The validation master plan (VMP) is the governing document that defines a pharmaceutical site's qualification and validation strategy: what must be validated, with which approach, under whose responsibility, and how the validated state is maintained over time. In inspections it is often one of the first documents requested, because it immediately shows whether validation is governed or merely endured. This updated guide gives you a section-by-section annotated template, a practical example of scope and Validation Master List, and the changes introduced by PIC/S PI 006-4, effective 1 October 2026.
Validation Master Plan: What EU GMP Annex 15 Requires
EU GMP Annex 15 (EudraLex, Volume 4), in operation since 1 October 2015, states in paragraph 1.4 that the key elements of the site qualification and validation programme should be clearly defined and documented in a validation master plan or equivalent document. Paragraph 1.5 lists the minimum content the VMP must include or reference:
- the site qualification and validation policy;
- the organisational structure, with roles and responsibilities;
- a summary of facilities, equipment, systems and processes with their validation status;
- change control and deviation management as applied to validation;
- guidance on developing acceptance criteria;
- references to existing documents;
- the qualification and validation strategy, including requalification where applicable.
Paragraph 1.6 adds that for large and complex projects planning takes on added importance and separate validation plans may enhance clarity. Paragraph 1.7 requires the VMP to document how risk assessments are used to support qualification and validation activities, with reassessments as process knowledge grows.
New for 2026: PIC/S PI 006-4
On 30 July 2026 PIC/S published its Recommendations on Qualification and Validation (PI 006-4), which enter into force on 1 October 2026 and supersede the long-standing PI 006-3 on Validation Master Plan, Installation and Operational Qualification, Non-Sterile Process Validation and Cleaning Validation. The document is written for inspectors, and that is precisely the point: it describes what a PIC/S-trained inspector expects to find when they open your VMP.
For VMP owners the practical consequence is clear: the next revision of the document can no longer simply cite Annex 15. Verify that your risk-based strategy, validation lifecycle and the link between the VMP and its operational evidence (protocols, reports, Validation Master List) are also aligned with PI 006-4, and record that verification as a documented gap assessment.
Updates like PI 006-4 keep coming: for a practical weekly digest, without chasing the authorities' websites, subscribe to The Pragmatic GMP, GuideGxP's free newsletter for QA, QC and Validation professionals.
VMP Template: The Essential Sections
An effective validation master plan template must be readable by an inspector, manageable internally and connected to real evidence. This structure covers the Annex 15 requirements and holds up well in audits:
| VMP Section | Expected Content | Reference |
|---|---|---|
| Purpose and scope | Site perimeter, inclusions and exclusions with rationale | Annex 15 §1.4 |
| Validation policy | Principles, risk-based approach and lifecycle | Annex 15 §1.5(a) |
| Organisation and responsibilities | QA, Validation, Engineering, Production, QC and IT roles; Quality Unit oversight | Annex 15 §1.5(b) |
| Inventory and validation status | Facilities, utilities, equipment, processes, computerised systems and their status | Annex 15 §1.5(c) |
| Change control and deviations | Validation impact assessment on changes, deviations and CAPA | Annex 15 §1.5(d) |
| Acceptance criteria | How they are developed and approved | Annex 15 §1.5(e) |
| Strategy per category | Equipment and utilities qualification, process validation, cleaning validation, CSV, analytical methods; requalification | Annex 15 §1.5(g) |
| Quality Risk Management | Where and how risk assessments drive scope, depth and priorities | Annex 15 §1.7, ICH Q9(R1) |
| Annexes | Validation Master List, matrices, RACI, requalification plans | Annex 15 §1.5(f) |
The body of the document describes strategy and criteria; the operational detail of the assets lives in controlled annexes. A 25-60 page VMP that is site-specific and has current annexes is worth more than 150 narrative pages nobody maintains.
Practical Example: Scope and Validation Master List
The two components inspectors spend the most time on are the scope and the Validation Master List.
Scope in/out. The practical rule: if something can impact product quality, patient safety or GMP data integrity, it is either included in the scope or excluded with a documented rationale. For example: LIMS and MES enter the scope because they manage GMP data; e-mail is excluded with a justified rationale; the non-GMP R&D laboratory is out only if its physical and documentation boundaries are defined by a boundary assessment.
Validation Master List. This is the annex that turns the VMP from a statement into a governance tool: a controlled list of all assets with ID, owner, category, GMP impact, criticality, status (validated, pending, decommissioned), latest report and date, next review or requalification and the latest impacting change control. In an audit it lets you move in seconds from the general principle to the specific evidence, and it is the first place where you can tell whether the VMP is alive or has been left in a drawer.
The Mistakes That Cost You Audit Findings
- A VMP out of date versus the real site: decommissioned equipment still listed, new systems missing. Consistency with the real asset list is the inspector's first check.
- Exclusions without rationale: an unjustified "out of scope" reads as an attempt to avoid validation.
- Contradictions with SOPs: if the VMP says one thing and the operating procedures another, the problem becomes systemic.
- Risk-based declared but not applied: writing "risk-based approach" without showing where risk assessments changed the scope or depth of activities.
- No documented regulatory update: with PI 006-4 in force from 1 October 2026, a VMP last revised in 2024 with no documented gap assessment is an easy finding.
GuideGxP Recommendation
Treat the VMP as a governance document, not a formality: set a periodic review (typically annual), link it to change control, deviations and CAPA, and keep the Validation Master List alive as a controlled annex. Before 1 October 2026, schedule a gap assessment of your VMP against PI 006-4 and record the outcome: that is the question you should expect at your next inspection.
If you want a ready-made path, the GuideGxP operational guide Validation Master Plan (VMP) in GMP: governing validation, defending it in audits and getting ready for PI 006-4 includes Word and Excel templates, a ready-to-use Validation Master List and audit-ready examples aligned with Annex 15 and PI 006-4.
