Qualify the intended use, not just the appliance
A refrigerator delivered with a manufacturer's certificate may still be unsuitable for the site's process. Room position, rejected heat, material arrangement, access patterns and service availability can change the outcome. Qualification must demonstrate that equipment, utilities, monitoring and operators work together within a defined operating envelope. The deliverable is permission to use a documented configuration, with boundaries that the operating team can understand and maintain.
This article covers pharmaceutical refrigerators, freezers, ultra-low temperature systems and controlled-temperature storage areas. Cryogenic conditions require specific assessment of the system, containers and safety risks; tests for mechanical refrigeration cannot simply be transferred. Analytical stability chambers and equipment used solely for laboratory work remain outside scope unless they perform an actual cold-chain storage function.
Establish the regulatory basis and ownership
[REQUIREMENT] For GMP activities, Annex 15, 2015 revision, places qualification within the lifecycle, with documented protocols, criteria and results. For distribution, EU GDP 2013/C 343/01 governs the applicable activities. The word “pharmaceutical” in a catalogue does not establish compliance of the installed system.
[GUIDANCE] WHO Supplement 7 provides technical guidance for storage areas. [QRM] ICH Q9(R1) supports proportionate verification. QA owns quality decisions, Engineering owns technical functions and Operations confirms that restrictions are workable. Suppliers may generate evidence, but they do not replace the site's acceptance of its intended use.
Turn user requirements into a verifiable matrix
[GEP] The URS should describe products, packs, useful capacity, authorised conditions, material movements, installation environment, continuity needs and required records. Avoid requirements such as “fast recovery” without a loading condition and an associated decision. An acceptable duration follows the process and product protection strategy, rather than a number copied from another appliance.
A traceability matrix links each requirement to its design solution, verification and final record. Where inspection or documentation replaces a physical test, explain why. Requirements that cannot be verified often reveal an incomplete URS. State exclusions as well: a system qualified for storage is not automatically qualified to freeze initially warm material. That operation introduces a different thermal load and may require separate evidence.
| Element | Qualification question | Expected evidence |
|---|---|---|
| Useful capacity | Which containers fit without obstructing airflow? | Demonstrated arrangements and loads |
| Temperature control | Does the authorised volume remain within its defined conditions? | Local histories against approved criteria |
| Failure detection | Does loss of control become a managed event? | Test of the complete alarm chain |
| Continuity | Which configuration protects stock during unavailability? | Challenge evidence and transfer plan |
| Records | Do records remain reliable and retrievable? | Access, export and recovery verification |
Define needs before selecting the technology. Use the discussion of cold rooms, refrigerators, freezers and ULT selection to compare architectures and operating envelopes. Qualification should not be the first occasion on which the team discovers that purchased capacity differs from usable capacity. If that gap appears, it must return to the design and commercial decision.
Design review, supplier evidence and preliminary testing
[GEP] Review refrigeration capability in the actual environment, heat rejection, maintenance access, probe penetrations, condensation, cleaning, electrical supply and protection. For ULT equipment, consider performance at expected room conditions and the effects of ice accumulation. Translate commercial performance claims into testable conditions. A recovery curve without starting load, ambient conditions and door history has limited value for comparison.
Factory and site acceptance testing can reduce uncertainty before use, but answer different questions. A factory test may verify functions unaffected by transport. A site test examines the real installation and interfaces. Identify which results can be reused, the document revision supporting them and checks still needed after delivery, relocation or an update. Reuse must follow an assessment of relevance.
The supplier dossier should distinguish serial-number-specific evidence, type testing and declarations. A curve obtained on a similar model does not automatically describe the installed unit. Review deviations, changes and limitations rather than only the signed cover sheet. Retain ownership of the review and a clear link between each received document and the requirement it supports.
IQ: verify what was actually installed
[GEP] Installation qualification establishes identity, configuration and connections. Record model, serial number, relevant software, accessories, shelf arrangement and final position. Compare power supply, protective devices, dedicated outlets and remote signals with the approved design. Check ventilation clearances in the actual configuration, including obstacles added after delivery. An installation drawing that predates a nearby cabinet may no longer describe the relevant conditions.
Identify control probes, monitoring probes and independent devices without confusing their roles. Review suitable calibration, manuals, drawings, critical spares and start-up instructions. For a system connected to an EMS or network, document the data path, dependencies and interface ownership. A connected cable does not prove that an event is recorded correctly or reaches the intended destination.
Assess installation discrepancies before tests that they could affect. A different electrical protective device may be acceptable after technical review; inadequate ventilation may undermine a temperature test. Separate cosmetic defects from discrepancies affecting performance, safety or quality. A punch list should make remaining work visible, not conceal conditions that prevent release.
OQ: challenge functions and operating boundaries
[QRM] Operational qualification examines controlled behaviour under defined conditions. Challenges may include stabilisation, temperature distribution, door opening, defrost, power loss and return, probe faults, restart and mode changes. Select scenarios by mechanism, consequence and detectability. Not every failure needs to be physically induced if a justified and safe method can verify the relevant function.
Define recovery of air temperature separately from recovery of the load condition. The display may return to range while a position in the useful volume remains unfavourable. Stabilisation criteria must likewise identify what is observed. Avoid irrelevant extreme challenges that produce dramatic curves without informing the intended process. Where destructive or hazardous tests are inappropriate, document the alternative and its limitations.
Test the complete alarm chain: event, detection, any delay, transmission, receipt, acknowledgement and escalation. Simulating a contact verifies a different part of the chain from creating a real temperature change. State what each method demonstrates and which steps are checked separately. Connect results to the alarm strategy, using product- and site-specific limits and delays.
PQ: demonstrate performance with realistic loads and people
[GEP] Performance qualification reproduces configurations that the site will authorise. Minimum load may reduce inertia; maximum load may obstruct circulation. Containers with similar dimensions may have different thermal masses. Describe distribution, starting temperature, packaging and insertion sequence. Justify simulants and their limits of representativeness, including whether they reproduce the relevant heat transfer mechanism.
Include relevant activities such as picking, replenishment, inventory checks, consecutive openings and shift handovers. Duration follows the cycles to be observed and remaining uncertainty, not a fixed number of days. Passing with closed doors does not establish suitability for frequent access. Necessary restrictions become workable instructions confirmed with Operations. If staff cannot consistently follow them, redesign the process or system.
Temperature mapping supplies spatial evidence, but PQ connects it to activities and decisions. A position outside criteria may require exclusion, a layout change or technical correction. If the remaining capacity does not satisfy the URS, qualification has not succeeded merely because the problematic positions were removed from the report. Reassess the original business and quality requirement.
Outages, redundancy and product transfer
[QRM] Two compressors do not automatically provide useful redundancy. They may share power, a controller or another vulnerable component. Identify common failures and verify which functions survive. Assess emergency generation together with transfer switching, restart, utility endurance and competing loads. A “backup” label does not describe actual continuity. The relevant question is which service remains available after a defined failure.
Alternative capacity must be available when needed, compatible with the product and reachable through a controlled transfer. Separate detection, decision, preparation, movement and restoration times. If the site cannot complete these activities within its demonstrated margin, other controls are required. An operational drill may supply evidence without exposing commercial batches. Include access to doors, keys, handling equipment and the responsible people.
For cryogenic systems, distinguish quality assessment from safety controls for gas, ventilation, access and handling. Refrigerant level and container position can matter alongside temperature. Qualification follows the actual architecture and manufacturer evidence; liquid phase, vapour phase and mechanical freezing are not equivalent configurations. The safety assessment and quality plan should agree on how challenges can be executed.
Electronic records and changes
[REQUIREMENT] For computerised systems within GMP, the currently listed Annex 11, January 2011 revision, is relevant. [GEP] Define critical functions, access roles, time synchronisation, change records, backup and recovery. A software certificate does not replace verification of the configuration actually used by the site.
Demonstrate that exports preserve identity, units, period and meaning. Examine loss of connection and reconstruction of events. Restoration of a network does not automatically mean every record has arrived. Specify who reviews data and anomalies and how a gap can be recognised. The review should distinguish missing measurements from measurements taken locally but transmitted later.
Maintenance access also deserves assessment before release. Determine whether replacing a probe, cleaning a condenser or changing a door seal requires unloading or temporary loss of monitoring. Specify the safe storage arrangement during that work and the checks needed afterwards. These practical details connect qualification to maintainability and avoid treating every predictable service event as an improvised emergency.
Link each change to the checks actually needed
[GUIDEGXP] Prepare a simple matrix connecting intervention type, affected function, previous evidence and required verification. Probe replacement may require checks of measurement, position and alarm response. A controller change can also affect setpoints, logic, communication and restart behaviour. Physical similarity of a spare does not establish functional equivalence to the approved configuration.
For a shelf change, ask whether useful volume, clearances or airflow change. For relocation, examine ambient conditions, supply, ventilation and connections. The matrix does not automatically prescribe full requalification; it makes the rationale for selected checks explicit. Where impact is uncertain, plan focused verification instead of assuming that earlier evidence remains applicable to the modified system.
At release, a reviewer should be able to start from the equipment identifier and find current configuration, tests, deviations and instructions without informal reconstruction. Distinguish superseded and current records, including supplier files and local copies. If units of the same range serve different uses, assign boundaries to each one. Handover also confirms that people, labels and location records describe the same authorised system. A document revision must reach the operating process, rather than remain an administrative change that staff cannot recognise.
Hypothetical case: an ULT freezer passes empty
A hypothetical ULT freezer passes initial checks without load. Before PQ, the department proposes larger containers to increase storage density. The team identifies possible obstruction of circulation and treats the new arrangement as a configuration to evaluate. Similar occupied volume is insufficient to declare equivalence because obstruction and thermal behaviour can differ.
During simulated replenishment, one zone recovers more slowly than expected while the control probe returns to its own range. The investigation links the effect to container arrangement and access sequence, without immediately blaming the compressor. Alternative configurations are compared, and a practical access procedure is verified. Original and repeated results are retained with their reasons.
The solution changes the layout and makes filling limits visible. PQ demonstrates the approved configuration; QA confirms that final capacity still meets the URS. Training, instructions and location records are updated together. Qualification produces a usable system with maintained boundaries, rather than a collection of favourable curves selected from different configurations.
Release and lifecycle checklist
- Every critical requirement has a traceable verification and conclusion.
- Configuration, loads and authorised volume agree with operating instructions.
- Deviations and actions affecting use are resolved or addressed through a formally justified decision.
- Monitoring, alarms and response are verified across their respective interfaces.
- Maintenance, calibration, spares and support have clear owners.
- The emergency plan and alternative capacity are workable in practice.
- Operators and maintenance staff understand restrictions, signals and escalation.
- Periodic review considers trends, failures, changes and continuing validity of assumptions.
[GUIDEGXP] Requalification follows impact and risk after relocation, interventions, load changes, updates or unexpected performance. Not every repair requires repetition of the entire package, but every decision should identify affected functions and necessary checks. Deciding not to repeat a test also requires an evidence-supported rationale. Keep the current configuration easy to distinguish from superseded versions.
Errors, warning signs and operational conclusion
Warning signs include accepting only a commercial certificate, IQ without a final location, tests without an authorised load, alarms checked only on the display, untested data recovery, occupied emergency capacity and criteria changed to make a result acceptable. Another weakness is approving qualification while procedures and layouts still describe earlier configurations. The evidence and the operating reality must agree.
[GUIDEGXP] Release should state what is authorised, under which restrictions and who maintains the qualified state. Place that decision within the Cold Chain & Controlled Temperature Systems lifecycle. Sources checked on 21 September 2026: Annex 15 (2015), Annex 11 (2011), EU GDP 2013/C 343/01, WHO Supplement 7 and ICH Q9(R1). They do not establish one universal frequency, duration or sensor count for every system.
