Utility Qualification
& Verification Record FAQ

Initial qualification — DQ, IQ, OQ, and PQ — establishes that a utility like HVAC or a water system performs as intended at a specific point in time, while the ongoing utility verification record is the continuing evidence, built from routine monitoring, periodic review, and requalification activities, that the utility has actually remained in that qualified state throughout its operational life.

A utility that passed PQ five years ago tells an inspector almost nothing about its current state without a continuous verification record connecting that original qualification to today — the ongoing record is what actually demonstrates the utility can still be trusted right now.

Not every utility needs full qualification — non-critical, non-product-contact services such as general office HVAC can often be excluded from the formal qualification program, provided a documented risk assessment justifies why the utility has no direct or indirect impact on product quality, patient safety, or data integrity.

CPV principles apply to utilities in the same spirit as they apply to manufacturing processes — ongoing trending of routine monitoring data, such as water system conductivity, TOC, or bioburden results, or HVAC pressure differentials, is used to confirm the utility remains in a state of control between formal requalification events, rather than waiting for the next scheduled requalification to discover a gradual drift.

Most utilities are managed through a periodic review that evaluates trending monitoring data and change history to decide whether full requalification is actually needed, rather than a rigid fixed-interval requalification regardless of performance — but the periodic review itself should occur on a defined schedule, and its outcome, not just its existence, is what determines whether requalification is triggered.

A utility verification record is the broader body of evidence — routine monitoring data, calibration records, requalification protocols, change history — demonstrating the utility's ongoing qualified state, while the periodic review record is a specific, scheduled document that evaluates that evidence at a point in time and concludes whether the utility remains fit for use or needs further action.

A utility exceedance should trigger an immediate assessment of the products, batches, or processes that relied on the utility during the period it may have been out of specification, documented as a deviation, with corrective action taken on the utility itself before it's returned to GxP use.

The scope of the product impact assessment depends heavily on how the utility connects to the affected process — a brief HVAC pressure excursion in a low-risk area carries very different implications than a water system microbial exceedance feeding directly into a sterile manufacturing process.

Not always — routine, like-for-like replacement of a component such as a filter, performed per an established preventive maintenance procedure, typically doesn't require full requalification, but a change to the component's specification, a modification to the distribution system, or a repair following a failure should go through change control, which then determines whether requalification is warranted based on the change's assessed risk.

Unscheduled requalification is typically triggered by a significant change to the system, a pattern of exceedances or drifting trend data, a major repair or component failure, relocation or modification of distribution infrastructure, or a periodic review conclusion that current qualification evidence no longer adequately represents the system's actual state.

Adding a new point-of-use generally requires qualification of that specific new point plus an assessment of whether the addition affects the broader system — such as introducing a new dead-leg or changing flow dynamics elsewhere in the loop — rather than automatically requiring full requalification of the entire distribution system, provided that impact assessment is documented and supports the narrower scope.

The investigation should extend back to the utility's last known in-specification monitoring result, assessing every GxP activity that relied on the utility during that window, with the depth of investigation scaled to the severity of the exceedance and the criticality of what the utility supports.

A shared utility should have its own single, dedicated verification record covering the utility itself, with each dependent system or process separately documenting its reliance on that utility and referencing the utility's qualification status — duplicating the utility's own qualification evidence separately within every dependent system's documentation creates redundant, inconsistent records that are harder to keep synchronized.

For utilities significantly affected by ambient conditions, such as HVAC systems exposed to summer and winter extremes, verification should include testing across seasonal variation, commonly captured during the PQ phase of initial qualification and revisited periodically — a utility verified only under one set of ambient conditions doesn't demonstrate performance under the opposite seasonal extreme it will also experience.

A utility should be classified as GxP-critical if it has direct or indirect contact with product, directly supports a GxP-critical process parameter, or its failure could compromise product quality, patient safety, or data integrity — this classification should come from a documented risk assessment rather than an assumption based on the utility's general category, since two similar utilities can have very different criticality depending on what they actually support.

An intermittently used, GxP-critical utility like a backup generator still needs formal qualification and ongoing verification, but the verification approach is typically adapted to its use pattern — for example, periodic functional testing and load testing on a defined schedule rather than continuous trend monitoring — since continuous monitoring isn't meaningful for a system that isn't continuously running.

A utility shared across multiple sites or buildings needs a qualification and verification strategy that accounts for how each connected site or building draws on it, including site-specific point-of-use verification where local conditions differ, with a central master record for the shared utility itself and clear cross-references from each site's own documentation to that central record.

Equipment qualification protocols and process validation documentation should explicitly reference the specific utility system and its current qualification or verification status as a prerequisite, so a reviewer can trace forward from a piece of equipment or a process to confirm the utility supporting it was actually in a verified state at the relevant time.

An inspection-ready utility verification record should let a reviewer confirm the utility's current qualification status, its routine monitoring trend data, any exceedances and how they were resolved, its change and requalification history, and the date and outcome of its most recent periodic review.

• Utility identification, classification (GxP-critical or supporting), and system boundaries.
• Current qualification status and reference to the qualifying protocols.
• Routine monitoring trend data and defined alert or action limits.
• Exceedance history with investigation outcomes and corrective actions.
• Change control and requalification history.
• Most recent periodic review date, outcome, and next review due date.

Utility verification records should be retained for at least as long as the products or processes that relied on the utility during the period the records cover, since they're the evidence supporting the claim that the utility was in a controlled, qualified state whenever it was used to support GxP manufacturing or testing.

Inspectors frequently focus on water systems and HVAC specifically, checking that routine monitoring trend data is actually reviewed and acted on rather than just collected, that exceedances were investigated with a documented product impact assessment, and that requalification kept pace with changes made to the utility over time.

A common finding is monitoring data that shows a gradual drift toward a limit with no evidence anyone reviewed the trend before it became an actual exceedance — this suggests the data was being recorded but not meaningfully reviewed as part of an active verification program.

The most common mistake is treating initial qualification as the finish line and letting the ongoing verification program become a passive data-collection exercise — trend data gets recorded but not actively reviewed, exceedances get investigated in isolation without checking for a developing pattern, and by the time a real failure occurs, the monitoring history often shows warning signs that were technically documented but never acted on.