The VMP must present an overall picture of the company facility. It must give a clear and concise overview, to a reviewer, of how the company has integrated all applicable cGMP requirements into its operations. It must define validation activities and allot responsibilities for authoring, reviewing, approving, and executing validation documentation and tasks. The execution of the VMP protocol must verify that there is an abundance of documented evidence to verify that these activities are continuous and on going.

The VP must specify methodologies, assign staff, designate responsibilities and give specific guidance on any contentious or ambiguous aspects of the VP validation task. Where it makes commercial sense and is compliant with cGMP rules and regulations; each VP can be written to cover multiple items.

The URS is produced once the product is established. With the product concept documented – then the design / recipe can be further analysed. From these investigations the requirements for facilities, utilities, maintenance, calibration, operator skills, software, documented specifications and engineering drawings can all be extracted and provisioned for.

Risk Based Validation was introduced to apply a level of validation that was adequate to maintain confidence in the qualification process; but would reduce unnecessary repetitive testing. The Validation Risk Assessment (VRA) was therefore designed to ensure that this level of validation is consistently used.

With a company approved VP and URS produced; vendors can be invited to submit submissions. These submissions will be challenged by the execution of a DQ; which will or will not certify that the vendor’s submission; if proceeded with, will fully satisfy all the requirements listed in the URS. Likewise when an Off-The-Shelf (OTS) purchase is proposed, then a DQ must be used to verify that this prospective purchase will satisfy all the relevant requirements, as listed in the URS.

The Installation Qualification (IQ) section shall include test scripts that when executed shall verify that each testable requirement applicable to installation is fully complied with. The Operational Qualification (OQ) section shall include test scripts that when executed shall verify that each testable requirement applicable to Operation is fully complied with. The Performance Qualification (PQ) section shall include test scripts that when executed shall verify that each testable requirement applicable to performance is fully complied with.

The validation packages takes the strain out of validation. Just follow the guiding SOP's; that are integral to each protocol, through to completion, then sign off the protocols and start the protocol execution stage. Using the package guarantees that you will not run into discrepancies late in your execution program (this is the cause of the majority of validation delays).

Device specifications including; appropriate drawings, composition, formulation, component specifications and software specifications. Production process specifications including; appropriate equipment specifications, production methods, production procedures and production environment specifications. Quality assurance procedures and specifications including; acceptance criteria and the quality assurance equipment to be used. Packaging and labeling specifications. Installation, maintenance and servicing procedures and methods.

What should go into the DHF and what should? Well not every change is worthy of documenting in your DHF, however if the following question are applied then you will capture the required records:
1) Did the design plan change?
2) Did a design input change?
3) Did a design output change?
4) Was the risk analysis affected?
You cannot have a change that affects verification or validation activities that meet at least one of these four criteria. If any of these criteria are met, the change is significant enough that it requires documenting it in the DHF.

The manufacturer shall maintain device history records. The DHR shall include, or refer to the location of, the following information:
(a) The dates of manufacture;
(b) The quantity manufactured;
(c) The quantity released for distribution;
(d) The acceptance records which demonstrate the device is manufactured IAW the DMR;
(e) The primary identification label and labeling used for each production unit; and
(f) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s) and control number(s) used.