January 2011 version) and of 21 CFR Part 11. The cycle record is what release will be based on: if it is not attributable, legible and retained, release has no basis.

Residue removal and return to the qualified state

The cycle does not end when contact ends. In chemical cycles the rinse must be qualified with the same rigour and with a worst case of its own: the last point displaced during the rinse is not necessarily the last point the sanitant reached. The acceptance criterion must be specific to the agent: if the agent is not detectable through the water release parameters — conductivity per USP <645> or Ph. Eur. 2.2.38, TOC per USP <643> or Ph. Eur. 2.2.44 — a dedicated method is needed, with demonstrated specificity and an adequate limit of quantitation. The acceptance limit must be justified on a toxicological basis or as demonstrated absence; "below the detection limit of the instrument we had" is not a justification, it is an observation.

In ozonated systems residual destruction, typically by UV, precedes distribution to the points of use. Three distinct things must be demonstrated: the absence of residual ozone at the worst-case points of use and not merely downstream of the destruct unit, the system behaviour on failure or degradation of that unit (alarm, interlock, release blocked), and the repeatability of the sequence after an interruption. In thermal cycles the residue is one of state: recovery covers cool-down, restoration of the conductivity and TOC profiles and, in cold systems, the return to operating temperature without prolonged dwell in the range that favours growth.

Recovery time must be measured during qualification and becomes a planning input: it is the share of unavailability nobody accounts for until a batch runs short of water. One last detail that inspections always find: the TOC and conductivity excursion in the post-cycle window is expected, but whether and how those data enter trending must be set by a written rule. Excluding them informally is indefensible.

Microbiological verification: what it actually demonstrates

A conforming sample taken immediately after the cycle demonstrates very little: the cycle does not deliver sterility, and the moment right afterwards is when any system, including a sick one, shows its lowest count. What carries information is the microbial recovery profile between one cycle and the next: when the count re-emerges, at which locations, with which species. That profile is what justifies the interval, consistently with Annex 1 clauses 6.13 and 6.14.

The design of the verification follows: sampling at the worst-case locations identified by the distribution study, at increasing times after the cycle, over enough cycles to observe repeatability; methods and volumes consistent with the system sampling plan; identification of isolates to the level needed to distinguish recurrent flora from episodic contamination, as discussed in relation to microbiological and endotoxin control in PW and WFI.

Two cautions. The action levels given in USP <1231> — an informational, non-binding chapter — are levels above which the water is considered unfit for use and which trigger an investigation: they are not efficacy criteria for a cycle, and using them as qualification acceptance criteria is a category error. And efficacy against established biofilm is not measured by planktonic counts: the planktonic population returns while the sessile one remains. If the recovery profile shortens progressively for the same cycle, either the cycle is losing efficacy or the system is degrading; the wrong answer to that signal is the one Q&A EMA/INS/GMP/443117/2017 names: raising the limits masks a failing system.

Releasing the system for use after sanitisation

Release is a decision and must be written as one. Minimum elements: review of the cycle record (critical parameters within criteria, alarms, interruptions), verification of the recovery state on in-line physico-chemical parameters, residue verification where applicable, the role authorised to release, and traceability of the moment water becomes available again at the points of use.

One question the SOP must answer explicitly: do you release while the microbiological result is pending? In almost every system the operational answer is yes, because incubation time exceeds any realistic recovery time. The rationale then rests on physico-chemical parameters and on historical system knowledge, must be stated in those terms, and must come with the feedback rule: what happens if the result comes back out of limit once the water has already been used, which batches are assessed, who decides. If that rule is not written, it exists anyway — improvised, on the day it is needed. The criteria for an interrupted or failed cycle deserve the same treatment: whether it counts towards the schedule, whether and how it is repeated, what happens to the water in the system, and at what threshold a formal investigation starts.

Decision matrix for the sanitisation strategy

There is no universally better answer. The matrix lists the criteria that turn out to be decisive; the weights are left empty because they are assigned by whoever knows the system and the production constraint.

Worked example: Site Delta

An illustrative, fictitious site. Site Delta runs a cold PW loop with periodic thermal sanitisation, the cycle having been defined by the supplier at commissioning and never re-examined. Over several months, microbiological trending shows a progressively shorter time to re-emergence of counts at two points of use served by an intermittently consumed branch.

The site does not raise the alert levels. It rebuilds the worst-case rationale from the P&IDs and isometrics and finds that those two points were not among the locations mapped in the original qualification, which had concentrated on the most accessible ones. It runs a distribution study with independent probes: for the same condition measured at the return, the two points reach the required condition later and hold it for less time. The analysis separates two causes: a design limitation — insulation, thermal mass, geometry — or a manipulation effect, that is, the position of the point-of-use valves during the cycle.

The resulting decision introduces no new parameter. The site prescribes a manipulation at those points during the hold phase, anchors the start of contact-time counting to the real worst-case location instead of the return probe, requalifies the cycle against the corrected criterion, updates the SOP, protocol and point map, and verifies the effect on the recovery profile over a defined number of cycles before consolidating the interval. All of it under change control, within the Annex 15 framework. The point: the parameter did not change; the location at which the parameter is verified did — and with it the validity of the entire dossier.

Common errors and inspection red flags

• Treating the Annex 1 clause 6.10 example — constant circulation above 70 degrees as an operating condition — as a mandatory parameter of the periodic cycle.
• Counting contact time from cycle start or from the control probe rather than from the worst-case location.
• Declaring "sterilisation" and producing evidence of sanitisation.
• Qualifying the contact phase but not the rinse, or having no agent-specific analytical method.
• Inheriting the parameters from the supplier without taking ownership through a site rationale.
• Study instrumentation with no drift criterion defined in advance, or measurement points not traceable to isometrics and P&IDs.
• Qualification replicates all executed within the same seasonal window.
• An SOP with cycle parameters but no document explaining where they came from, and a qualification report with no point map and no worst-case rationale.
• Sanitisation frequency increased in practice because "it works better that way", with no change control and no investigation.
• Alert levels raised at the same time as the recovery profile deteriorates.
• An ozone destruct unit with no alarm or interlock, and no residual verification at the worst-case points of use.
• A tank vent filter outside every sanitisation strategy and outside every justification.
• The cycle excluded from periodic review, and therefore never re-examined in the light of trending.

The sanitisation cycle is one of the places where a water system shows its state of health most clearly: for the full picture, start from the pharmaceutical water and WFI systems hub.

If this kind of analysis is useful in your day-to-day work, The Pragmatic GMP collects practical insights on qualification, systems and GMP compliance.

Key takeaways

• No applicable text fixes temperature, concentration, contact time or frequency: Annex 1 requires a predetermined schedule, WHO TRS 1025 Annex 3 requires validated intervals set by the manufacturer, Q&A EMA 443117/2017 leaves contact times to the site.
• EMA guideline 496873/2018 does not set sanitisation parameters: looking there for cycle parameters is wasted time.
• The value of the dossier lies in demonstrating that the sanitant reaches the worst-case location, not in the merit of the nominal set point.
• Contact time must be counted from the worst-case location: that definition either sustains or collapses the whole qualification.
• The cycle does not end with contact: rinse, residue removal, recovery and release are part of the same qualification.
• The interval is justified by the microbial recovery profile between cycles, not by a conforming sample taken right after the cycle.

Regulatory and technical references

• EudraLex Volume 4, Annex 1 (C(2022) 5938 final), operational from 25 August 2023 — clauses 6.8-6.14: health.ec.europa.eu
• EudraLex Volume 4, Annex 15 Qualification and Validation, 2015 revision, operational from 1 October 2015; the EU-PIC/S revision concept paper of 9 February 2026 (corrigendum 16 July 2026) remains a concept paper. Annex 11 Computerised Systems, January 2011 version (in force); the draft revision consulted on from 7 July to 7 October 2025 has not been adopted.
• EMA/CHMP/CVMP/QWP/496873/2018 Guideline on the quality of water for pharmaceutical use, effective from 1 February 2021 — does not set sanitisation parameters: ema.europa.eu. Q&A EMA/INS/GMP/443117/2017 Production of WFI by non-distillation methods, effective from 1 August 2017.
• WHO TRS 1025, Annex 3 (2020) Production of WFI by means other than distillation; WHO TRS 1033, Annex 3 (2021): who.int. PIC/S PE 009-17 and Aide-Memoire PI 009-4 Inspection of Utilities, rev. 4 (1 January 2021): picscheme.org
• USP <1231> (informational, official from 1 December 2021), <643> TOC, <645> Water Conductivity; Ph. Eur. 2.2.38 and 2.2.44.
• FDA Guide to Inspections of High Purity Water Systems (July 1993), reference material for investigators, non-binding: fda.gov. 21 CFR Part 11: ecfr.gov. ICH Q9(R1) (Step 4, 18 January 2023): ich.org
• Industry guides, not regulatory: ISPE GPG Ozone Sanitization of Pharmaceutical Water Storage & Distribution Systems, 2nd ed., October 2024; ISPE Baseline Guide Vol. 4 Water and Steam Systems, 3rd ed., September 2019; ISPE GPG Approaches to C&Q of Pharmaceutical Water and Steam Systems; ISPE GPG Sampling for Pharmaceutical Water, Steam, and Process Gases; PDA TR No. 61 (2013) Steam In Place; PDA TR No. 69 (2015) Bioburden and Biofilm Management; ASME BPE, applicable edition to be fixed contractually (part SD, drainability).