Pharma
- What applies
- EU GMP Guide Annex 15 governs qualification and validation, for sterile medicinal products Annex 1 in addition.
How do manufacturers plan and execute verification and validation in compliance with standards, without the evidence falling apart in an audit?
We support Verification and Validation from design verification to process validation with IQ, OQ and PQ, planned to ISO 13485:2016 and the GMP requirements. Where a test case does not point clearly to a design input or process specification, the review examines the traceability gap instead of the product.
Overview
What requirements do V&V place on manufacturers in MedTech and pharma?
Design V&V and process validation across pharma, biotech, MedTech & IVD · ISO 13485:2016, GMP (IQ/OQ/PQ), 21 CFR Part 820
Last updated: September 18, 2026
Verification and validation are not a final test campaign, but a continuous body of evidence: verification demonstrates that the product or process meets the defined requirements; validation demonstrates that the intended use is achieved under real-world conditions.
- The V&V plan does not cover all regulatory requirements because it is created too late. Under ISO 13485:2016, and additionally under EU 2017/745 (MDR) for medical devices, the planning must define the scope, the acceptance criteria and the responsibilities before testing begins.
- Test protocols are not traceable to design inputs or product specifications. Without an end-to-end traceability matrix, it cannot be shown that every requirement has been verified and the intended use validated.
- Process validations with Installation, Operational and Performance Qualification (IQ, OQ, PQ) are incomplete or do not conform to Annex 15 of the EU GMP Guide, which governs the qualification and validation of processes.
- Revalidations following process changes, supplier changes or site relocation are forgotten or carried out indiscriminately, instead of being planned in a targeted manner based on an impact assessment.
Industries
What this means in your industry
Biotech
- What applies
- EU GMP Guide Annex 15 and, for sterile manufacturing, Annex 1 apply as in pharma.
MedTech
- What applies
- ISO 13485:2016 carries verification and validation under the MDR (EU) 2017/745, ISO 14971 the risk; FDA: 21 CFR Part 820.
IVD
- What applies
- Under the IVDR (EU) 2017/746, ISO 13485:2016 and ISO 14971 apply likewise.
Services
How we support you
V&V strategy & master plan
V&V master plan for product development or production with a defined scope, responsibilities, acceptance criteria and schedule. Deliverable: an approved master plan that maps the V&V activities to the regulatory requirements under ISO 13485:2016.
Revalidation strategy upon changes
Impact assessment for process changes, supplier changes or site relocation. Deliverable: a documented assessment with a targeted revalidation scope that covers the changed area, without indiscriminately revalidating intact processes.
How we work together
What it comes down to
Verification and validation turn on the acceptance criteria, and those are too often written after the test. The V&V plan must be in place before the first protocol is executed, because it derives the acceptance criteria from the design inputs and process requirements.
Only then can a traceability matrix be built that traces every test case unambiguously back to a requirement.
A team that tests first ends up with a matrix that is backfilled after the fact. The review by the notified body under EU 2017/745 (MDR) or the inspection against GMP requirements takes hold at the unsupported or duplicate links.
The next gap opens up between verification and validation: for processes whose output cannot be fully verified by end-of-line testing, such as sterilization, filling and welding, Annex 15 of the EU GMP Guide requires process validation with IQ, OQ, PQ.
With every subsequent change, an impact assessment determines the revalidation scope, so that the changed area is covered without indiscriminately revalidating intact processes.
Our approach
Our approach
Step
Result
01
V&V planning
Approved V&V master plan with scope, acceptance criteria and responsibilities, derived from design inputs and process requirements.
02
Build traceability
Traceability matrix that links every requirement to a specific test case before protocols are executed.
03
Execute verification & validation
Executed design V&V and process validation protocols (IQ, OQ, PQ) with documented results against the acceptance criteria.
04
Review & approval
Reviewed and approved V&V reports, deviations assessed and closed out.
05
Change control & revalidation
Impact assessment per change, targeted revalidation scope defined and executed.
Common pitfalls
Where projects commonly fail
The V&V plan is not created until development is nearly complete.
By then, design inputs and acceptance criteria can no longer be derived cleanly, and the test campaign measures against assumptions rather than against defined requirements. This is the most common reason why V&V evidence fails to hold up in an audit.
Traceability between test cases and design inputs is missing or constructed after the fact.
The notified body under EU 2017/745 (MDR) requires an unbroken link between every requirement and its evidence; a matrix backfilled in hindsight is exposed by unsupported or duplicate links.
Process validation is reduced to end-of-line testing.
For processes such as sterilization, filling or welding, whose output cannot be fully verified, Annex 15 of the EU GMP Guide requires validation with IQ, OQ, PQ. A passed final test does not replace it.
Verification and validation are treated as equivalent.
If you only verify that specifications are met, you are missing the validation step that ISO 13485:2016 requires.
Revalidations are forgotten or rolled out indiscriminately across the entire production.
Without an impact assessment, either a relevant change goes unrevalidated, or unnecessary effort is incurred for processes that are not affected by the change at all.
Product Development & Regulatory Strategy
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
Verification checks whether a product or process meets the defined requirements, such as design inputs and specifications. Validation checks whether the product fulfills its intended use under real-world conditions. ISO 13485:2016 requires both steps; validation goes beyond mere requirement fulfillment.
Process validation is the documented evidence that a manufacturing process consistently produces a product that meets its predefined specifications. Per Annex 15 of the EU GMP Guide, it is required for all critical processes whose output cannot be fully verified by end-of-line testing, such as sterilization, welding or filling.
Installation Qualification (IQ) confirms the correct installation of the equipment, Operational Qualification (OQ) confirms function per specification, and Performance Qualification (PQ) confirms consistent performance under production conditions. Annex 15 of the EU GMP Guide describes these qualification steps for GMP-critical processes and equipment.
Upon significant changes to the process, material, equipment, environment or site, for example new manufacturing parameters, equipment replacement, a change of supplier for critical components or relocation of production. An impact assessment determines the scope of revalidation; the approach is part of change control per Annex 15 of the EU GMP Guide.
Yes. For IVDs, EU 2017/746 (IVDR) applies; the verification and validation of device performance are part of the conformity evidence and are managed through the QM system per ISO 13485:2016. The performance characteristics are additionally substantiated through performance studies.
For the US market, 21 CFR Part 820 applies, in effect since February 2, 2026 as the Quality Management System Regulation (QMSR), which requires design validation and process validation. The QMSR incorporates ISO 13485:2016 by reference, so that the requirements largely align. A shared V&V plan can cover both frameworks if the acceptance criteria and traceability are designed for both from the outset.
Sources
- ISO 13485:2016: Quality management systems for medical devices
- EU GMP Guide Annex 15: Qualification and Validation
- Regulation (EU) 2017/745 (MDR) and (EU) 2017/746 (IVDR): primary text
- 21 CFR Part 820: FDA Quality Management System Regulation (QMSR)
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Projects from this industry
What we have worked on in this industry
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (QM system for medical devices)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- 21 CFR Part 820 (FDA Quality Management System Regulation, QMSR)
- EU GMP Guide Annex 15 (Qualification and Validation)
- EU GMP Guide Annex 1 (Manufacture of Sterile Medicinal Products)
- ISO 14971 (Risk management for medical devices)
Related topics
Design Controls →
Design V&V as part of the design controls chain in product development
Process Validation →
IQ, OQ, PQ and revalidation of manufacturing processes in detail
Computer System Validation (CSV) →
CSV as a specific V&V domain for computerised systems
Annex 1 (Sterile Manufacturing) →
Validation of sterile processes per Annex 1 of the EU GMP Guide
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences