This is a ready-to-use risk assessment for deciding, before SAT starts, how much of the FAT scope needs to be re-executed on site and how much can be reduced to the mandatory core. It turns “the FAT went well, let’s trim SAT” from an informal schedule call into a documented, QA-approved decision with a defined floor that never moves. Replace every <<FILL: ...>> placeholder with your own specifics and route it through your QRM and change-control procedures. A worked specimen follows. Verify each cited regulation against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Assessment title | FAT-to-SAT Scope Reduction Justification, <<FILL: EQUIPMENT / SYSTEM>> |
| Document number | <<FILL: RA-ID, e.g. QRM-CQ-018>> |
| Version | <<FILL: version>> |
| Effective date | <<FILL: date>> |
| Facilitator / author | <<FILL: C&Q engineer / Validation>> |
| Cross-functional team | <<FILL: engineering, validation, QA, metrology>> |
| Linked FAT report | <<FILL: FAT report number>> |
| Linked SAT protocol | <<FILL: SAT protocol number this decision scopes>> |
1. Objective and scope
Decide, for <<FILL: EQUIPMENT / SYSTEM>>, which SAT test cases from the approved FAT/SAT protocol are re-executed in full, which are reduced to a transport-sensitive spot check, and which mandatory core items are unaffected by this decision because no FAT outcome can substitute for them. This assessment does not authorize skipping SAT; it scopes SAT’s functional re-testing depth. It does not alter the punch list, deviation, or reuse-into-IQ/OQ rules of <<FILL: cross-reference FAT/SAT protocol SOP-ID>>, which still apply in full to whatever scope is executed.
2. Methodology
The decision follows a gated logic. Two independent factors are scored, system criticality/novelty and FAT outcome, and a defined mandatory core is carved out first because it is never eligible for reduction regardless of either score.
- Gate 0, mandatory core. Transit-damage inspection, utility connection and quality checks, integration/network/time-sync tests, and every transport-sensitive re-test identified in the FAT/SAT protocol are always executed at SAT in full. This assessment never touches Gate 0.
- Gate 1, system criticality and novelty. Direct product contact, sterility criticality, and first-of-kind design or vendor each push toward full SAT scope regardless of FAT outcome.
- Gate 2, FAT outcome strength. A clean, QA-witnessed FAT with no deferred critical or major items is a precondition for any reduction; a rough FAT is not offset by low system criticality.
- Gate 3, platform track record. A repeat of an already-qualified design and vendor, with a documented history of clean outcomes at this site, is what allows the reduction to extend beyond the mandatory core.
3. Scoring scales
| Score | Criticality / novelty (Gate 1) | FAT outcome (Gate 2) | Platform track record (Gate 3) |
|---|---|---|---|
| 1 (low risk, supports reduction) | Indirect/no product contact, non-sterile function, established design and vendor | Zero critical or major punch items; QA witnessed every GxP-critical test | Two or more prior clean FAT/SAT cycles with this design and vendor at this site |
| 2 (moderate) | Indirect product contact with a quality-relevant function, or a minor design variant | Minor items only, all closed before ship, or one major item closed with clean retest | One prior clean cycle, or a closely related platform |
| 3 (high risk, forces full scope) | Direct product contact, sterility-critical, or first-of-kind design/vendor | Any open critical item at ship, or a major item shipped on a disposition rather than closed | No track record: first installation of this design or with this vendor at this site |
4. Mandatory full-scope trigger check (Gate 0 and Gate 1 ceiling)
| Question | Answer | Consequence |
|---|---|---|
| Is the system direct product-contact or sterility-critical? | <<FILL: yes/no>> | If yes, full functional and safety re-test at SAT regardless of FAT outcome or track record. Stop scoring; proceed to Gate 0 mandatory core only. |
| Is this a first-of-kind design or a first installation from this vendor at this site? | <<FILL: yes/no>> | If yes, full SAT scope for this instance. This assessment may be revisited for later repeat installations once a track record exists. |
If either answer is yes, the reduction decision ends here: run the full SAT scope, and still perform every Gate 0 mandatory-core item regardless.
5. Factor assessment table
Complete when the Gate 4 trigger check above did not already force full scope.
| Gate | Input data | Score (1-3) | Evidence reference | Notes |
|---|---|---|---|---|
| 1. Criticality / novelty | <<FILL: product-contact status, sterility relevance, design/vendor history>> | <<FILL>> | <<FILL: component criticality assessment ref>> | |
| 2. FAT outcome | <<FILL: punch list summary, count and class of open items at ship>> | <<FILL>> | <<FILL: FAT report / punch list ref>> | |
| 3. Platform track record | <<FILL: number of prior clean cycles, dates, systems>> | <<FILL>> | <<FILL: prior FAT/SAT report refs>> |
6. Decision logic
- Gate 1 or the Gate 0/1 trigger check scores 3, or forces full scope: run the full SAT scope. No reduction regardless of Gates 2 to 3.
- All gates score 1: reduce to Gate 0 mandatory core plus re-verification of the specific transport-sensitive items named in the FAT/SAT protocol. All other functional sequences and I/O checks witnessed cleanly at FAT are not re-executed at SAT.
- A mix of 1s and 2s, no 3: reduce partially, naming explicitly, item by item, which additional functional test cases beyond the mandatory core are still re-executed at SAT to cover the moderate-risk factor, and which are waived.
- Any 3 outside Gate 1 (for example a major FAT item shipped on disposition rather than closed): do not reduce until the underlying item is closed and this assessment is re-run.
Decision: <<FILL: full SAT scope / reduced to mandatory core / partial reduction, see item list>>
If reduced, list every FAT test case waived at SAT, with the gate basis:
| FAT test case (from the FAT/SAT protocol) | Waived at SAT? | Basis |
|---|---|---|
<<FILL: TC number and description>> | <<FILL: yes/no>> | <<FILL: gate scores supporting the waiver>> |
<<FILL>> | <<FILL>> | <<FILL>> |
7. Mitigations and residual risk
| Pathway | Control applied | Residual risk | Acceptable? |
|---|---|---|---|
| Transit damage undetected on a waived functional test | Gate 0 mandatory transit-damage inspection and visual check still performed in full | <<FILL>> | <<FILL: yes/no>> |
| Undetected calibration shift on a waived measurement | Transport-sensitive instruments still re-verified per the FAT/SAT protocol regardless of this reduction | <<FILL>> | <<FILL>> |
| Software/firmware drift between FAT and SAT | Version reconciliation performed in full at SAT regardless of scope reduction; any mismatch reopens this assessment | <<FILL>> | <<FILL>> |
| Reduction perceived, on audit, as an uncontrolled shortcut | This assessment, signed and dated before SAT, on file with the SAT report | <<FILL>> | <<FILL>> |
Residual risk is acceptable when the mandatory core plus the named transport-sensitive re-tests remain untouched by any reduction, and every waived test case has a stated, evidence-backed basis in this record rather than an unstated assumption.
8. Acceptance criteria for the assessment
- The Gate 0/1 trigger check was performed and documented before any scoring occurred.
- Gate 0 mandatory-core items are listed and confirmed unaffected by the decision, in every case.
- Each waived FAT test case is named individually with its gate basis; no blanket statement such as “reduce SAT by half” without an item list.
- The FAT outcome cited in Gate 2 matches the actual punch list and FAT report, not a summary impression.
- QA approved the assessment before SAT execution began, not after the fact.
- Change control is set to re-trigger this assessment if the FAT outcome, the system’s criticality classification, or the vendor/design changes for a future repeat.
9. References
EU GMP Annex 15 (Qualification and Validation), 2015 revision, sections 3.4 to 3.7 (FAT/SAT and reuse of qualification work). ASTM E2500, Standard Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment. ICH Q9(R1), Quality Risk Management, for the risk-based scoping approach. ISPE Baseline Guide Volume 5, Commissioning and Qualification (second edition, 2019).
Confirm the current version and clause numbers of each reference before issue.
10. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| C&Q / Validation facilitator | <<FILL>> | ||
| Engineering | <<FILL>> | ||
| Metrology (where instrument-dependent waivers apply) | <<FILL>> | ||
| QA | <<FILL>> |
Filled specimen
The following shows the assessment completed for an illustrative blister-packaging and cartoning line, the third installation of an already-qualified platform design from the same vendor at the same site. Numbers are illustrative.
| Gate | Input | Score | Decision effect |
|---|---|---|---|
| 0/1 trigger check | Not direct product contact (secondary packaging only), not sterility-critical, not first-of-kind (third identical line from this vendor) | pass, no forced full scope | Proceed to scoring |
| 1. Criticality / novelty | Indirect product contact, established platform, component criticality assessment rates the line moderate overall, low on product-contact elements | 1 | Supports reduction |
| 2. FAT outcome | One critical item (interlock timing) and one major item (HMI field truncation), both retested and closed before ship, zero open at ship | 1 | Supports reduction |
| 3. Platform track record | Two prior installations of this design and vendor at this site, both with clean SAT outcomes | 1 | Supports reduction |
Decision: reduced to mandatory core. SAT executes transit-damage inspection, utility connection and quality checks, network/MES integration, time synchronization, and re-verification of the two FAT-closed items (interlock timing and HMI field display), since both are the transport- and configuration-sensitive items named in the FAT report. All other functional sequences and I/O checks witnessed cleanly at FAT (feed indexing, changeover recipe load, non-safety alarms) are waived at SAT.
Waived items extract:
| FAT test case | Waived at SAT? | Basis |
|---|---|---|
| TC-09, full normal operating cycle | Yes | Gates all score 1; cycle has no transport dependence; re-verified functionally only through the mandatory transit-damage and utility checks |
| TC-12, changeover/recipe selection | Yes | Software configuration reconciled under the mandatory version-control check; no plausible transport dependence |
| TC-13, interlock re-test (retuned at FAT) | No, retained | Directly transport- and rework-sensitive; named explicitly in the FAT report as a re-verification item |
This is the proportionate answer the article describes: the mandatory core and the specific FAT-closed, transport-sensitive items are never waived, and every waiver beyond that is named individually with its basis rather than assumed by a general sense that “the FAT went fine.”
Common inspection findings this assessment prevents
- SAT scope quietly cut under schedule pressure with no documented risk rationale, indistinguishable on record from a corner cut.
- A reduction applied uniformly to every system regardless of criticality, so a sterility-critical or first-of-kind asset gets the same shortened SAT as a routine platform repeat.
- A major FAT item shipped on disposition rather than closed, and SAT still reduced as if the FAT had been clean.
- Waived test cases described only in general terms (“reduced scope”) with no item-by-item list an inspector can check against the FAT/SAT protocol.
- Software or firmware version reconciliation skipped along with the reduced functional testing, when it is part of the mandatory core regardless of scope decision.
How to adapt this assessment
- Run the Gate 0/1 trigger check first; if it forces full scope, the rest of the scoring is unnecessary.
- Pull the FAT outcome score from the actual punch list and FAT report, not a verbal summary from whoever ran the trip.
- Name every waived test case individually in the decision table; do not close this assessment with a percentage or a general statement of reduced scope.
- Get QA approval before SAT execution begins, and file the signed assessment with the SAT report.
- Set the change-control trigger so a future repeat installation, a design change, or a rough FAT reopens this assessment rather than inheriting a stale decision.