The Relationship Between CSV, Qualification, and Process Validation

Understanding GMP “Hardware” and “Software”

“Hardware” and “Software” are indispensable elements and concepts when discussing Good Manufacturing Practice (GMP). The three principles of GMP are achieved through both GMP Hardware and GMP Software.

GMP Hardware

Hardware refers to manufacturing facilities, equipment, and instruments, which must be:

• Manufacturing facilities with equipment and environments that can prevent errors
• Manufacturing facilities with hygienic equipment and environments
• Manufacturing facilities with equipment and environments that can maintain high quality consistently

GMP Software

GMP Software encompasses:

• Establishing and documenting rules
• Implementing according to rules and creating records
• Conducting periodic reviews and implementing improvements

The Evolution of GMP Hardware: Computerized Systems

While GMP Hardware is primarily composed of hardware components, many structural facilities in recent years are controlled by relatively compact programs such as PLCs (Programmable Logic Controllers) and firmware (hereinafter referred to as software). GMP Hardware controlled by software is called a “computerized system.”

The critical principle for computerized systems is that the quality and quality assurance of manufactured (or analyzed) pharmaceutical products must not deteriorate when software controls operations that were previously performed manually. Therefore, software validation, known as CSV (Computerised System Validation), must be performed. The goal of CSV is to ensure equivalent quality and quality assurance for products manufactured through manual operations versus computer-controlled operations. Additionally, computerization (automation) must not increase risks.

Understanding Qualification: Beyond One-Time Validation

Regardless of whether it is computerized, GMP Hardware must undergo qualification (DQ, IQ, OQ, PQ) before use. Qualification is the validation process for GMP Hardware.

The Four Stages of Qualification

Design Qualification (DQ): Documented verification that the proposed design of facilities, systems, and equipment is suitable for the intended purpose. This stage establishes the foundation by ensuring that design specifications align with user requirements and regulatory expectations.

Installation Qualification (IQ): Documented verification that facilities, systems, and equipment have been installed according to design specifications and manufacturer recommendations.

Operational Qualification (OQ): Documented verification that facilities, systems, and equipment operate as intended throughout all anticipated operating ranges.

Performance Qualification (PQ): Documented verification that facilities, systems, and equipment can perform effectively and reproducibly based on the approved process method and product specification.

The Reality of Requalification

Important Clarification: It is incorrect to state that qualification is performed only once when equipment is introduced. Periodic requalification is required to ensure ongoing compliance and quality throughout the equipment lifecycle. Requalification should be performed:

• After significant changes to equipment or processes
• Following major maintenance activities
• When deviations indicate potential impact on product quality
• Based on risk assessment and regulatory requirements
• Typically on a scheduled basis (risk-based intervals)

According to current regulatory expectations (FDA 21 CFR Part 211, EU GMP Annex 15, ICH Q9), requalification is not optional but a mandatory GMP requirement to maintain validated status over time.

CSV Within the Qualification Framework

CSV cannot be performed independently because it controls hardware. Therefore, CSV must be implemented as part of equipment qualification. In other words, CSV corresponds to one chapter within the qualification report.

However, it is important to note that CSV is not merely a subordinate activity. Under current regulatory frameworks including:

• FDA 21 CFR Part 11 (Electronic Records and Electronic Signatures)
• EU GMP Annex 11 (Computerised Systems) – revised with expanded requirements
• FDA Computer Software Assurance (CSA) guidance (finalized September 2025)
• GAMP 5 (Good Automated Manufacturing Practice, 2nd Edition)
• ISO 13485:2016 (for medical device manufacturers)

CSV has evolved into a comprehensive lifecycle approach that requires:

• Risk-based assessment of computerized systems
• Focus on data integrity (ALCOA++ principles)
• Critical thinking and software assurance activities
• Continuous monitoring and periodic review
• Integration with the Pharmaceutical Quality System (PQS)

The FDA’s Shift to Computer Software Assurance (CSA)

The FDA’s 2025 CSA guidance represents a paradigm shift from traditional exhaustive documentation to a more efficient, risk-based approach:

• Critical thinking first: Validation activities guided by understanding how systems impact GMP processes and patient safety
• Risk-based focus: High-risk functions receive the most rigorous testing and controls
• Efficient testing: Scripted testing applied where meaningful, with exploratory testing for broader assurance
• Leveraging vendor documentation: Appropriate use of supplier documentation when properly assessed

Process Validation: The Integration of Hardware and Software

Process validation is performed for each product using qualified GMP Hardware together with GMP Software. This represents the comprehensive validation of the manufacturing process.

The Modern Lifecycle Approach to Process Validation

According to FDA’s 2011 “Process Validation: General Principles and Practices” guidance and EU GMP Annex 15 (revised 2015), process validation follows a lifecycle approach with three stages:

Stage 1 – Process Design: The commercial manufacturing process is defined during this stage based on knowledge gained through development and scale-up activities. This stage emphasizes:

• Quality by Design (QbD) principles (ICH Q8)
• Risk management (ICH Q9)
• Understanding of process capabilities and sources of variation

Stage 2 – Process Qualification: Also known as Process Performance Qualification (PPQ), this stage confirms that the process design is capable of reproducible commercial manufacturing. It includes:

• Design of the facility and qualification of utilities and equipment
• Performance of the process in the commercial manufacturing facility
• Demonstration that the commercial manufacturing process performs as expected

Stage 3 – Continued Process Verification: Ongoing assurance is gained during routine production that the process remains in a state of control. This stage involves:

• Continuous monitoring and trending of process performance
• Statistical process control where appropriate
• Management of process variability
• Implementation of improvement initiatives

This lifecycle approach replaces the outdated “validation by three batches” concept, emphasizing continuous process knowledge and understanding throughout the product lifecycle.

The Fundamental Relationship: A Comprehensive Framework

Process validation encompasses both GMP Software and GMP Hardware. Validation related to GMP Hardware is accomplished through Qualification (DQ, IQ, OQ, PQ, and periodic requalification). This relationship can be understood as follows:

Hierarchical Structure

Level 1 – GMP Foundation

• GMP Hardware (facilities, equipment, systems)
• GMP Software (procedures, documentation, continuous improvement)

Level 2 – Hardware Validation

• Equipment Qualification (DQ, IQ, OQ, PQ)
  • For computerized systems: CSV is integrated within qualification
  • Periodic requalification maintains validated status

Level 3 – Process Validation

• Lifecycle approach (Stage 1: Design, Stage 2: Qualification, Stage 3: Verification)
• Product-specific validation
• Integration of qualified hardware and established software procedures

Clarifying Industry Confusion: A Comparative Analysis

Aspect	CSV	Qualification	Process Validation
Scope	Software validation for computerized systems	Hardware validation (equipment, facilities, utilities)	Complete manufacturing process validation
When Performed	During equipment qualification lifecycle	Upon installation and periodically thereafter	Throughout product lifecycle (3 stages)
Relationship	Component of qualification for computerized systems	Prerequisite for process validation	Encompasses qualified equipment + validated procedures
Focus	Data integrity, system functionality, ALCOA++ principles	Equipment capability, installation, operation, performance	Process capability, reproducibility, state of control
Regulatory Basis	FDA 21 CFR Part 11, EU Annex 11, FDA CSA 2025, GAMP 5	FDA 21 CFR Part 211, EU Annex 15, ICH Q9	FDA Process Validation Guidance 2011, EU Annex 15, ICH Q8/Q10
Frequency	Initial + after changes + periodic review	Initial + requalification (risk-based intervals)	Stage 2 (initial) + Stage 3 (continuous)
Product Specific	No (system-specific)	No (equipment-specific)	Yes (each product/process)

Current Regulatory Landscape and Industry Standards

The regulatory environment has evolved significantly, emphasizing:

Key Regulatory Documents (2024-2026)

• FDA Computer Software Assurance (CSA) – Final Guidance (September 2025): Modernizes validation expectations with risk-based, critical thinking approach
• EU GMP Annex 11 – Draft Revision (2025): Expands from 5 pages to 17 sections, strengthening CSV expectations with PQS integration
• GAMP 5 Second Edition: Provides practical framework for risk-based computerized system validation
• ICH Q9 (Quality Risk Management): Foundation for risk-based validation activities
• ICH Q10 (Pharmaceutical Quality System): Emphasizes lifecycle approach to quality management

Emerging Trends

• Integration of cybersecurity into CSV
• Cloud computing validation considerations
• Data integrity as central focus (ALCOA++ principles: Attributable, Legible, Contemporaneous, Original, Accurate + Complete, Consistent, Enduring, Available)
• Shift from documentation-heavy to assurance-focused validation
• Continuous process verification using real-time data analytics

Why This Understanding Matters

There is a conspicuous absence of seminars and literature explaining the relationship between CSV, Qualification, and Process Validation comprehensively. This gap has been a source of confusion for pharmaceutical companies. Understanding this fundamental relationship is essential for:

1. Regulatory Compliance: Meeting FDA, EMA, and other regulatory authority expectations
2. Efficient Resource Allocation: Avoiding redundant validation activities
3. Risk Management: Focusing validation efforts where they matter most for product quality and patient safety
4. Audit Readiness: Demonstrating clear understanding of validation hierarchy to inspectors
5. Quality Assurance: Ensuring systematic approach to validation throughout product lifecycle

Practical Implementation Guidance

For pharmaceutical companies to successfully implement this framework:

For CSV Implementation

• Adopt risk-based approach following GAMP 5 principles
• Focus on GMP-critical functionality and data integrity
• Leverage vendor documentation appropriately
• Implement robust change control processes
• Conduct periodic reviews (typically annually)

For Equipment Qualification

• Develop comprehensive qualification master plans
• Execute DQ, IQ, OQ, PQ systematically with clear acceptance criteria
• Establish requalification schedules based on risk assessment
• Maintain qualification status through change control
• Document all activities thoroughly for regulatory inspection

For Process Validation

• Establish validation master plan covering all products and processes
• Apply lifecycle approach across all three stages
• Integrate process analytical technology (PAT) where beneficial
• Implement continued process verification with statistical trending
• Link validation activities to quality risk management

Conclusion: A Unified Framework for Pharmaceutical Quality

The relationship between CSV, Qualification, and Process Validation forms an integrated quality framework essential for pharmaceutical manufacturing. CSV validates software within computerized systems, Qualification validates equipment and facilities, and Process Validation confirms the entire manufacturing process. Together, they ensure that pharmaceutical products consistently meet quality standards and protect patient safety.

Understanding this hierarchy – from individual system validation through equipment qualification to comprehensive process validation – enables pharmaceutical companies to develop robust, compliant, and efficient validation strategies. As regulatory expectations continue to evolve toward risk-based, lifecycle approaches, this foundational understanding becomes increasingly critical.

The key takeaway is that these are not separate, disconnected activities but interconnected components of a comprehensive quality assurance strategy. Equipment must be qualified (including CSV for computerized elements) before process validation can begin, and all must be maintained through ongoing verification and requalification activities throughout their lifecycle.

By clarifying these relationships and incorporating current regulatory expectations, pharmaceutical companies can move beyond confusion and implement validation programs that truly ensure product quality, regulatory compliance, and ultimately, patient safety.