Requalification and Periodic Review of Qualified Equipment

Initial qualification gets a piece of equipment into a validated state. Keeping it there is the harder job, and the one inspectors actually probe. A chromatograph that passed OQ four years ago, a depyrogenation tunnel mapped at installation, an autoclave qualified before three control-board swaps: none of these are still “qualified” by virtue of a signed report sitting in a binder. Qualified state is a present-tense claim, and you have to be able to defend it on the day of the inspection, not on the day the report was signed.

This article covers how that claim is maintained. It deals with requalification (the targeted re-execution of qualification testing when something changes or time passes), periodic review (the structured look-back that confirms a system is still fit for use), and the operational programs (calibration, preventive maintenance, change control) that feed both. The goal is that you can build the program, run it, defend it, and answer the questions an inspector asks about it.

For the upstream activity, read Equipment Qualification Lifecycle. This article picks up where that one ends.

What “maintaining the qualified state” actually means

A qualified state is the documented, evidenced condition in which a piece of equipment performs as intended, within defined limits, under its actual operating conditions. The initial IQ/OQ/PQ established it. Everything after that either confirms it still holds or detects that it has drifted.

Three forces erode qualified state over time:

1. Physical drift and wear. Sensors age, seals degrade, pumps lose calibration, heating elements weaken, gaskets compress. Nothing announces this. It shows up as a calibration that barely passes, a batch that runs slow, an environmental excursion.
2. Change. Component replacements, firmware updates, control-system upgrades, relocation, utility changes, software patches. Each can invalidate part of the original qualification.
3. Use that diverges from the qualified envelope. The equipment gets used for a new product, a new load pattern, a wider parameter range, or a different cleaning regime than what PQ covered.

Maintaining qualified state is the set of controls that catch all three before they reach product. The three pillars are:

• Routine monitoring and control programs (calibration, preventive maintenance, and in some cases automated condition monitoring) that keep the equipment within limits day to day.
• Change control, which evaluates every proposed change for qualification impact and triggers requalification when needed.
• Periodic review, which steps back at a defined cadence and asks: across everything that happened since the last review, is this system still qualified, and is the documentation that says so still complete and accurate?

Five related activities people confuse

These terms get used interchangeably and they are not the same thing. Keeping them distinct is the difference between a clean answer in an inspection and a muddled one.

The trap is treating periodic review and requalification as synonyms. Periodic review is the judgment; requalification is one of the actions that judgment can call for. A review can conclude that no requalification is needed, and that conclusion, when the data supports it, is just as valid as one that triggers a full re-mapping.

Regulatory basis

You do not need to memorize every clause, but you must be able to name the source of the requirement when asked. The expectation to maintain the qualified state is explicit in several places.

“Equipment used in the manufacture, processing, packing, or holding of a drug product shall be of appropriate design, adequate size, and suitably located to facilitate operations for its intended use and for its cleaning and maintenance.” US 21 CFR 211.63

“Automatic, mechanical, or electronic equipment … shall be routinely calibrated, inspected, or checked according to a written program designed to assure proper performance.” US 21 CFR 211.68(a)

EU GMP Annex 15 (Qualification and Validation), 2015 revision is the most direct source. It states that equipment, facilities, utilities, and systems should be evaluated at an appropriate frequency to confirm they remain in a state of control, and that the need for requalification should be assessed on a periodic basis. Annex 15 deliberately moves away from fixed calendar requalification toward a risk-based, review-driven model: you requalify when a review or a change tells you to, not merely because a clock ran out.

EU GMP Chapter 3 covers premises and equipment maintenance in operation. EU GMP Chapter 4 governs the documentation (qualification records, maintenance records, calibration records) that must exist and be retained.

ICH Q9(R1) Quality Risk Management (2023 revision) is the framework you use to decide how much requalification is enough and how often periodic review should occur. Risk drives frequency and depth.

ICH Q10 Pharmaceutical Quality System places equipment lifecycle and periodic review inside the management system, including the role of management review and continual improvement.

ASTM E2500-25 (Standard Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment) frames verification as risk- and science-based, with subject matter experts (SMEs) leading. Its philosophy carries straight into the maintenance phase: requalification scope follows criticality, not ritual.

For computerized systems, the periodic review obligation also lives in EU GMP Annex 11 (Computerised Systems), which requires that computerized systems be periodically evaluated to confirm they remain in a valid state and are compliant. Many pieces of GMP equipment (chromatography data systems, PLC- or SCADA-controlled units, building management systems) carry both an equipment periodic review and a computerized-system periodic review, sometimes combined into one assessment.

The risk/quality rationale behind all of this: equipment that has silently fallen out of its qualified envelope can produce out-of-specification product, false in-process readings, or undetected contamination. The cost of catching that through a structured review is trivial compared with the cost of a recall, a rejected batch, or a data-integrity finding traced to an uncalibrated instrument.

Requalification: what it is and when to do it

Requalification is the planned re-execution of qualification testing, in whole or in part, to confirm that equipment still meets its acceptance criteria. It is not a re-run of the entire original IQ/OQ/PQ by default. The right scope is the minimum testing that re-establishes confidence for whatever was challenged.

There are two distinct triggers, and conflating them is a common error.

Change-driven requalification

This is triggered by a specific change, through change control. The change control assessment determines qualification impact and defines the requalification scope. Examples and typical scope:

The decision sequence for a change:

1. Raise the change in change control. Read Change Control for Validated Systems.
2. The SME and QA assess qualification impact: which IQ/OQ/PQ elements does this change touch, and what is the risk if the change is wrong?
3. Define requalification scope and acceptance criteria in a protocol or change-control test plan.
4. Execute the requalification testing under the same documentation rigor as the original.
5. Review and approve results; close the change only after requalification passes.
6. Update the validation status / qualification register and the system’s documentation set.

The governing principle: scope the requalification to what the change could have affected, justified by risk, and document that justification. “We replaced a like-for-like sensor, calibrated it, and verified one set point” is a defensible decision when the reasoning is written down. “We replaced the controller and re-ran only the calibration” is not.

Periodic (time-driven) requalification

This is the requalification that an organization performs at a defined interval, or that a periodic review concludes is needed, independent of any single change. Annex 15 frames this as: assess the need for requalification periodically. Two models exist in practice, and you should know both.

• Fixed-interval requalification. The equipment is requalified on a calendar (for example, autoclaves and sterilizers are very commonly requalified annually, including a re-mapping). This is conservative and easy to defend, and remains standard practice for high-risk sterilization and aseptic equipment.
• Risk-based / review-driven requalification. Instead of a fixed clock, the periodic review evaluates whether anything (cumulative changes, calibration drift trends, maintenance history, deviations, use-pattern changes) indicates that requalification is warranted. If the review finds the system stable and unchanged, requalification may be deferred with justification.

Most mature programs run a hybrid: high-risk equipment (sterilizers, depyrogenation tunnels, lyophilizers, critical HVAC, sterile filtration skids) on a fixed interval, and lower-risk equipment on a review-driven basis with a maximum interval cap (for example, “review at least every 24 months, requalify if the review or any change indicates”).

A short numeric illustration of “review-driven”:

An automated tablet press has been in service 30 months. Periodic review at month 24 found: 0 unplanned maintenance events affecting critical functions, all calibrations passed first-time with no drift trend toward limits, 1 minor deviation unrelated to equipment performance, no product additions, no changes to the qualified parameter range. Conclusion: the system remains in a qualified state; full requalification not warranted; re-confirm OQ critical alarm checks only; next review in 24 months. That conclusion is defensible because the supporting data is cited, not asserted.

Shared and platform equipment across products and sites

Many organizations operate more than one unit of the same equipment model, sometimes at one site (three identical bioreactors in the same suite), sometimes across sites (the same tablet press model qualified independently at two manufacturing sites, or the same isolator design used for two different products). This raises a real question with no single universal answer: can requalification and periodic review evidence be pooled across identical units, or does each instance need its own independent evidence base?

What can reasonably be pooled. The design-level case for a piece of equipment, meaning the vendor’s design qualification, the URS-to-design traceability, and any generic OQ challenge that tests the equipment’s engineering design rather than its installed context, does not need to be re-proven from zero for every identical unit. A bracketing or platform approach, where one representative unit carries the full design-level testing and each additional identical unit carries only the installation- and use-specific testing, is defensible when the units are genuinely identical: same model, same revision, same software version, same critical-function design.

What cannot be pooled. Installation conditions, local utilities, the environment the unit sits in, the operators who run it, the actual product and load pattern it processes, and its own calibration and maintenance history are all site- and instance-specific by definition. IQ is always instance-specific. PQ challenges the equipment against real product and real operating conditions, which differ by definition between a unit in one site’s suite and a nominally identical unit in another site’s suite, before even accounting for different water quality, different HVAC performance, or a different product mix. Periodic review, likewise, has to be run per instance: a calibration drift trend, a deviation history, and a change history are all instance-specific facts that a sister unit’s clean review says nothing about.

The pooling decision has to be written down, with the rationale for what is shared and what is instance-specific, approved by the SME and QA before it is relied on, the same way a change-driven requalification scope decision is written down. A common finding is the opposite: a periodic review conclusion or a requalification result from one unit quietly extended to a nominally identical unit elsewhere with no data from that second unit at all. When one instance in a pooled family produces a finding (an OOT calibration, a deviation tied to a design weakness rather than local use), the same cumulative-impact thinking that applies to a single asset’s changes applies across the family: the finding has to be evaluated against every other instance sharing the same design element, not closed out as a one-off at the unit where it happened.

When a requalification test fails

Requalification testing is executed against pre-defined acceptance criteria, and sometimes a result falls outside them. This is a distinct failure mode from an out-of-tolerance calibration or a maintenance finding, and it needs its own decision path rather than being folded into either. A requalification failure means a test performed specifically to re-confirm the qualified state did not confirm it. The equipment’s status is genuinely in question from that moment, not merely under investigation, and the response has to reflect that immediately, not only once root cause is known.

A few points are worth making explicit. First, quarantine is not optional and does not wait for root cause; a piece of equipment that just failed a test designed specifically to confirm it works correctly does not get the benefit of the doubt while the investigation runs. Second, the backward product-impact assessment is not automatic in every case, since it depends on whether the failure is judged, with evidence, to reflect a real loss of qualified state rather than a test artifact, but that judgment itself has to be documented, not assumed in the equipment’s favor by default. Third, re-execution after corrective action is the actual re-confirmation; a QA risk acceptance of a failed requalification result without re-testing is a common and serious finding, because it substitutes a risk argument for the very evidence the requalification was designed to produce. Fourth, the event belongs in the equipment’s history that the next periodic review pulls together, so a requalification failure that is fixed and forgotten cannot be told apart, two years later, from one that never happened.

Periodic review: the central deliverable

Periodic review is the structured, documented evaluation performed at a defined frequency to confirm that a system remains in a qualified/validated state and that its supporting documentation is complete, current, and accurate. It is the keystone of maintaining qualified state and the single most-asked-about activity in this topic at inspection. For the broader system-level equivalent, see Validation Master Plan and Periodic Review.

Why it is required

Annex 15 (re)qualification expectations and Annex 11 clause on periodic evaluation both require it for their respective scopes. The quality rationale: changes, deviations, calibration results, and maintenance accumulate in separate systems over time. No single one of them, viewed alone, may signal a problem. Periodic review is the deliberate act of pulling them together for one asset and asking whether the sum tells a different story than the parts. It also catches documentation rot: superseded SOPs still referenced, drawings not updated after a change, training lapses, missing records.

Frequency and how to set it

Frequency is risk-based. A defensible scheme ties the interval to a documented criticality or risk classification of the equipment.

These are common industry intervals, not a regulatory mandate of specific numbers. What inspectors require is that you have a written, risk-justified frequency and that you meet it. Set the rule once in a policy or SOP; do not invent intervals per asset without a basis.

Defending the interval: the evidence behind the number

The risk class sets the starting interval. What an inspector actually probes, when they push past the table, is whether you can defend the specific number for a specific class against a harder question: why 24 months and not 12? A risk classification alone is necessary but not sufficient; a defensible program also points to an evidence base that has been checked against the chosen interval and continues to support it.

The evidence base that supports an interval decision:

• Calibration pass-rate and drift trending across the population of similar assets, not one unit. If every tablet press in the medium-risk class has passed its calibrations first-time, with no instrument trending toward its tolerance limit, across multiple review cycles, that is a real argument for holding or even lengthening the interval. If several assets in the class show first-time-pass rates dropping or drift creeping toward limits, that is a real argument for shortening it, regardless of what the table says.
• Deviation and unplanned-maintenance frequency across the population. A class with a low, stable rate of equipment-attributable deviations and corrective maintenance supports the interval; a rising rate is a leading indicator that the interval is too long, and it is cheaper to catch that in the trend than to prove it with a requalification failure.
• Severity, independent of observed frequency. A high-risk class stays on a short interval even when its own track record is clean, because the interval buys early detection against a consequence, such as a sterility failure or an under-dosed batch, that a medium-risk class does not carry. Frequency evidence lengthens or shortens an interval within a risk tier; it does not on its own move an asset out of a tier whose interval is set by consequence.
• Prior periodic review findings, meaning whether reviews in that class have historically found something worth acting on (a documentation gap, a drift, a missed PM) or have been genuinely uneventful. A class with a history of substantive findings at review has just demonstrated the review interval is doing useful work at its current length, which is a reason to hold it, not shorten it, provided the findings themselves are also being closed out effectively.

A worked illustration: a site classifies 14 formulation vessels as medium risk on a 24-month interval. Across the last three review cycles, the population shows a 98 percent calibration first-time-pass rate with no unit trending toward a limit, an average of 0.4 equipment-attributable deviations per vessel per two-year period, and no requalification failures. That evidence, presented as a population trend rather than a single unit’s clean record, is what an inspector’s “why 24 and not 12” question is actually asking for, and it is what a risk classification alone cannot answer. Where the same population shows pass rates falling below roughly 90 percent or a rising deviation rate, the defensible response is to shorten the interval for that class, or for the specific assets driving the trend, and to write down the decision and the data behind it the same way the interval was originally set.

The mechanism that makes this possible is trending the calibration and deviation data by equipment class, not only by individual asset, which is why the population-level rollups described under Calibration and Metrology Program matter here as much as they do for the calibration program itself.

What goes into a periodic review

A complete equipment periodic review report should contain:

1. System identification. Equipment ID, description, location, owner, criticality/risk class, current validation status.
2. Scope and period covered. The window since the last review (or since initial qualification for the first review).
3. Reference to current qualification status. Initial qualification reports, last requalification, current validated configuration baseline.
4. Change control review. Every change raised against the system in the period. For each: change number, description, qualification impact decision, requalification performed (if any), closure status. Open/unclosed changes are flagged.
5. Deviation and event review. All deviations, incidents, and unplanned events involving the equipment. CAPA status. Recurring or trending issues called out. See Deviation Management.
6. Calibration history review. Calibration results in the period: pass/fail, out-of-tolerance (OOT) events, any as-found out-of-tolerance results and their product impact assessments, and trend toward limits even where passing. See Calibration and Metrology Program.
7. Preventive maintenance review. PM compliance (were PMs done on schedule?), corrective maintenance frequency, any reliability concerns, spare-parts/obsolescence issues.
8. Document review. Are SOPs, drawings (P&IDs, electrical), specifications, and the qualification document set current and consistent with the as-built/as-operated system? Any superseded references?
9. Training review. Are operators and maintainers trained to current procedures?
10. Computerized-system elements (if applicable). Audit trail review status, user access review, security, backup/restore verification, software version vs. validated baseline, patches applied. See Audit Trail Design and Review and Backup, Restore, and Disaster Recovery Validation.
11. Assessment and conclusion. A reasoned statement: does the system remain in a qualified/validated state? Is requalification required, and if so, what scope? Are there actions?
12. Actions and ownership. Any CAPAs, document updates, requalification protocols to be raised, with owners and due dates.
13. Approvals. SME/owner and QA signatures and dates.

The computerized-system periodic review in detail

Item 10 above, computerized-system elements, is a single line item in the list, but it represents a distinct evaluation with its own regulatory basis (EU GMP Annex 11’s periodic evaluation clause) and its own evidence set. Many pieces of equipment now qualify as both equipment and a computerized system at once: a chromatography data system riding on an HPLC, a PLC- or HMI-controlled process skid, an autoclave with a validated recipe-management controller, a balance whose firmware calculates and stores results. Where that is true, the periodic review has a genuine second dimension that a documentation-completeness check does not satisfy.

What an Annex 11 periodic evaluation actually checks, beyond confirming the audit trail is switched on:

How this combines with, or stays separate from, the equipment-side review depends on how much the embedded software does and how it is changed. Two patterns cover most real programs:

• Fold it into the single equipment periodic review when the software’s GxP function is narrow, does not change outside the equipment’s own change control, and is administered by the same people who maintain the equipment. A balance’s firmware or a simple standalone data logger usually fits this pattern: one report, one conclusion, with the computerized-system elements as evidenced line items inside it, the way the general table above already treats them.
• Run it as a distinct, explicitly evidenced track, authored or co-authored by IT or the person who owns the software, when the system integrates broadly: a chromatography data system serving multiple instruments, a SCADA layer spanning several process units, or anything patched, backed up, and access-managed on an IT cadence that does not match the equipment’s PM cadence. In that case the equipment periodic review should still reference the computerized-system review’s conclusion and date rather than silently omitting it, and the two conclusions have to agree; an equipment review that says “remains qualified” next to a computerized-system review that found a non-conformance is not a defensible pair of documents.

The finding this distinction exists to prevent is the equipment review that lists “computerized-system elements: satisfactory” with no named evidence behind it, next to a control system that has never actually had its access list reconciled or its patch history reviewed. A single line item in a table is not itself an evaluation; it is a place to cite one. For a full periodic review procedure and evidence set built for standalone GxP computerized systems (an MES, a LIMS, a document management system) rather than equipment-embedded software, see the SOP: Periodic Review of GxP Computerized Systems; for the equipment-embedded case addressed here, see the Checklist: Computerized-System Elements of Equipment Periodic Review.

How to run a periodic review, step by step

1. Schedule triggers. A validation/qualification register or a CMMS/document system generates the review due date based on the asset’s risk class. Do not rely on memory; due dates must be tracked. A ready-to-use version of that register, tracking due dates by risk class across the whole equipment population and escalating overdue reviews, is the Log: Equipment Periodic Review Schedule and Escalation Register.
2. Assemble the data. The system owner / SME pulls change records, deviations, calibration history, PM history, and document status for the period. This is the bulk of the work and where it usually goes wrong (data scattered across systems).
3. Analyze, do not just list. For each data category, look for trends, not just individual pass/fail. A calibration that passes at 9.8% of a 10% limit every time is a signal even though it never failed.
4. Assess cumulative impact. Several individually low-impact changes can together move the system outside its qualified envelope. Evaluate the aggregate.
5. Reach a conclusion and define actions. State plainly whether the system is still qualified. If yes, say so with evidence. If actions are needed, raise them in CAPA/change control with owners and dates.
6. Approve and file. SME and QA approve. The report becomes part of the asset’s lifecycle record.
7. Set the next review date and update the register.

Acceptance criteria: what good looks like

• The review was completed on or before its due date (no overdue reviews, or overdue reviews themselves managed as deviations).
• Every data category in scope is addressed with evidence cited, not asserted.
• Open changes and open CAPAs are explicitly flagged, not buried.
• Trends (calibration drift, rising corrective-maintenance rate) are identified and addressed, not just listed.
• The conclusion is justified by the data above it. An inspector can trace the “remains qualified” statement back to specific evidence.
• Documentation discrepancies found are routed to correction with owners and dates.
• The report is approved by both the technical SME/owner and QA.

Worked example: an autoclave periodic review (condensed)

Below is a condensed, realistic example of the body of a periodic review for a high-risk asset on a 12-month cycle. Numbers are illustrative.

System: Steam Sterilizer STZ-04. Risk class: High. Status: Qualified. Period: 2025-06-01 to 2026-05-31.

Conclusion: STZ-04 remains in a qualified state for the period reviewed. Two actions raised (calibration interval reduction; P&ID/BOM update). Annual requalification (load re-mapping) proceeds on schedule. Next periodic review: 2027-05-31.

Why this is a good review: it cites evidence, it catches a drift trend before it becomes a failure, it catches a documentation gap, and it ties cleanly into the separate annual requalification rather than duplicating it. The “remains qualified” sentence is earned.

Worked example: catching cumulative change

The failure mode periodic review exists to catch is the one no single change control would ever flag. Here is what it looks like when the review does its job. A lyophilizer accumulated four changes over 18 months, each assessed at the time as low impact:

Each was reasonable in isolation. The periodic review looks at the sum. The reviewer plots the condenser pull-down time and the shelf temperature uniformity across the period and finds that pull-down time has crept up since change 2, and that the added load schedule (change 4) now runs the condenser closer to its capacity. Individually nothing breached; together the margin to the qualified condenser performance has thinned. The review raises an action: a targeted requalification of condenser performance under the combined worst-case load, not a full re-mapping. That action exists only because someone evaluated the aggregate. This is the single most valuable thing a periodic review does, and the one most often skipped.

Critical utility systems: WFI, clean steam, and HVAC/cleanroom

Critical utility systems, water for injection (WFI) and purified water distribution loops, clean and pure steam generation and distribution, and HVAC serving classified cleanrooms, get one line in most equipment programs and then get treated exactly like a piece of discrete equipment for requalification purposes. That undersells how differently they behave. A sterilizer has a start and an end to each cycle and a defined load. A WFI loop runs continuously, feeds dozens of use points, and never really settles into an “off” state to qualify against. Requalification for a utility is less a single re-executed protocol and more a rolling verification against an established periodic sampling, monitoring, and testing program, with occasional targeted re-testing layered on top when something changes.

Water systems (WFI and purified water)

USP General Chapter <1231> frames the ongoing expectation directly: the qualification history, maintenance and calibration records, and the accumulated quality and process data for a water system should be assessed periodically to judge whether the system remains in a state of control, and that assessment can lead to adjustments in operating or sanitization practice, in the calibration or maintenance plan, or to additional testing or a targeted re-qualification of specific tasks. In practice this means:

• Trend the routine monitoring data (conductivity, TOC, microbial counts, and endotoxin where WFI is involved) at the periodic review, not only at the moment of an individual excursion. A slow upward creep in a distribution loop’s microbial counts that never individually breaches an alert limit is exactly the kind of signal a routine excursion review will not surface but a periodic trend review will.
• Any distribution-loop change (a new use point, an extended run of piping, a changed sanitization method or frequency, a dead leg introduced by a tie-in) triggers a system-wide reassessment, not a local one. A loop is one connected system; a change at one point can shift flow, residence time, or sanitization coverage everywhere downstream of it, so the requalification question is whether the whole loop still performs as validated, not whether the new branch passes on its own.
• The three-phase qualification structure that established the system (see Pharmaceutical Water System Validation) is the reference baseline the periodic review checks against, not something re-run wholesale on a calendar. A full or partial repeat of the later monitoring phases is the typical scope when periodic review or a significant change calls for targeted re-qualification, rather than re-executing the entire original three-phase program.

Clean steam

EU GMP Annex 1 (2022 revision) sets an explicit expectation that clean and pure steam quality is assessed periodically against validated parameters, typically non-condensable gases, dryness value, and superheat, drawn on a representative sampling schedule, with steam condensate assessed against the current compendial water-for-injection monograph. The periodic review for a clean steam system pulls together that recurring quality data the same way an equipment review pulls together calibration data, and asks the same question: does the trend still support the validated state, or has something drifted. A generator or distribution change (a new take-off point, a traced-line modification, a boiler or generator component replacement) goes through the same system-wide reassessment logic as a water-loop change, because clean steam, like WFI, is a distribution system rather than a single asset.

HVAC and cleanrooms

Cleanroom classification and monitoring sit under the ISO 14644 series, which frames periodic reclassification testing as a baseline expectation whose exact interval is set by the site’s risk assessment and by how consistently the ongoing monitoring data stays inside its limits, rather than by one fixed number applied everywhere. A program typically periodically re-executes particle count classification testing, HEPA filter integrity testing, airflow visualization (smoke studies) where room changes could affect pattern or cascade, and room recovery testing. See Cleanroom Classification and Qualification for how these tests work at initial qualification; periodic review reruns the same tests at the interval the risk assessment and monitoring trend support, and ties any adverse environmental-monitoring trend back into the decision on whether that interval still holds.

What makes utility periodic review different from discrete equipment

The common finding here is treating a utility exactly like a discrete asset: copying a fixed annual interval from a sterilizer SOP onto a water loop without engaging the trend-based logic above, or approving a distribution change on the strength of a local test with no system-wide reassessment. For the underlying qualification approach these systems build on, see Clean Utilities Qualification, Pharmaceutical Water System Validation, and Cleanroom Classification and Qualification; the ISPE Baseline Guide, Volume 4 (Water and Steam Systems) is a widely used industry engineering reference for the design and lifecycle management of these systems.

The linkage to calibration and preventive maintenance

Periodic review and requalification do not generate confidence on their own. They depend on the routine programs running underneath. This linkage is examined heavily at inspection because a broken link here invalidates the qualified-state claim.

Calibration

Calibration keeps the measuring instruments that the qualification depends on trustworthy. If a sterilizer’s chamber thermocouple is out of calibration, every cycle it controlled is suspect. The connection points to manage:

• Every critical instrument identified in qualification must be in the calibration program. A common gap: an instrument used to demonstrate OQ acceptance is never enrolled for routine calibration. The qualification then quietly expires the moment the instrument drifts.
• As-found out-of-tolerance (OOT) results trigger a backward product-impact assessment. If an instrument is found out of tolerance at calibration, the expectation most programs apply is a backward evaluation of every batch processed since its last good calibration, so that any product impact is identified rather than assumed away. Skipping that backward look, or evaluating only the batch that happened to surface the problem, is a frequent and serious finding when it happens.
• Calibration intervals are themselves risk-based and reviewed. Periodic review is where you adjust an interval based on observed drift, as in the worked example.

Worked example: an out-of-tolerance backward impact assessment. A pH meter (PHM-220) is used as an in-process control to verify buffer pH before use in a chromatography step feeding a licensed process. Its calibration interval is 90 days. At the routine 90-day calibration, the as-found reading at the mid-point check is 0.15 pH units high against the reference buffer, outside the plus-or-minus 0.10 tolerance. The instrument is confirmed genuinely out of tolerance after re-measurement against a fresh reference buffer, which rules out a bad standard as the cause.

Step 1, define the window. The last known-good calibration was 90 days before the OOT was found. Every buffer preparation verified on PHM-220 in that 90-day window is pulled from the equipment use log, not only the batch that was in progress when the OOT was found.

Step 2, quantify and apply the error. The instrument reads high, so every recorded value in the window was actually 0.15 pH units lower than what was logged. The corrected value, not the recorded value, is what gets compared to the acceptance range.

Step 3, screen every affected record against the corrected value.

Step 4, decide affected versus unaffected. Four of six batches remain within range after correction and are documented as unaffected, with the arithmetic shown, not merely asserted. Two batches (B-2602 and B-2604) would have failed the in-process acceptance range had the true value been used at the time; these go to a formal impact assessment against the downstream process step the buffer fed, following the deviation process, and the batch disposition decision sits with QA, not with whoever ran the calibration.

Step 5, close the loop. Root cause, in this illustration a worn reference electrode, is corrected and the instrument is re-verified before return to service. Because two of six checks in the window were affected, a rate high enough to indicate more than an isolated artifact, the calibration interval for this instrument is reassessed rather than left at 90 days, and the finding is fed to the next periodic review for PHM-220 so the trend, not just the single event, is on record.

This is what turns “a backward product-impact assessment was performed” from an assertion into something an inspector can retrace: a defined window, a corrected value applied consistently, every record in the window screened rather than only the one that surfaced the problem, and a disposition that follows from the arithmetic rather than from a preference for a clean outcome. A ready-to-use version of this assessment, with the full investigation, root cause, and disposition structure, is the Form: Instrument Out-of-Tolerance Investigation and Impact Assessment.

See Calibration and Metrology Program and Analytical Instrument Qualification for the instrument side.

Preventive maintenance

PM keeps the equipment physically within the condition that qualification assumed. The linkage:

• PM activities should be derived from the equipment’s critical functions, not just the vendor manual. The functions that qualification proved must be the functions PM protects.
• PM compliance is a periodic-review input. Chronic late or skipped PMs are a direct argument that the qualified state is not being maintained.
• Corrective maintenance on a critical component can be a requalification trigger. Replacing a worn heating element is maintenance; but if it changes the thermal profile, it can require re-mapping. The change-control/maintenance boundary must be defined in procedure so the decision is consistent.
• The maintenance-vs-change boundary must be written down. Like-for-like replacement under maintenance vs. a modification under change control is a judgment that needs a documented rule, or different people will make it differently.

The decision rule, as a flow, keeps that judgment consistent across whoever makes it:

The last step matters as much as the first: a string of individually defensible like-for-like swaps is exactly what periodic review has to be able to reconstruct and judge in aggregate. A ready-to-use version of this decision rule, expanded across the equipment-change scenarios it has to cover in practice, is the Matrix: Maintenance versus Change Control Boundary Decision.

For the broader programs, see Equipment Qualification Lifecycle and Change Control for Validated Systems.

Roles and responsibilities

The non-negotiable: QA approval on the requalification decision and on the periodic review conclusion. The SME may drive the technical content, but the qualified-state claim is a quality decision.

Common mistakes and inspection-finding patterns

These are the patterns that recur in inspection observations and warning letters on this topic. They are generic, drawn from public regulatory expectations.

1. Overdue periodic reviews. The review was due, the due date passed, nothing happened. This is one of the most common findings. Fix: track due dates in a register, treat overdue reviews as deviations, and report them in quality metrics.
2. Periodic review as a box-ticking exercise. The report lists changes and deviations but performs no analysis, identifies no trends, and reaches a “remains qualified” conclusion that the body does not support. Inspectors read for the reasoning, not the checklist.
3. No documented requalification frequency or basis. Equipment is requalified “when we get to it,” with no SOP defining the interval or the risk basis. Or fixed intervals exist with no justification for why they are what they are.
4. Change made without requalification impact assessment. A controller swap, a software upgrade, or a relocation went through with no evaluation of qualification impact, so requalification that should have happened never did.
5. Calibration program gaps. An instrument relied on for qualification is not in the calibration program; or as-found OOT results were closed without a backward product-impact assessment.
6. Like-for-like used as a loophole. Material changes are repeatedly classified as like-for-like maintenance to avoid requalification. When the “like-for-like” parts are not genuinely equivalent, the qualified state is broken without anyone evaluating it.
7. Documentation not updated after change. Drawings, specs, and SOPs still describe the old configuration. The qualified state and the documented state diverge, which is itself a data-integrity and control concern.
8. Computerized-system periodic review missing for GMP equipment. The equipment review happens but the Annex 11 periodic evaluation (audit trail, access, backup, version) is skipped, even though the unit is software-controlled.
9. Cumulative change blindness. Each change was assessed in isolation and found low-impact; nobody ever evaluated whether the accumulation moved the system out of its qualified envelope. Periodic review exists precisely to catch this and frequently does not.
10. Requalification scope not justified. Either everything is re-run wastefully, or too little is re-run with no rationale. Inspectors want to see a risk-justified scope, written down.
11. Utility periodic review treated identically to discrete equipment. A fixed interval copied from a sterilizer program onto a water loop or HVAC zone with no trend-based reasoning behind it, or a distribution change approved on a local test with no system-wide reassessment of the loop or zone it sits in.
12. Pooled or sister-unit qualification data extended with no data from the actual instance. A periodic review conclusion or a passing requalification result from one unit of an identical fleet applied to another site’s or another suite’s unit with no independent evidence for that unit.
13. A failed requalification result accepted on a risk argument instead of being re-tested. QA accepts a failed test result through a written justification rather than correcting the root cause and re-executing the test, which substitutes an argument for the evidence the requalification exists to produce.

Interview-ready: questions and strong answers

Q: What is the difference between requalification and periodic review? Periodic review is the structured look-back at defined intervals that decides whether a system is still in a qualified state and whether requalification is needed. Requalification is the act of re-executing qualification testing (in whole or part) to re-establish that state. Periodic review can conclude that requalification is or is not required. They are related but not the same activity.

Q: What triggers requalification? Two categories. Change-driven: a specific change (component, software, relocation, new product, utility) assessed through change control to have qualification impact. Time/review-driven: a fixed interval for high-risk equipment, or a periodic review concluding that cumulative changes, drift, or use changes warrant it. Annex 15 expects the need for requalification to be assessed periodically on a risk basis.

Q: Do you have to fully re-run IQ/OQ/PQ every time? No, and doing so blindly is a red flag for not understanding risk. You scope requalification to what was challenged. A like-for-like sensor swap may need only calibration verification. A controller replacement needs OQ of affected functions. A relocation may need full IQ plus OQ plus PQ. The scope is risk-justified and documented.

Q: How do you set the periodic review frequency? Risk-based, defined in a policy or SOP. Tie the interval to the equipment’s documented criticality class: high-risk on roughly annual review, medium roughly biennial, low up to about every three years, with the rationale written once and applied consistently. There is no regulatory mandate of a specific number; there is a mandate to have a justified frequency and meet it.

Q: Which regulations require this? EU GMP Annex 15 (2015) is the most direct for requalification and periodic assessment. US 21 CFR 211.63 and 211.68 require suitable, properly maintained, calibrated equipment. ICH Q9(R1) provides the risk framework, ICH Q10 places it in the quality system. For software-controlled equipment, EU GMP Annex 11 requires periodic evaluation of the computerized system. ASTM E2500-25 frames the risk- and SME-led verification philosophy.

Q: An instrument is found out of tolerance at calibration. What do you do? Document the as-found OOT result, and perform a backward product-impact assessment covering every batch or use since the last in-tolerance calibration. Quarantine or evaluate affected product as needed. Investigate root cause, often through a deviation, and consider whether the calibration interval should be shortened. Failing to do the backward impact assessment is a serious and common finding.

Q: How do calibration and PM relate to maintaining the qualified state? They are the routine programs that keep the equipment within the envelope qualification proved. Calibration keeps the measuring instruments trustworthy; PM keeps the equipment physically in condition. Their results feed periodic review. A gap in either (an uncalibrated critical instrument, chronic skipped PMs) directly undermines the qualified-state claim.

Q: How do you handle a software upgrade on a GMP instrument’s control software? Through change control with a risk-based impact assessment. Identify affected functions, perform regression testing scaled to risk, re-verify calculations, audit trail, security, and data integrity, confirm the validated version baseline, and update documentation. The periodic review later confirms the version in use matches the validated baseline.

Q: What is the single most common finding on this topic? Overdue or shallow periodic reviews, closely followed by changes made without a requalification impact assessment and calibration OOT events closed without backward product-impact assessments.

Q: What does an Annex 11 periodic evaluation check that the equipment-side periodic review does not? It checks the computerized-system controls specifically: audit trail review status, user access and privilege review, backup and restore verification with a restore actually tested, patch and version control against the validated baseline, and security configuration. For simple embedded software it is usually folded into the single equipment review as evidenced line items; for broadly integrated software, such as a chromatography data system or a SCADA layer, it is often run as its own explicitly evidenced track that the equipment review then references.

Q: A requalification test fails. What is the immediate response, before root cause is known? The equipment goes on quarantine or hold immediately; it does not continue in GxP use while the investigation runs. A deviation is raised, and QA and the SME assess whether the failure reflects a real loss of qualified state before deciding whether a backward product-impact assessment is needed. Root cause and corrective action follow, and the requalification test is re-executed and passed before the equipment returns to service; accepting the original failing result on a risk justification without re-testing is not an acceptable substitute.

Q: How do you decide whether to pool qualification data across identical units of the same equipment model? Pool only the design-level evidence: vendor design qualification, URS-to-design traceability, and generic OQ challenges that do not depend on installation. IQ, PQ, calibration and maintenance history, and the periodic review conclusion itself are instance-specific and cannot be pooled. The pooling rationale has to be written down and approved before it is relied on, and a finding on one instance has to be evaluated against every other instance sharing that design element.

Practical tips

• Run periodic review off a register, not memory. A validation/qualification register or CMMS that auto-generates due dates by risk class is the difference between a clean program and a stack of overdue findings.
• Make trend analysis mandatory in the template. Force the author to look at calibration drift and corrective-maintenance rate over time, not just pass/fail this period. The drift you catch at 80% of limit is cheaper than the failure at 101%.
• Write the maintenance-vs-change boundary down. A one-page decision rule for like-for-like vs. modification prevents the most common qualified-state breaches and the most common arguments.
• Combine equipment and computerized-system periodic review where it makes sense, but make sure every required element of both is present. Combining to save effort while dropping the Annex 11 elements is a finding waiting to happen.
• Keep high-risk sterilization equipment on fixed-interval requalification even in an otherwise review-driven program. It is conservative, easy to defend, and aligned with common expectation.
• Tie requalification scope decisions to the original qualification’s traceability. If you know which OQ test challenged which function, scoping a change-driven requalification becomes mechanical. See User Requirements and Traceability.
• Treat overdue reviews as deviations. It forces visibility, root cause, and CAPA, and it shows an inspector your system self-detects rather than hides lapses.

Related articles

• Equipment Qualification Lifecycle
• Equipment Qualification Audit Checklist
• Calibration and Metrology Program
• Change Control for Validated Systems
• Validation Master Plan and Periodic Review
• Temperature Mapping Qualification
• Sterilization Validation (Moist Heat)
• Commissioning and Qualification (ASTM E2500)
• Quality Risk Management
• Part 11 and Annex 11 Assessment Guide
• Clean Utilities Qualification
• Pharmaceutical Water System Validation
• Cleanroom Classification and Qualification