
Getting the validation scope wrong costs you in one of two ways. Over-scope, and you burn weeks writing OQ and PQ protocols for equipment that has no meaningful effect on product quality. Under-scope, and you walk into an audit with gaps that are genuinely difficult to defend. Both happen constantly. The pressure to move fast pushes engineers toward "just do an IQ," while consultants with nothing to lose push toward "document everything." Neither position is right. The scope of your qualification effort should be driven by what the equipment actually does to your product and process. and that determination should happen before you open a template.
This post gives you a structured way to make that call, grounded in the logic behind the regulations rather than cargo-culted checklists.
---
The fundamental question is not "what type of equipment is this?" The question is: what is the consequence if this equipment performs outside its intended specification?
If the answer is "nothing measurable happens to the product," IQ may be all you need. If the answer is "a critical quality attribute is affected," you need the full sequence. Everything else follows from that.
Regulatory frameworks agree on this direction even if they vary in language. FDA's process validation guidance (2011) ties qualification activity to the risk posed to product quality. EU GMP Annex 15 describes a qualification lifecycle that scales to complexity and risk. ICH Q9 gives you the formal vocabulary for risk-based decisions. None of these sources tell you that every piece of equipment needs IQ/OQ/PQ. They tell you to justify your scope.
---
Before you write a single protocol, you need to answer five questions about the equipment in question.
1. Does it directly contact the product?
Direct product contact is the highest-weight factor. Filling needles, mixing vessels, conveyor belts that carry open product, tablet press tooling, coating pan baffles. If the equipment touches the product or the product's immediate container, the qualification scope goes up automatically.
2. Does it affect a critical quality attribute (CQA)?
A CQA is any physical, chemical, biological, or microbiological property that should be within an appropriate limit to ensure product quality. If the equipment's output variability can shift a CQA, you need OQ and PQ. If it cannot, your argument for stopping at IQ gets much stronger.
3. What is the GAMP 5 category if software is present?
The ISPE GAMP 5 framework categorizes software by complexity and configurability: Category 1 (infrastructure software), Category 3 (non-configured products), Category 4 (configured products), Category 5 (custom software). The higher the category, the more validation rigor is expected for the software component. A piece of equipment with a Category 5 SCADA system managing critical process parameters needs functional testing in OQ regardless of what the hardware alone would require. A Category 1 embedded firmware PLC on a support utility is a different story.
4. Is it a utility or a production asset?
Utilities support production but do not act directly on the product. Compressed air, nitrogen, purified water generation equipment, HVAC systems, and process chillers are utilities. Their qualification scope is determined by whether they produce a critical material or control a critical environment. Purified water systems used in product formulation require rigorous OQ and PQ. A compressed air dryer feeding pneumatic actuators in a non-sterile secondary packaging area does not.
5. Is there regulatory or pharmacopeial specificity for this equipment type?
Some equipment types carry explicit regulatory expectations. Autoclaves used for sterilization have documented expectations in FDA guidance, PDA Technical Reports, and EU GMP Annex 1 (2022). Stability chambers have defined mapping requirements. If there is industry-standard guidance for your equipment type, it sets the floor for your scope.
---
IQ establishes that equipment is installed correctly according to manufacturer specifications, site engineering standards, and any applicable design specifications. It answers: is the right equipment here, installed the way it should be?
IQ alone is sufficient when the equipment's correct installation is all that matters and its operational behavior has no meaningful pathway to affect product quality or critical utility output.
Concrete examples where IQ alone is a defensible scope:
The common thread: correct installation is verifiable, and operational variability has no consequence for product quality or regulatory classification.
---
OQ establishes that equipment operates as intended across its defined operating range. It answers: does this equipment do what it is supposed to do under defined conditions?
You need OQ when equipment has functional parameters that matter. Parameters that need to be confirmed against specification before the equipment is used in production. But where that operational performance does not yet involve product or process output variability.
Examples:
---
PQ establishes that equipment consistently produces output meeting predetermined specifications under conditions representative of actual production. It answers: does this process deliver acceptable product, repeatedly, under routine operating conditions?
Full IQ/OQ/PQ is required when the equipment is part of a process that directly determines whether a critical quality attribute is met.
Examples:
---
Risk assessment is not a replacement for engineering judgment, but it is the tool that makes your scope defensible. ICH Q9 provides the framework. Your internal SOP provides the process.
A well-executed risk assessment for equipment qualification answers three questions:
The consequence score drives your scope. Low consequence, high controllability: IQ may be sufficient. High consequence, low existing control: full IQ/OQ/PQ is justified and required.
Document this. A one-page risk matrix tied to your VMP that explains why the nitrogen generator got IQ-only while the tablet press got full qualification is exactly what an auditor wants to see. It shows you made a deliberate decision. The absence of that documentation implies you did not.
For more on what auditors are actually looking for, see What Auditors Actually Look for in Validation Documentation.
---
Work through these questions in order before you assign a validation scope to any piece of equipment.
Question 1: Does this equipment directly contact the product or the product's immediate container?
If yes, the scope is at minimum IQ/OQ, and PQ is required unless you have an explicit documented justification for why product contact does not create CQA risk in this specific case.
Question 2: Does the equipment's operational performance directly determine whether a CQA is met?
If yes, you need PQ. The output of this equipment goes into a batch record and affects release decisions.
Question 3: Does the equipment have functional parameters that need independent confirmation beyond installation?
If yes, you need OQ at minimum. This covers environmental chambers, utilities with defined output specifications, sterilization equipment, and any system with a control loop managing a parameter that has acceptance criteria.
Question 4: If the answer to questions 1, 2, and 3 is no, can you clearly document why?
IQ-only scope requires a written rationale. "We decided it was low risk" is not a rationale. "This equipment is a non-contact utility serving a non-classified area, its operational variability has no pathway to product CQAs, and it is maintained under a calibrated PM program" is a rationale.
If you cannot write a clear answer to question 4, your scope is not IQ-only.
---
Scope decisions made after protocol drafting is underway create problems that compound. You end up with OQ protocols that nobody actually needs, or PQ sections stapled on at the last minute because an auditor asked about them during a pre-approval inspection.
The right sequence is: complete your equipment classification, run your risk assessment, document the scope decision in your VMP or in a qualification scope memo, get it reviewed, then write the protocol.
For a detailed walkthrough of what belongs in each phase, see IQ vs OQ vs PQ: What Actually Goes in Each One. If you are starting an OQ protocol from scratch, How to Write an OQ Protocol From Scratch covers the structure and content requirements directly.
If you are managing multiple qualification projects and want to bring consistency to how scope decisions are made and documented across your site, Valiqa generates qualification scope frameworks, protocol templates, and risk assessment documents tailored to your equipment type and regulatory context.
---
Valiqa is an AI-powered validation lifecycle platform for regulated manufacturing. Learn more at valiqa.io
Generate audit-ready IQ/OQ/PQ protocols in minutes, not weeks.
Get StartedThis site uses essential cookies for authentication and security. By continuing to use this site, you consent to our use of cookies.