Manufacturing Process Validation for KGMP and ISO 13485

Where Validation Goes Wrong

Manufacturing process validation is one of the most consistently demanded — and most consistently weak — areas in medical device QMS audits. The pattern is recognizable:

Validation was performed at process implementation, often years ago.
Validation reports are filed somewhere; nobody can find them quickly during audit.
Process changes have been made since validation; the changes were captured in change control but the validation was not refreshed.
New auditors arrive and treat the absence of recent revalidation evidence as a finding.

For KGMP audits specifically, manufacturing process validation is among the top three areas where foreign manufacturers receive findings. The Korean audit expectation is stricter than what manufacturers experience in some other jurisdictions, and the evidence threshold is real.

What the Standards Actually Require

A consolidated view of the major standards:

ISO 13485 §7.5.6 requires the manufacturer to validate any processes where the output cannot be (or is not) verified by subsequent monitoring or measurement. The validation must:

Be planned (IQ/OQ/PQ or equivalent)
Define criteria for review and approval
Use defined methodology
Document records
Provide for revalidation when the process changes

FDA 21 CFR 820.75 is structurally similar with explicit mention of:

Performance characteristics that affect device safety or effectiveness
Approved procedures
Documented IQ, OQ, PQ
Monitoring and control

KGMP requirements are aligned with ISO 13485 §7.5.6 but Korean auditors specifically check:

Validation report completeness (not just the certificate but the full underlying data)
Statistical justification of sample sizes
Korean-language summary or transcript where the operator interactions are critical

The principles overlap; the execution evidence expectations are jurisdiction-specific.

Which Processes Need Validation

A common scope question: which manufacturing processes require validation?

Always require validation (output cannot be verified):

Sterilization (EO, gamma, steam, e-beam)
Cleaning processes for reusable devices
Bonding and welding (cannot fully inspect bond strength non-destructively)
Heat treatment
Coating application
Software installation and configuration for SaMD
Aseptic filling and assembly
Polymer molding processes

Often require validation (output verification is partial or insufficient):

Mechanical assembly where final inspection cannot capture all critical attributes
Calibration processes
Packaging processes for sterile barrier integrity
Labeling processes (especially direct marking)
Temperature/humidity-controlled storage

Usually do not require validation (output is fully verified):

Final dimensional inspection
Visual inspection
Functional testing where all critical functions are tested

The decision should be documented per process, not left as an implicit judgment.

The IQ/OQ/PQ Structure

Three sequential phases. Each phase has distinct objectives and evidence types.

Installation Qualification (IQ)

The purpose: verify that the manufacturing equipment is installed correctly, calibrated, and matches the design intent.

Evidence: equipment specifications matched to installation, calibration records of measurement instruments, utilities (power, gas, water) verified, environmental conditions verified, equipment manuals on file, operator training records.

IQ is typically straightforward and is rarely the source of findings. The failure mode is missing calibration records or expired calibrations.

Operational Qualification (OQ)

The purpose: verify that the equipment operates as intended across the full intended operating range, including challenge conditions.

Evidence: process parameter ranges defined, equipment performance tested at the boundaries of the range, statistical justification of the sample size, failure modes characterized, control limits established.

OQ is where most validation work concentrates. The failure mode is testing only at nominal conditions rather than at the edges of the operating range.

Performance Qualification (PQ)

The purpose: verify that the manufacturing process produces consistent results under actual production conditions, including with actual operators and actual materials.

Evidence: minimum three production batches run under normal conditions, all critical process parameters captured per batch, all quality attributes verified per batch, statistical analysis demonstrating capability, operator certification.

PQ is where Korean auditors look most carefully. The failure mode is treating PQ as a one-time event rather than as establishment of ongoing process capability.

Statistical Justification

A frequent area of weakness: sample sizes used in OQ and PQ are chosen by convention rather than by statistical justification.

A more defensible approach:

For attribute data (pass/fail), sample sizes anchored on AQL tables or on binomial confidence calculations for the required defect rate.
For variable data (measurements), sample sizes anchored on capability requirements (Cpk targets) and required confidence intervals.
Justification documented in the validation protocol, not added retroactively.

Korean auditors often request the statistical justification specifically. A protocol with "n=3 lots" without justification is a likely finding.

Revalidation Triggers

Revalidation is required when:

The process changes (materials, equipment, methods, operators if certified-operator dependent)
The product changes in ways that affect the process
Performance data indicates trend toward out-of-specification
Periodic review interval has elapsed (typically 3–5 years for stable processes, more frequently for critical processes)
Regulatory requirements change

The revalidation does not always mean a full IQ/OQ/PQ rerun. A risk-based approach can scope the revalidation to the elements affected by the change, with formal justification of the limited scope.

The discipline is: every process change goes through an explicit revalidation determination. The determination — full revalidation, partial revalidation, or no revalidation with justification — is documented as part of change control.

Sterilization Validation: A Special Case

Sterilization validation has its own framework (ISO 11135 for EO, ISO 11137 for gamma, ISO 17665 for steam). It is more elaborate than general process validation.

Key elements:

Microbiological challenge testing with appropriate bioindicators
Dose distribution mapping (for radiation)
Bioburden characterization on the product
Sterility assurance level (SAL) calculation
Routine monitoring methodology

For Korean operations, sterilization validation is often where KGMP audit findings concentrate because:

The validation report is typically held by the sterilization contractor, not the manufacturer
Korean auditors expect the full validation report, not the sterilization certificate
The manufacturer is responsible for verifying the contractor's validation, which often is not documented

Manufacturers should obtain the full sterilization validation report from contractors and hold it as part of the audit-defensible record set.

MES Integration

Modern manufacturing execution systems can dramatically improve validation defensibility:

IQ records integrate with equipment master in MES
OQ test data captures into MES, linked to the process specification
PQ batches generate eDHRs that serve as PQ evidence
Ongoing process monitoring integrates with MES SPC, providing continuous evidence of process capability
Revalidation triggers can be configured (e.g., capability index drift, parameter excursion)

Manufacturers with mature MES deployments report 40–60% reduction in validation documentation cycle time and meaningfully cleaner audit defenses.

The Korean-Specific Implications

For manufacturers operating under KGMP:

Validation documentation should be retrievable in Korean or with Korean summary translations
Validation evidence should be on-site (accessible during audit) not stored only in remote/global systems
Sterilization validation specifically requires the full contractor report, on file at the manufacturing site or at the KLH location
Process changes that affect Korean-marketed devices should trigger revalidation determination and, where applicable, MFDS change notification

For Korean manufacturing sites specifically, the validation work is often the most time-consuming element of KGMP readiness.

Where Leanabl Plugs In

The eQMS service includes manufacturing process validation infrastructure setup — protocols, documentation, statistical justification frameworks. Platform MES deployment integrates validation evidence into the production system. For Korean-specific manufacturing readiness, Korea QMS Foundation and KGMP Certification cover the validation evidence work required for KGMP audits.