The 3 Q’s in Computer System Validation – IQ OQ PQ

Adopting a Computer Systems Validation approach for the various systems companies use is easier said than done when it comes to FDA-regulated organizations. Managing the computer system validation process is often comprehensive, with many steps from beginning to completion. Even one failure in the process can lead to devastating consequences for patients and the organization, which can face warning letters as well as other penalties from regulatory bodies. This is why reliable validation is crucial in the pharmaceutical, clinical, and medical device industries.

Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ), popularly known as IQ-OQ-PQ, represent a way to ensure a reliable outcome of the validation process. In the validation process, IQ-OQ-PQ is often referred to as the Qualification Process. Please keep reading to know why they are essential and what they mean. Start a 30-day free trial of the pre-validated eLeaP LMS to ensure your records and data comply with 21 CFR Part 11.

Objectives of performing 3 Q’s

Performing the IQ-OQ-PQ is an integral part of testing activities. Testing is often performed at several levels depending on the risk, complexity, and novelty. One level is appropriate for simple and low-risk systems, while multiple levels may be required for complex configured or custom systems. Testing must be carried out in accordance with the test strategy documented in the validation plan.

• Identifying defects so they can be corrected or removed before operational use
• Preventing failures that might affect patient safety, product quality, or data integrity
• Providing documented evidence that the system performs as specified
• Demonstrating the system meets its requirements
• Providing confidence that the system is fit for its intended use
• Providing a basis for user acceptance
• Meeting a critical regulatory requirement

What are IQ, OQ, and PQ?

IQ, OQ, and PQ are sequential activities that are carried out to validate the system. IQ stands for Installation Qualification, OQ for Operational Qualification, and PQ for Performance Qualification.

#Installation Qualification Tests (IQ) Tests

The Installation Qualification tests provide confirmation that the software or system is installed and set up according to pre-approved Design Specifications. Usually, the software is first installed in a test or validation environment to verify the correct installation and configuration of software and hardware.

The purpose of IQ is to verify and document that the system components are combined and installed in accordance with the specifications, supplier documentation, and local and global regulations. Installation testing provides a verified configuration baseline for subsequent verification and validation activities and verifies any installation methods, tools, or scripts used. This forms the basis for the configuration management of the installed system.

Installation testing should verify that the following documents are available where appropriate:

• User and technical guides
• Standard operating procedures
• Training schedules
• Service level agreements
• Security procedures
• Hardware inventory
• Specification sheets
• Program source code
• Back up and restore
• Data archival and retrieval
• Ability to deal with a high-volume load

#Operational Qualification (OQ) Tests

Operational Qualification testing is also referred to as Functional Testing. OQ tests confirm that all functionality defined in the Functional Specification is working correctly and that there are no bugs. The functionality tested should support the specific business process, and based on the risk and supplier assessment, the level of testing is defined.  Generally, black box testing is performed for functional specification testing. As suggested by the FDA, specific types of testing should be performed depending on – risk, complexity, novelty, and supplier assessment of the system as below:

• Normal case testing (Positive or Capability testing)
• Invalid case testing (Negative or Resistance testing)
• Repeatability testing
• Performance testing
• Volume/load testing
• Regression testing
• Structural/path testing

#Performance Qualification (PQ) Tests

Performance Qualification testing is called User Acceptance testing. It confirms that the software will meet the user’s needs and is fit for their intended use, as defined in the User Requirements Specification. The acceptance testing may be carried out in two stages:

Factory Acceptance Testing is performed at the supplier site before delivery to show that the system is working well enough to be installed and tested on-site.

Site Acceptance Testing, also called System Acceptance testing, shows that the system is working in its operational environment and interfaces correctly with the other systems.

Purpose of 3 Q’s

Process validation aims to establish documented evidence that the system meets a set of defined requirements. The defined discipline for a validation process has proven to be the ideal way to guarantee the best quality of the validated system. Each phase of the validation process includes documentation with detailed results of each qualification test. To understand the concept of the qualification process, we should know more details about the testing strategy as defined by the FDA. The classic “V Diagram” was popularized by industry organizations such as ISPE via GAMP Guides. This “V Diagram” explains what requirement is tested against what kind of requirements.

Take the course “The GAMP Approach to 21 CFR Part 11 Compliance” to stay current and relevant.

How to perform IQ-OQ-PQ?

According to the FDA guidelines, the test strategy should be set with an appropriate approach for testing each requirement through IQ-OQ-PQ.  The FDA has defined a typical structure for testing documentation.

The verification of IQ-OQ-PQ is carried out via the Qualification Protocol followed by a Summary report.

#Installation Qualification Protocol

The Installation Qualification Protocol verifies the proper installation and configuration of a System. Depending on the system’s needs and complexity, Installation Qualification can be combined with Operational Qualification or Performance Qualification. Installation Qualification protocols should be approved before protocol execution. A copy of the unexecuted protocol should be kept in the validation package. The System Owner and Quality Assurance should approve the unexecuted protocol. The executed protocol should be signed by the tester and reviewed by the system owner and Quality. Installation Qualification must be performed before completing the Operational Qualification or Performance Qualification.

#Operational Qualification Protocol

The Operational Qualification Protocol is a collection of test cases used to verify the system’s functionality. The operational qualification test requirements are defined in the Functional Requirements Specification. Operational Qualification is usually performed before the system is released for use. Depending on the system’s needs and complexity, Operation Qualification can be combined with Installation Qualification or Performance Qualification. Operational Qualifications should be approved before protocol execution. A copy of the unexecuted protocol should be kept in the validation package. The System Owner and Quality Assurance should approve the unexecuted protocol. The executed protocol should be signed by the tester and reviewed by the system owner and Quality.

#Performance Qualification

Performance Qualifications are a collection of test cases that verify that a system performs as expected under simulated real-world conditions. The performance qualification test requirements are defined in the User Requirements Specification (or possibly the Functional Requirements Specification). Sometimes the performance qualification is performed by End Users as the system is being released. Depending on the system’s needs and complexity, Performance Qualification can be combined with Installation Qualification or Operational Qualification. Performance Qualifications should be approved before protocol execution. A copy of the unexecuted protocol should be kept in the validation package. The System Owner and Quality Assurance should approve the unexecuted protocol. The executed protocol should be signed by the tester and reviewed by the system owner and Quality.

In a nutshell, the below diagram explains the IQ-OQ-PQ activities:

Best Practices to be followed while performing IQ-OQ-PQ executions: 

• Tests should be executed according to pre-defined and pre-approved specifications
• Each test should be run according to the test script, and all test results should be recorded
• Tests should be performed by the trained tester
• Test results must be documented as and when testing occurs and must be retained
• All test results should be immediately and accurately recorded
• In case of any corrections, it should be crossed out with a single line, signed and dated with a brief justification
• The script should clearly state if the test is passed or failed
• In case of a failed test, a defect must be raised and retested through the final closure
• A summary report should be produced for each qualification test performed and state all the findings and conclusion
• The executed protocol and the reports must be signed and approved by the Quality representative

Significance of IO-OQ-PQ

IQ-OQ-PQ requires strict adherence to the process along with proper documentation. While the basics of IQ-OQ-PQ are critically important to understand and implement, it is also critical to acknowledge the challenges encountered while performing.  As industries are required to follow FDA guidance, product quality and performance, delivery precision, and patient safety are of the utmost importance. Quality assurance professionals must ensure that validation activities are planned, executed, and documented according to standards. Even if the product/software has passed all the verification stages and fails to prove one of IQ-OQ-PQ, the result can be disastrous and incur a considerable cost.  Hence, the successful completion of IQ-OQ-PQ alone is the successful delivery of the system from development to the end users.