Skip to main content

IQ OQ PQ Validation 2026: Complete Guide for Pharma & Life Sciences

Equipment Validation • By Gobinath • • 6 min read
IQ OQ PQ Validation 2026: Complete Guide for Pharma & Life Sciences

IQ (Installation Qualification) proves the system is installed correctly. OQ (Operational Qualification) proves it works as designed across all functions. PQ (Performance Qualification) proves it performs reliably when real users run real processes. In 2025, retroactive documentation, missing RTM traceability, and absent Part 11 test cases in OQ were the three most cited qualification gaps in FDA 483 observations.

8–18w
Typical manual validation timeline (GAMP Cat 4)
3–6w
GoVal validation timeline for the same system
6
Recurring audit gaps that cause the most 483 citations

The Three Phases at a Glance

IQInstallation Qualification
Core question

Is it installed exactly per specification — right version, right config, right hardware, all security controls active?

Key checks

Software version · config baseline · calibration status · audit trail activation · user role setup

Run by: IT / Vendor
OQOperational Qualification
Core question

Does it work as designed across all functions — including boundary conditions, negative tests, and Part 11 controls?

Key checks

Functional tests · boundary tests · negative tests · audit trail completeness · e-signature integrity

Run by: Validation / QA
PQPerformance Qualification
Core question

Does it perform reliably when real users run real business processes under actual production conditions?

Key checks

Real-world scenarios · representative data volumes · pre-defined measurable acceptance criteria · formal deviation logging

Run by: End Users / QA

Documents Required at Each Phase

All documents must be version-controlled and signed per 21 CFR Part 11. Protocols approved before execution begins — never after.

DocumentIQOQPQ
Validation Plan✓✓✓
Qualification Protocol Pre-approved✓✓✓
Test Execution Records (signed, with evidence)✓✓✓
Deviation Log (every failure formally documented)✓✓✓
Qualification Report✓✓✓
Requirements Traceability Matrix (RTM) Most cited gap—✓✓
Validation Summary Report——✓

The Six Audit Findings That Keep Appearing

Not rare edge cases — these appear in FDA 483 observations regularly and are all avoidable.

FindingWhat goes wrong
Missing RTM HighTest cases cannot be linked to specific URS requirements. RTM assembled after testing rather than maintained throughout execution.
Undocumented deviations HighTest failed, someone fixed it informally and re-ran. No deviation record, no root cause, no formal investigation.
Retroactive documentation CriticalProtocols written or signed after testing occurred. Timestamps don't match reported test dates. Calls the entire qualification into question.
Vague acceptance criteria High"System should work correctly" is not an acceptance criterion. Every test case needs a specific, measurable expected result defined before execution.
No re-qualification after changes HighA vendor pushed an update or config was changed without formal impact assessment. Original qualification is now void.
No Part 11 OQ test cases HighNo specific OQ tests confirming 21 CFR Part 11 audit trail completeness or e-signature integrity. Cited in the vast majority of Part 11-related OQ findings.

How GoVal Eliminates These Gaps Structurally

Common gapHow GoVal prevents it
Missing RTMEvery test case linked to source requirement at creation — live RTM from day one, never assembled retroactively
Retroactive documentationSystem-generated tamper-evident timestamps — cannot be backdated by any user including admins
Undocumented deviationsDeviation logging built into test execution — cannot complete a test without formally recording the result
Vague acceptance criteriaProtocol templates require specific expected results per test case before protocol can be approved
Post-change compliance gapsChange control integrated with validation record — triggers impact assessment automatically on every change
Missing Part 11 OQ testsPre-built templates include 21 CFR Part 11 audit trail and e-signature test cases as standard in every OQ

Frequently Asked Questions

What is the difference between IQ, OQ, and PQ? ＋
IQ confirms the system is installed correctly per specification. OQ confirms it works as designed across all functions including boundary conditions, negative tests, and 21 CFR Part 11 controls. PQ confirms reliable performance when real users run real business processes under actual production conditions.
Is IQ OQ PQ required for all pharma computer systems? ＋
Not universally. Under FDA CSA guidance (September 2025), lower-risk systems can use vendor-supplied testing. GAMP Category 4 needs full IQ/OQ/PQ on your configuration; Category 3 needs functional testing only; Category 1 needs configuration documentation only.
What documents are required for IQ, OQ, and PQ? ＋
Every phase: pre-approved Qualification Protocol, signed Test Execution Records, Deviation Log, Qualification Report. OQ and PQ add an RTM. PQ adds a Validation Summary Report. All must be version-controlled and Part 11-compliant.
How long does IQ OQ PQ validation take? ＋
Manual validation: 8–18 weeks for a complex GAMP Category 4 system. GoVal: 3–6 weeks. The biggest manual time losses are protocol authoring (2–4 weeks), review/approval cycles (1–3 weeks), and retroactive RTM assembly — all eliminated in GoVal.
When is re-qualification required after a change? ＋
After any significant change — software upgrade, configuration change, hardware migration, or changed intended use. Change control must include a formal impact assessment determining whether full, partial, or no re-qualification is needed before the change is implemented.
What are the most common IQ OQ PQ audit findings? ＋
Six consistent findings: missing RTM traceability; undocumented deviations; retroactive documentation (most serious — calls the entire qualification into question); vague acceptance criteria; no re-qualification after changes; and no Part 11-specific OQ test cases for audit trail and e-signature verification.
Does FDA CSA eliminate the need for IQ and OQ? ＋
No. CSA changes the evidence source — you can use vendor documentation for lower-risk functions instead of re-executing from scratch. A PQ confirming fitness for your intended use still applies. The IQ/OQ evidence requirement is unchanged; only the approach to generating that evidence changes.
What is a Requirements Traceability Matrix and why is it required? ＋
An RTM links every URS requirement to one or more test cases in OQ/PQ, proving every requirement has been tested. Without one, an auditor cannot verify testing completeness — one of the most commonly cited qualification gaps. Must be built before execution begins, not assembled retroactively.

Complete Your Next Validation in Weeks, Not Months

GoVal gives your team pre-built IQ, OQ, and PQ templates with Part 11 test cases built in, digital execution with tamper-evident timestamps, automatic live RTM generation, and one-click audit-ready reports.

See a Live Validation Demo