When it comes to the FDA regulated organizations, adopting a Computer Systems Validation approach for the various systems they use is easier said than done. Managing the computer system validation process is often a comprehensive process with many steps from beginning to completion. Even one failure in the process can lead to devastating consequences for patients, as well as the organization which can face warning letters from the regulatory bodies. This is why reliable validation is so crucial when it comes to the pharmaceutical, clinical, and medical device industry. Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) popularly known as IQ-OQ-PQ represents a way to ensure a reliable outcome of the validation process. In validation aspects, IQ-OQ-PQ is often referred to as the Qualification Process. To know why they are important and what they actually mean, keep reading.

Objectives of performing 3 Q’s

Performing the IQ-OQ-PQ is an integral part of testing activities. Testing is often performed at several levels depending on the risk, complexity, and novelty. One level is appropriate for simple and low risk systems, while multiple levels may be required for complex configured or custom systems. Testing must be carried out in accordance with the test strategy documented in the validation plan.

  • Identifying defects so they can be corrected or removed before operational use
  • Preventing failures that might affect patient safety, product quality or data integrity
  • Providing documented evidence that the system performs as specified
  • Demonstrating the system meets its requirements
  • Providing confidence that the system is fit for its intended use
  • Providing basis of for user acceptance
  • Meeting a key regulatory requirement

What are IQ, OQ, and PQ?

IQ, OQ, and PQ are sequential activities that are carried out to validate the system. IQ stands for Installation Qualification, OQ for Operational Qualification, and PQ for Performance Qualification.

#Installation Qualification Tests (IQ) Tests

The Installation Qualification tests provide confirmation that the software or system is installed and set up according to pre-approved Design Specification. Usually, the software is first installed in a test or validation environment to verify the correct installation and configuration of software and hardware.

The purpose of IQ is to verify and document that the system components are combined and installed in accordance with the specifications, supplier documentation, and local and global regulations. Installation testing provides a verified configuration baseline for subsequent verification and validation activities, and also verifies any installation methods, tools or scripts used. This forms the basis for the configuration management of the installed system.

Installation testing should verify that the following documents are available where appropriate:

  • User and technical guides
  • Standard operating procedures
  • Training schedules
  • Service level agreements
  • Security procedures
  • Hardware inventory
  • Specification sheets
  • Program source code
  • Back-up and restore
  • Data archival and retrieval
  • Ability to deal with high volume load

#Operational Qualification (OQ) Tests

Operational Qualification testing is also referred as Functional Testing. OQ tests confirm that all functionality defined in the Functional Specification is working correctly, and that there are no bugs. The functionality tested should support the specific business process and based on the risk and supplier assessment the level of testing is defined.  Generally, black box testing is performed for functional specification testing. As suggested by the FDA, specific types of testing should be performed depending on – risk, complexity, novelty, and supplier assessment of the system as below:

  • Normal case testing (Positive or Capability testing)
  • Invalid case testing (Negative or Resistance testing)
  • Repeatability testing
  • Performance testing
  • Volume/load testing
  • Regression testing
  • Structural/path testing

#Performance Qualification (PQ) Tests

Performance Qualification testing is called User Acceptance testing. It confirms that the software will meet the user’s needs and is fit for their intended use, as defined in the User Requirements Specification. The acceptance testing may be carried out in two stages:

Factory Acceptance Testing is performed at the supplier site before delivery to show that the system is working well enough to be installed and tested on-site.

Site Acceptance Testing also called as System Acceptance testing shows that the system is working in its operational environment and that it interfaces correctly with the other systems.

Purpose of 3 Q’s

The purpose of process validation is to establish documented evidence that the system meets a set of defined requirements. The defined discipline for a validation process has proven to be the ideal way to guarantee the best quality of the validated system. Each phase of the validation process includes documentation with detailed results of each qualification test. To understand the concept of the qualification process, we should know more details about the testing strategy as defined by the FDA. The classic “V Diagram” was popularized by industry organizations such as ISPE via GAMP Guides. This “V Diagram” explains what requirement is tested against what kind of requirements.

Take the course, “The GAMP Approach to 21 CFR Part 11 Compliance” to stay up to date and relevant.

Purpose of 3 Q’s

How to perform IQ-OQ-PQ?

As per the FDA guidance, the test strategy should be defined with an appropriate approach for testing of each requirement through IQ-OQ-PQ.  The FDA has defined a typical structure for testing documentation.

How to perform IQ-OQ-PQ

The verification of IQ-OQ-PQ is carried out via Qualification Protocol followed by Summary report.

#Installation Qualification Protocol

The Installation Qualification Protocol verifies the proper installation and configuration of a System. Depending on the needs and the complexity of the system, Installation Qualification can be combined with Operational Qualification or Performance Qualification. Installation Qualification protocols should be approved before protocol execution. A copy of the unexecuted protocol should be kept in the validation package. The unexecuted protocol should be approved by the System Owner and Quality Assurance. The executed protocol should be signed by the tester and reviewed by the system owner and Quality. Installation Qualification must be performed before completing the Operational Qualification or Performance Qualification.

#Operational Qualification Protocol

The Operational Qualification Protocol is a collection of test cases used to verify the functionality of the system. The operational qualification test requirements are defined in the Functional Requirements Specification. Operational Qualification is usually performed before the system is released for use. Depending on the needs and the complexity of the system, Operation Qualification can be combined with Installation Qualification or Performance Qualification. Operational Qualifications should be approved before protocol execution. A copy of the unexecuted protocol should be kept in the validation package. The unexecuted protocol should be approved by the System Owner and Quality Assurance. The executed protocol should be signed by the tester and reviewed by the system owner and Quality.

#Performance Qualification

Performance Qualifications are a collection of test cases used to verify that a system performs as expected under simulated real-world conditions. The performance qualification tests requirements defined in the User Requirements Specification (or possibly the Functional Requirements Specification). Sometimes the performance qualification is performed by End Users as the system is being released. Depending on the needs and the complexity of the system, Performance Qualification can be combined with Installation Qualification or Operational Qualification. Performance Qualifications should be approved before protocol execution. A copy of the unexecuted protocol should be kept in the validation package. The unexecuted protocol should be approved by the System Owner and Quality Assurance. The executed protocol should be signed by the tester and reviewed by the system owner and Quality.

In a nutshell, the below diagram explains the IQ-OQ-PQ activities:

IQ-OQ-PQ activities

Best Practices to be followed while performing IQ-OQ-PQ executions: 

  • Tests should be executed according to pre-defined and pre-approved specifications
  • Each test should be run according to the test script and all test results should be recorded
  • Test should be performed by the trained tester
  • Test result must be documented as and when testing occurs and must be retained
  • All test result should be immediately and accurately recorded
  • In case of any corrections, it should be crossed out with single line, signed and dated with a brief justification
  • The script should clearly state if the test is passed or failed
  • In case of a failed test, a defect must be raised and retested through final closure
  • Summary report should be produced for each qualification test performed and state all the findings and final conclusion
  • The executed protocol and the reports must be signed and approved by the Quality representative

Significance of IO-OQ-PQ

IQ-OQ-PQ requires strict adherence to the process along with proper documentation. While the basics of IQ-OQ-PQ are critically important to understand and implement, it is also critical to acknowledge the challenges encountered while performing.  As the industries are required to follow FDA guidance, product quality and performance, delivery precision, and patient safety are of the utmost importance. Quality assurance professionals must ensure if validation activities are planned, executed, and documented according to standards. Even if the product/software has passed all the verification stages and fails to prove any one of IQ-OQ-PQ, the result can be disastrous and will incur a huge cost.  Hence successful completion of IQ-OQ-PQ alone is the successful delivery of the system from development to the End-Users.