GOOD PRACTICE GUIDE:

Critical Utilities
GMP Compliance
How to Be Compliant and
Ready to Prove It

Disclaimer:
This Good Practice Guide is intended to provide guidance on achieving and maintaining critical utility systems
compliance, and to be an aid to organizations in preparing and hosting regulatory inspections and audits. This Guide
is solely created and owned by ISPE. It is not a regulation, standard or regulatory guideline document. ISPE cannot
ensure and does not warrant that a system managed in accordance with this Guide will be acceptable to regulatory
authorities. Further, this Guide does not replace the need for hiring professional engineers or technicians.

Limitation of Liability
In no event shall ISPE or any of its affiliates, or the officers, directors, employees, members, or agents of each of
them, or the authors, be liable for any damages of any kind, including without limitation any special, incidental,
indirect, or consequential damages, whether or not advised of the possibility of such damages, and on any theory of
liability whatsoever, arising out of or in connection with the use of this information.

© Copyright ISPE 2020. All rights reserved.

All rights reserved. No part of this document may be reproduced or copied in any form or by any means – graphic,
electronic, or mechanical, including photocopying, taping, or information storage and retrieval systems – without
written permission of ISPE.

All trademarks used are acknowledged.

ISBN 978-1-946964-29-8
Page 2 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Preface
Because of their hidden nature, critical utility systems are vulnerable to noncompliance. With their potential to impact
product quality or performance in a significant way, critical utilities consistently receive close scrutiny by regulatory
inspectors. This ISPE Good Practice Guide: Critical Utilities GMP Compliance – How to Be Compliant and Ready to
Prove It aims to assist pharmaceutical organizations achieve and maintain their critical utility systems in a state of
control, and then efficiently demonstrate these systems’ GMP compliance to regulatory inspectors and auditors.

It is not the goal of this Good Practice Guide to provide tips on how to pass an inspection; rather the intent is to
provide guidance on achieving and maintaining compliance, and to be an aid to organizations when preparing the
documents, personnel, and site logistics to help ensure inspections are efficiently conducted, making good use of the
limited resources of regulators.
ISPE Good Practice Guide: Page 3
Critical Utilities GMP Compliance

Acknowledgements
The Guide was produced by a Task Team led by Nik Krpan (Cheme Engineering Inc., Canada) and Rod Freeman
(Kite Pharma, Inc., USA). The work was supported by the ISPE Critical Utilities Community of Practice (CoP).

Core Team

The following individuals took lead roles in the preparation of this document and each managed one or more chapter
teams made up of writers and contributors.

Brian Cox Eli Lilly and Co. USA

Rod Freeman Kite Pharma, Inc. USA
Nik Krpan Cheme Engineering Inc. Canada
Joe Manfredi GMP Systems, Inc. USA
Fritz Röder Merck Healthcare KGaA Germany
Teri C. Soli, PhD Soli Pharma Solutions Inc. USA

Chapter Writers and Reviewers

The Core Team wish to thank the following individuals for their valuable contribution during the preparation of this
document.

Robert M. Augustine Eli Lilly and Company USA

Stuart du Kamp Innomar Strategies Inc. Canada
Ariel Kehati Johnson & Johnson Israel
Dave Manku Azzur Group, LLC USA
Samuel O’Callaghan CSL Behring USA
Roland Thoendel Takeda Austria
Nancy Tomoney Strategic Solutions USA

Regulatory Input and Review

Particular thanks go to the following for their review and comments on this Guide:

Bernd Boedecker, EU GMP Inspector (retired), Trade & Industry Inspection Agency of Hannover, Germany

Alan Moon, Senior GMDP Inspector, IE&S, Medicines and Healthcare products Regulatory Agency (MHRA), United
Kingdom

Subject Matter Expert Input and Review

General thanks to all industry reviewers with particular thanks to the following reviewers numerous and constructive
criticism:

Pharmaceutical Technical Services USA

PM Group China
Amgen Inc. USA
J-GMP United Kingdom
Sanofi USA
DoD JPO – CBRND Systems USA
Page 4 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Special Thanks

The Team would like to give particular thanks to Andre Gill (Andre Gill Engineering, LLC, USA) for identifying the need
for this Guide and initiating its inception.

The Leads would like to thank Lynda Goldbach (ISPE Guidance Documents Manager) for her indispensable work
in organizing the working group. The Leads would also like to thank Jeanne Perez (ISPE Guidance Documents
Technical Writer/Editor) for her skillful and timely editing of the final working drafts.

The Leads would also like to express their grateful thanks to the many individuals and companies from around the
world who reviewed and provided comments during the preparation of this Guide; although they are too numerous to
list here, their input is greatly appreciated.

Company affiliations are as of the final draft of the Guide.

Facility cover photo courtesy of GC Biotherapeutics Inc. (GCBT), https://www.greencrossbt.com.

600 N. Westshore Blvd., Suite 900, Tampa, Florida 33609 USA

Tel: +1-813-960-2105, Fax: +1-813-264-2816

www.ISPE.org
ISPE Good Practice Guide: Page 5
Critical Utilities GMP Compliance

Table of Contents
1 Introduction.......................................................................................................................7
1.1 Overview....................................................................................................................................................... 7
1.2 Purpose......................................................................................................................................................... 7
1.3 Scope............................................................................................................................................................ 8
1.4 Key Terms..................................................................................................................................................... 8

2 Critical Utilities Viewed from a Regulatory Perspective............................................11

2.1 Drinking/Potable Water............................................................................................................................... 11
2.2 Compendial Water Pretreatment................................................................................................................ 14
2.3 Purified Water............................................................................................................................................. 14
2.4 Water for Injection....................................................................................................................................... 15
2.5 Pure Steam................................................................................................................................................. 15
2.6 Clean Compressed Air................................................................................................................................ 16
2.7 Process Gases............................................................................................................................................ 17

3 Validation Lifecycle and Quality Systems................................................................... 21

3.1 Validation.................................................................................................................................................... 21
3.2 Change Control........................................................................................................................................... 24
3.3 Risk Management....................................................................................................................................... 25
3.4 Drawings and Documentation..................................................................................................................... 27
3.5 Investigations and Corrective Actions and Preventive Actions................................................................... 32
3.6 Sampling and Testing.................................................................................................................................. 36

4 Ongoing Operations...................................................................................................... 39
4.1 Data Integrity, Handling, and Automation.................................................................................................... 39
4.2 Sanitization and Microbial Control In Pharmaceutical Water Systems....................................................... 43
4.3 Maintenance............................................................................................................................................... 47
4.4 Hoses.......................................................................................................................................................... 49
4.5 Routine System Reviews............................................................................................................................ 50
4.6 Calibration................................................................................................................................................... 52
4.7 Training....................................................................................................................................................... 54

5 Legacy Water Systems.................................................................................................. 57

5.1 Sources of Legacy Systems....................................................................................................................... 57
5.2 Types of Deficiencies and What Can Be Done........................................................................................... 57
5.3 Regulatory Impact of Legacy Systems....................................................................................................... 60

6 Appendix 1 – Typical Regulatory Citations/Warning Letters................................... 61

6.1 Letter 1 – Failure to Validate and Monitor the Water Purification System................................................... 61
6.2 Letter 2 – Failure to Test Water Used in Drug Product Manufacture.......................................................... 62
6.3 Letter 3 – Inadequate Purified Water System Controls............................................................................... 62
6.4 Letter 4 – Water System Failures............................................................................................................... 63
6.5 Letter 5 – Inadequate Investigations........................................................................................................... 64
6.6 Letter 6 – Failure to Validate and Monitor the Water Purification System................................................... 65
6.7 Letter 7 – Failure to Validate Purified Water System.................................................................................. 66
6.8 Letter 8 – Data Integrity Failures................................................................................................................ 67
6.9 Letter 9 – Lack of or Insufficient Investigation of Water System Failures................................................... 68
Page 6 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

7 Appendix 2 – Inspection Hosting Good Practices and Readiness Checklist......... 69

7.1 Inspection Hosting and Behaviors.............................................................................................................. 69
7.2 Opportunities for Improvement................................................................................................................... 70
7.3 Inspection Readiness Checklist.................................................................................................................. 72

8 Appendix 3 – Sampling Practice and Planning Supplemental Information.......... 75

8.1 Testing SOP and Test Materials Preparation.............................................................................................. 75
8.2 Examples of Good and Poor Water Sampling and Water Use Practices.................................................... 75
8.3 Microbial Discrepancies Caused by Poor Sampling Methods.................................................................... 76
8.4 Sampling Plan............................................................................................................................................. 77

9 Appendix 4 – Compendial Water Specifications...................................................... 79

10 Appendix 5 – Microbial Enumeration: Consideration of Nutrient Media,

Incubation Temperature, and Incubation Time......................................................... 85
10.1 Growth Medium Choice.............................................................................................................................. 85
10.2 Incubation Conditions (Temperature and Duration).................................................................................... 86

11 Appendix 6 – References.............................................................................................. 87

12 Appendix 7 – Glossary................................................................................................... 93
12.1 Acronyms and Abbreviations...................................................................................................................... 93
12.2 Definitions................................................................................................................................................... 95
ISPE Good Practice Guide: Page 7
Critical Utilities GMP Compliance

1 Introduction
1.1 Overview

Regulatory compliance of Critical Utilities (CU) is important to maintaining overall facility compliance, but due to their
hidden nature, CU can become vulnerable to noncompliance. CU consistently receive close scrutiny by inspectors
primarily because of the level of associated risk to product. If contamination is present in the CU systems, the risk of
product contamination increases significantly since in many cases, one or more of the following are true:

• Water from the CU is used as an excipient directly in product

• Compressed gas is used in direct contact with product

• Water and/or compressed gas are used in cleaning product-contact surfaces

• Clean steam is used in the sterilization of product or product-contact surfaces

Governmental inspectorates have been largely silent for decades on their specific expectations of users during
an inspection of CU. An inspection guide was written by the FDA for high purity water systems in 1993 (Guide
to Inspections of High Purity Water Systems [1]). This guide, although valuable in earlier years, has led to many
discussions regarding non-contemporary water system designs and validation approaches, to name a few issues,
and does not provide the depth of scope to prepare organizations for an inspection in today’s pharmaceutical
industry. In addition, there are no compliance or inspection guides issued by any inspectorate for other CU such as
compressed gases or steam.

ISPE sees the need in the pharmaceutical industry for guidance in the CU area (specifically water, steam, and
compressed gases) for achieving and maintaining GMP compliance, and for demonstrating that compliance during
a regulatory inspection. This Good Practice Guide (GPG) is intended to fill that void by providing knowledge based
on the collective experiences of the authors gained from operational and regulatory inspections. To make this Guide
internationally useful, the authors have included information acquired from experience with the inspectorates of Brazil,
Canada, China, the European Union, India, Japan, the United Kingdom, and the United States.

This GPG is not a regulatory document, and should not be interpreted to reflect inspectorate guidance. Additionally,
it is not the goal of this GPG to provide tips on how to pass an inspection; rather the intent is to provide guidance
on achieving and maintaining compliance, and to assist organizations in preparing the documents, personnel, and
meeting rooms to help ensure inspections are efficiently conducted, making good use of the limited resources of
regulators.

1.2 Purpose

The purpose of this GPG is twofold: to help pharmaceutical organizations achieve and maintain their CU systems
in a state of control and to help organizations efficiently demonstrate these systems’ GMP compliance to auditors
and regulatory inspectors. By making inspections more efficient, our hope is that regulators’ limited resources will be
deployed more widely, resulting in enhanced patient safety.
Page 8 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

1.3 Scope

CU systems are utilities with the potential to impact product quality or performance in a significant way. The primary
CU discussed in this GPG is the water system, as it is highly complex and prone to noncompliance. (Appendix 1
contains examples of typical regulatory citations specific to water systems.) The other utilities covered are Pure
Steam, compressed air, and compressed medical gases.

This GPG provides an overview of the processes and documentation needed to implement and maintain a validated
utility system, for example, assessing the risks of upstream noncritical parameters (Section 3.3), the value of
proactively scheduling water system sanitizations (Section 4.2), and determining a suitable statistical distribution
model for monitoring water system data (Section 4.5). Furthermore, Chapter 5 discusses the challenges of legacy
water systems.

Topics such as the importance of maintaining up-to-date system drawings (Section 3.4) and sampling water in the
same manner as water use during manufacturing (Appendix 3) provide inspection preparation activities specific to
CU systems. Also included in this GPG are broadly applicable best practices, such as inspection hosting and an
inspection readiness checklist (Appendix 2). These are presented here to make the GPG comprehensive, since they
are not covered in other ISPE Guides. However, activities pertaining to CU inspections described in depth by other
ISPE Guides (such as the ISPE Baseline® Guide: Volume 5 – Commissioning and Qualification [2], and the ISPE
Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3]) are discussed at a higher
level in this GPG. The objective of this redundancy is to make this GPG as stand-alone as possible without sending
the user searching to find other GPGs with the critical content needed during preparation for an inspection.

It is worth noting that compliance begins with properly engineered systems; however other ISPE Guides fully cover
this aspect. As such, this GPG does not address the design of CU systems, but serves as a companion document to
these ISPE Guides (for example, ISPE Baseline® Guide: Volume 4 – Water and Steam Systems [4]).

Although HVAC is considered by many to be a CU, it is not included in this GPG. Such systems are often considered
to be an integral part of clean room operations and subject to additional quality attributes and operational issues, and
so tend to be associated with inspections of aseptic processing operations rather than CU. In addition, media supply
systems are normally considered as an excipient (except compressed air for oral solid dosage forms manufacturing),
but HVAC systems are not. Thus, the viewpoint when inspecting HVAC systems is different compared to the CU
systems mentioned in this Guide.

1.4 Key Terms

This section introduces key terms as they are used in the context of this Guide. Refer to Appendix 7 for an expanded
listing of definitions.

Critical Utilities (CU)

Utilities that have the identified potential to impact product quality or performance in a significant way.

Deviation (ICH Q7 [5])

Departure from an approved instruction or established standard.

ISPE Good Practice Guide: Page 9
Critical Utilities GMP Compliance

Drinking Water

Drinking water is not covered by a compendial monograph but must comply with the quality attributes of the US EPA
NPDWR1 [6] or comparable regulations of the European Union (EU) [7], World Health Organization (WHO) [8], or
Japan [9]. It may be derived from a variety of sources including a public water utility, a private water supply (e.g., a
well), or a combination of more than one of these sources.

Medical Gases (FDA [10, 11])

“Compressed medical gases (CMG or medical gases) include gaseous and liquid (cryogenic) forms stored in
high-pressure cylinders that are administered as a gas. Types of compressed medical gases include, but are not
limited to, oxygen, carbon dioxide, helium, nitrogen, nitrous oxide, medical air, and combinations of these gases.”

“The term ‘medical gas’ means a drug that— (A) is manufactured or stored in a liquefied, nonliquefied, or
cryogenic state; and (B) is administered as a gas.”

Potable Water

Water that is suitable for drinking.

Pure Steam

Steam that is produced by a steam generator which, when condensed, meets requirements for Water for Injection
(WFI).

Purified Water (PW)

A classification of water according to compendial standards.

Water for Injection (WFI)

As defined in the US Pharmacopeia (USP) [12]

“Prepared from water complying with the quality attributes of “Drinking Water.” Purified by distillation or a
purification process that is equivalent or superior to distillation in the removal of chemicals and microorganisms.”

As defined in European Pharmacopoeia (Ph. Eur.) [13]

“Water for the preparation of medicines for parenteral administration when water is used as a vehicle (WFI in
bulk) and for dissolving or diluting substances or preparations for parenteral administration (sterilized Water for
Injection).”

1
EPA NPDWR: US Environmental Protection Agency National Primary Drinking Water Regulations
ISPE Good Practice Guide: Page 11
Critical Utilities GMP Compliance

2 Critical Utilities Viewed from a

Regulatory Perspective
A Critical Utility (CU) is defined by ISPE [14] as: “Utility that has the identified potential to impact product quality or
performance in a significant way.” This GPG focuses on water systems (specifically PW, WFI, and Pure Steam);
however it is relevant to also address some of the systems/utilities that feed water systems, specifically potable water
and pretreated water, as these grades of water are important to overall compliance. Process gases are touched on in
this Guide as well, albeit to a lesser extent as they typically do not present the same degree of difficulty in maintaining
compliance.

CUs are special in that they can be considered a raw material, and therefore are subject to GxP requirements.
However, with the continuous generation and distribution of water and steam, and the constant availability of
compressed gases including air, it is not feasible to take the traditional approach of identifying these materials by a
discrete lot number, testing the lot, and releasing for production. Continuously produced utilities are typically used
before all results are available.

Additionally, since these CU have a broad impact across multiple products and processes at a manufacturing site,
they are considered to entail a significantly higher risk to product quality and subsequently, to patient safety.

For these reasons, regulatory scrutiny of CU systems often includes more elements of the quality system that
address monitoring, control, maintenance, and calibration than is seen for a noncritical utility system.

2.1 Drinking/Potable Water

Drinking water, also referred to as potable water, must comply with appropriate regulatory requirements (such
as defined by US EPA [6], WHO [8], etc.) and is the minimum quality of water to be used in pharmaceutical
manufacturing (i.e., various pharmacopeias, and GMPs found in the FDA 21 CFR Parts 210 [15] and 211 [16], and
elsewhere2).

Since this is the only specifically mentioned water in the GMP regulations, it is clearly important to regulatory
authorities that a lower quality of water not be used in pharmaceutical manufacturing and that the users have taken
steps to ensure that a lower, potentially unsafe quality of water is not inadvertently utilized. This puts the burden of
proof on the users of this water to ensure the quality meets minimum requirements and is suitable for its intended
use.

2.1.1 Minimum Water Purity Requirements for API and Finished Product Manufacturing

According to ICH Q7 [5], the minimum water quality to be used for API manufacture and in the pharmaceutical facility
in general, is water that complies with WHO Guidelines for Drinking-Water Quality3 [8].

Depending on the nature of the API processing and its final microbial and chemical attributes, water of a purity
level higher than potable quality may be needed. This is particularly important in the latter stages of synthesis or
purification, where removal of impurities introduced with the water may not be accomplished by these final API
processing steps [5].

2
Note that at the time of this writing, the EMA document “Guideline on the quality of water for pharmaceutical use” [17] is pending implementation.
3
Although the attributes specified in WHO Guidelines for Drinking-Water Quality are considered goals and not necessarily mandatory for human
consumption, compliance with all attributes is mandatory when used in API manufacture as well as for general pharmaceutical uses [5].
Page 12 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Most pharmacopeias require the minimum water quality used for API and excipient manufacture to be potable or
drinking water. USP General Notices Section 8.230.20 states4 [12]:

“When used in the manufacture of official substances, water shall meet the requirements for drinking water as
set forth in the U.S. Environmental Protection Agency National Primary Drinking Water Regulations (NPDWR)
or in the drinking water regulations of the European Union or of Japan, or in the World Health Organization’s
Guidelines for Drinking Water Quality. Additional specifications may be required in monographs.”

This means that if a pharmaceutical manufacturer is in a jurisdiction other than the US, a member state of the EU,
or Japan, the drinking water quality used in manufacturing must comply with the one of these jurisdictions’ drinking
water regulations or WHO drinking water guidelines [8]. Compliance with a different jurisdiction’s drinking water
regulations, if not one of those four, is irrelevant to USP as well as FDA.

The Ph. Eur. [13] defines the minimum quality of water for use in API manufacture as:

“complies with the regulations on water intended for human consumption laid down by the competent authority.”

Ph. Eur. does not explain who a competent authority is; however, it is understood to be the national entity in charge
of the subject. It is the manufacturer’s responsibility to identify the applicable drinking water regulations of the
country in which the product will be marketed and ensure that the drinking water used in manufacturing meets those
requirements.

2.1.2 Source Water for Purification Systems

Another important use of drinking water is as source water for an on-site purification system that produces
compendial grades of water, such as PW or WFI. When starting with one of the pharmacopeial drinking waters, all
unsafe levels of impurities have theoretically been removed. So unless there is a possibility that these impurities
could be reintroduced into the water, there is no need to test for their absence in the further purified water. Instead, for
finished water (i.e., PW or WFI), general non-specific tests for ionic and organic impurities, that is, Conductivity and
Total Organic Carbon (TOC), can be used to broadly define the finished water quality; however, several jurisdictions
mandate additional tests (see Appendix 4). It is noteworthy that the microbial content of the water undergoing
purification is also monitored, and, depending on the treatments selected, it may be that the levels of culturable
bacteria in the non-compendial pretreatment water increase due to certain unit operations, and that this is acceptable.

2.1.3 Source Water Compliance Standards

Similarly to the water requirements described for APIs in USP General Notices, the USP [12] monographs for PW,
WFI, and Pure Steam specify using one of the same four regional drinking water specification sets as the source
water.

In Europe [13] and Japan [18], a globally accepted source water quality for purification into PW is WHO Drinking
Water [8]. However some pharmacopeia require that PW is used to supply the final purification step that generates
WFI. (See Appendix 4 for the requirements of the major pharmacopeias.)

2.1.4 Public Water Compliance

When a public drinking water source is used, the responsibility for complying with the drinking water regulations of
the region usually falls to the drinking water provider. However, it remains the user’s responsibility to ensure that
compliance of all drinking water attributes has been achieved for water used at the pharmaceutical facility; this
responsibility includes year-round verification as there may be seasonal variability in water supply quality.

4
“Official substances” is USP’s [12] term for monographed drug substances [APIs], excipients, dietary ingredients, other ingredients, or a component
of a finished device and other finished product ingredients.
ISPE Good Practice Guide: Page 13
Critical Utilities GMP Compliance

2.1.4.1 Public Water Provider Certification and Verification

ICH Q7 [5] requires identity testing on manufacturing materials in most cases:

“At least one test to verify the identity of each batch of material should be conducted….A supplier’s Certificate of
Analysis can be used in place of performing other tests, provided that the manufacturer has a system in place to
evaluate suppliers.”

According to the GMPs, a certificate of compliance for any raw material should never be accepted without verification
of authenticity and accuracy. That verification may involve an audit of the facility to view operations and the raw data
associated with the certification, with organizations checking some attributes with their own testing. These rules
apply to any public drinking water provider including local, regional, or other drinking water authority. If the local water
provider refuses to allow a site visit/audit, then the level of risk is potentially increased and the level of monitoring by
the organization should increase to compensate.

Also, drinking water compliance applies primarily to the water at the source, prior to entering the delivery piping
network. Water may travel great distances during an extended period through piping of unknown integrity resulting in
reduced quality at the destination.

It is the user’s responsibility to verify that any provided certification of compliance with drinking water regulations is
accurate. Therefore, it may be appropriate for the pharmaceutical facility to periodically verify the drinking water’s
compliance. This includes sampling the drinking water at the manufacturer’s site in one or more locations to verify
that quality criteria are being met. The number of locations and frequency of sampling should be determined based
on a risk assessment.

Not all quality attributes in a set of drinking water regulations are required to be tested annually nor with every
sample, particularly where a history of compliance has been demonstrated by the manufacturing firm through
analysis of the incoming supply water. The selection of parameters for testing should be based on a combination of
risk assessment and the drinking water regulations applied to the manufacturing site. It may be appropriate during
a drinking water compliance audit of a water authority’s facility and its testing data to observe consecutive years of
historical testing data in order to confirm that all attributes have been tested at least at the required frequency.

2.1.4.2 Absence of Reliable Certification or Use of a Private Water Source

There are scenarios where a pharmaceutical facility may have its own private water source for use in manufacturing
and further purification. There may also be instances where the documentation supporting a drinking water provider’s
certification of compliance is absent, incomplete, untrustworthy, or not one of the acceptable standards. In these
scenarios, the pharmaceutical facility is responsible for demonstrating compliance to an acceptable set of drinking
water regulations.

The potential for variability, or when variability has been demonstrated, in drinking water quality in these situations
is a factor in how often testing should be performed. Minimally, during the first year of source testing, the robustness
of the supplied water and any treatment needed to bring the source water into compliance should be performed
multiple times (e.g., quarterly or monthly, depending on the risk assessment of the water supply) until such time as
the quality variability is discerned. Thereafter, an appropriate sampling frequency depends on a further risk analysis.
For example, in a situation with a high-risk water supply, the first year may include weekly water sampling. If all
data is acceptable, in the second year sampling frequency may be reduced to monthly, and if results are good, may
be reduced to quarterly in the third year. However, in a jurisdiction where a manufacturer has existing operations
fed from the same water supply with consistently good quality, reduced sampling frequency may occur much more
rapidly.
Page 14 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

2.1.4.3 Source Water Pretreatment and Sampling Location

It may be necessary to treat the water in order to comply with the drinking water standards. The nature of that
treatment depends on the nature of the noncompliance in the source water. Ideally, compliance with the selected
drinking water regulations should be shown with the water entering the purification system. However, it is generally
acceptably compliant to obtain samples taken from as far into the water system as the furthest Point of Use (POU);
however, sampling may be required at other locations that are deemed high risk due to infrequent usage, or due
to the nature of the use of the water dispensed. It is noteworthy that in large facilities there may be branches (not
recirculating) of potable water that see infrequent use and could be prone to microbial contamination if not regularly
flushed. If there are secondary storage tanks for potable water with their own distribution networks, this risk then
increases, and sampling from the POU of these systems should be done.

2.2 Compendial Water Pretreatment

The term pretreatment typically indicates unit operations chosen to prepare drinking water for conversion to a higher
quality by a primary treatment method. Pretreatment most often is used to either reduce the contaminant load on
primary treatment equipment or to extend the interval between equipment servicing.

Hence, pretreated water is not required to meet drinking water nor PW chemical or microbial standards; it is simply
an interim quality that allows for primary treatment equipment to operate under less demanding conditions and at
reduced operational costs. Pretreatment is significantly less costly to operate than primary treatment equipment and
extends the time between service events for the primary treatment components. Pretreatment systems must receive
a similar level of care as compendial systems proper in terms of their maintenance (leaks or other dysfunctions) as
they are an integral part of the overall treatment. From a compliance perspective, a poorly maintained pretreatment
system is a poorly maintained compendial water treatment system.

Pretreatment systems that are not properly maintained may force primary treatment components to bear the
additional load resulting in greater downtime, unscheduled outages, and increased cost. Each type of unit operation
selected for use as pretreatment requires Preventive Maintenance (PM) and possibly routine service specific to its
function.

For example, softeners typically need maintenance at a minimum annually for proper operation; however, depending
on the water quality and age of the system may require more frequent maintenance. Nonetheless, in addition to
regular maintenance, softeners need constant monitoring of salt used for regeneration, often needing additional salt
every few days. Failure to maintain salt levels could result in hardness fouling a downstream Reverse Osmosis (RO)
system and an unplanned outage.

The pretreatment system water may not meet the requirements of drinking water, but in order for the system to be
GMP compliant, it should be operated in a state of control; that is, parameters are maintained within specified ranges.
The nature of the parameters to be monitored depends on the technologies deployed in the pretreatment (e.g.,
hardness testing to verify softener performance).

Proper maintenance and operation of pretreatment equipment help to ensure optimal overall system operation, and
help to reduce events that could jeopardize the compliance of the system.

2.3 Purified Water

2.3.1 General

PW is normally used in cleaning operations as well as in the manufacture of APIs, oral solutions, topicals, oral
solid dosage products, and medical devices. In most of these cases, PW is a raw material that requires testing to
demonstrate quality and compliance.
ISPE Good Practice Guide: Page 15
Critical Utilities GMP Compliance

2.3.2 Applicable Requirements

PW, as defined by compendial monographs, requires compliance with specifications for chemical and microbial
quality. Chemical quality requirements are defined by conductivity and TOC specifications. Microbial quality
requirements for PW are usually defined in published standards. Several pharmacopeias specify a variety of other
parameters, which are summarized in Appendix 4.

2.4 Water for Injection

2.4.1 General

WFI is typically used in cleaning operations, and in the manufacture of inhaled products and injectable products. It is
a raw material, and therefore requires adequate testing to demonstrate quality and compliance.

2.4.2 Applicable Requirements

WFI, as defined by compendial monographs, requires compliance with specifications for chemical and microbial
quality. Chemical quality requirements are defined by conductivity and TOC specifications. Microbial requirements for
WFI are usually defined in published standards. Endotoxin limits are also applicable to WFI. Appendix 4 summarizes
the requirements for most of the major pharmacopeias.

WFI is the product of drinking water that has been pretreated and primary treated to meet the final required chemical
and microbial specifications. There is inconsistency worldwide about the allowed treatment techniques and the water
that may be used as the feed water to a WFI generation process. Europe [13], North America [12], and Japan [18]
allow for the use of non-distillation based techniques for the generation of WFI, and for the use of potable water as
the starting material. The Chinese Pharmacopoeia [19] specifies that distillation must be used with PW as the starting
material, but is currently considering allowing generation techniques other than distillation.

2.5 Pure Steam

2.5.1 General

Steam is classified as Pure Steam when it is intended to be used for direct and indirect product contact, for
sterilization of product or material, or for sanitization of surfaces.

2.5.2 Applicable Requirements

Pure Steam should meet the requirements of the applicable pharmacopeia (i.e., USP [12], Ph. Eur. [13]).

Many pharmacopeias do not include a Pure Steam monograph; therefore, often the relevant WFI monograph
specifications are applied. These are, for instance, the requirements for the feed water, a built-in component to retain
droplets, and the required test parameters for WFI that may be tested on the Pure Steam condensate. Due to the
lethality of Pure Steam, culturing of microbial samples is not required, although endotoxin testing is required.

Pharmacopeias may not define certain parameters such as steam saturation, dryness, and non-condensable
gases; however, guidance is provided by the EN285 [20] and the British HTM 01-01 Part C [21] standards. It is
recommended to conduct a risk analysis that includes specifics related to these qualities. EN285 may support a
decision as to whether or not these parameters are applicable, and to define limits and test procedures.
Page 16 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

The testing for steam quality is most often done at the POU to an autoclave unit and requires specialized test elbows
and equipment. If future quality testing is likely, considerations during the design phase should be made to provide
the necessary spool pieces.

2.6 Clean Compressed Air

2.6.1 General

Compressed air intended for use in product-impact applications include:

• Steam sterilizer overpressure

• Pressure equilibration after steam sanitization of piping and equipment

• Transfer of product

• Blow down of equipment after clean in place/steam in place for drying

• Air supply to fermenters

In addition, compressed air is used whenever there is air contact with a product-contact surface not cleaned in a
subsequent operation, and in all classified manufacturing space into which the process compressed air is exhausted.

Compressed air may be obtained in cylinders based on volume needs, although it is typically produced on site using
compressors. This puts it into a category different than most other gases and justifies its description separate from
other gases.

2.6.2 Applications

Some pharmacopeias include monographs for medical air. Standards such as “breathing air” (for example, the NFPA
99 Standard [22]) are available. ISO 8573 [23] is sometimes employed by manufacturers as a standard.

In most cases medical grade gases are not required in pharmaceutical manufacturing since medical gases and
breathing gases are typically intended for direct use by people or animals. The gene and cell therapy medicines
industry along with biotechnology manufacturing utilize medical gases and process air for product contact.

When used in a pharmaceutical process with direct product contact, the purity requirements should be based on
product and process needs. These product requirements are usually defined in the manufacturer’s regulatory filings.

When applicable, preparation of a risk analysis is prudent.

It is generally accepted that a critical quality parameter for clean compressed air is the dew point/relative humidity
with the expectation that the level of humidity in the air will be non-condensable in the temperature ranges to which
the compressed air piping is exposed. Maintaining dryness essentially eliminates the possibility for microbial growth
since without water, bacteria are not able to reproduce.

In addition, requirements applied to environmental air can be used to support decisions documented in the risk
analysis. This is especially true in cases where the air is used and exhausted within a classified space. As such,
a reason for the decision on the maximum allowed amount of particles or microbes in the compressed air may be
based on Table 2.1.
ISPE Good Practice Guide: Page 17
Critical Utilities GMP Compliance

Table 2.1: Clean Room and Clean Air Device Classification

(Adapted from EU Guidelines to Good Manufacturing Practice Medicinal Products for Human and Veterinary Use,
Annex 1 “Manufacture of Sterile Medicinal Products” [24])

Classification Nonoperational Operational

Maximum permitted number of particles of tabulated size/m3 Maximum

allowed
amount
Grade ≥ 0.5 µm ≥ 5.0 µm ≥ 0.5 µm ≥ 5.0 µm of viable
microbes/m3

A 3 520 20 3 520 20 <1

B 3 520 29 352 000 2 900 10

C 352 000 2 900 3 520 000 29 000 100

D 3 520 000 29 000 * * 200

*Annex 1 does not have limits defined for these cases; nevertheless, it is recommended to determine limits
according to respective working procedures.

A risk analysis should consider the need for POU filters or decentralized filters for each production room, whether the
use of an oiler or other equipment necessitates the need for backflow prevention, and if air should be exhausted from
the room.

To adequately address compliance it may be necessary, confirmed by risk analysis, to monitor and record important
parameters from properly defined sampling points using proper equipment, such as instruments to measure particles,
humidity, oil, and temperature, as well as a system and procedure to test for microbes. Often the limits in ISO 8573
[23] are applied for humidity and oil content testing.

It is ultimately the responsibility of the user to determine the needs for their product and situations. This should
consider and document the requirements of the product and appropriate and applicable regulatory requirements
respective limits and tests as necessary.

During the risk analysis, it may be appropriate to evaluate the origin of the compressed air, how it is produced, why
compressed air is being used, critical characteristics/quality of the compressed air and why they have been defined
(as applicable), which parameters will be tested and why, where filters are installed in the system, which parameters
to control, precision of instruments, redundancy of measurements, recording of data, etc.

2.7 Process Gases

2.7.1 General

High purity gases intended for product-impact applications (except clean compressed air) include nitrogen, oxygen,
carbon dioxide, and other suitable gases, or combinations of these gases. Often, compressed or liquid gases (e.g.,
nitrogen, oxygen) are delivered by external manufacturers. Bulk high purity gas supply systems may be equipped
with backup bottles for critical uses. Care should be taken when automating these backup systems so that the
manufacturer is notified (for example, an alarm is triggered) when the backup bottles have been engaged/used. In
such an event, the batch production record should indicate the use of the bottles. Bottles should receive a similar
level of scrutiny as other raw materials.
Page 18 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Common applications for these gases are:

• Blow down for drying pipes and equipment

• Tank sparging (including fermentation and cell culture)

• Incubation

• Tank blanketing and transfer overpressure

Many points mentioned in Section 2.6 for clean compressed air also apply to other gases wherever there is direct
product contact (including containers and closures) or contact with a product-contact surface not cleaned in a
subsequent operation, and in all classified manufacturing space into which the process compressed air is exhausted.
The gene and cell therapy medicines industry along with biotechnology manufacturing utilize medical gases and
process air for product contact.

2.7.2 Applicable Requirements

Some pharmacopeias include monographs for medical gases, such as the USP [12] and Ph. Eur. [13], however, the
test parameters and limits given in these monographs are intended for gases for use in patients. This is normally the
application with the most stringent requirements. See Table 2.2.

Table 2.2: USP [12] or Ph. Eur. [13] Specifications for Oxygen, Nitrogen, and Carbon Dioxide

Oxygen Nitrogen Carbon Dioxide

Test Specifications Test Specifications

Purity 99% weight/ 99% w/v N2 Purity 99% w/v CO2

volume (w/v) O2
Water ≤ 150 mg/m3
Carbon Dioxide ≤ 0.03% --
Ammonia ≤ 0.0025%
Oxygen -- ≤ 20 ppm
Hydrogen Sulfide ≤ 1 ppm
Carbon Monoxide ≤ 0.001% (10 ppm) ≤ 0.001% (10 ppm)
Nitric Oxide ≤ 2.5 ppm
Odor None Detected None Detected
Carbon Monoxide NMT 0.001%
w/v: Weight/Volume (10 ppm)
NMT: Not More Than
Nitrogen Dioxide ≤ 2.5 ppm

Sulfur Dioxide ≤ 5 ppm

Odor None Detected

w/v: Weight/Volume
NMT: Not More Than

If these gases are intended to be used during a pharmaceutical process such as tank sparging, the compendial
requirements may not apply completely. In specific applications (such as nitrogen in API production produced using
pressure swing adsorbers) purity requirements may be relaxed based on the needs of the process. A documented
rationale should be provided for the parameter limits selected.

Suppliers of gases used in processes should be governed by quality agreements, and included in the organization’s
supplier qualification and supplier audit programs.
ISPE Good Practice Guide: Page 19
Critical Utilities GMP Compliance

Gas bottles should be traceable, with the necessary documentation and labeling5 provided by the vendor.

It is ultimately the responsibility of the user to determine the needs relative to their product and situation. This should
be based on a risk analysis considering the requirements of the product and applicable regulatory requirements, and
including respective limits and tests as necessary.

During the risk analysis, it is recommended to evaluate:

• The origin of the medical gas

• How it is produced (its source)

• Why the particular gas is being used

• What the critical characteristics/quality of the gas are and why they have been defined (as applicable)

• Where filters are installed in the system

• Which parameters will be tested and why

• Which parameters will be controlled

• What instrument precision is needed

• How the redundancy of measurements will be achieved

• How data will be recorded

Additional points to consider are:

• Monitoring requirements and frequency for process gases, which should be appropriate for the products/
processes that they are used to support

• Definition and rationale for managing Out of Specification (OOS) results of any of the monitored parameters

• Definition and rationale of how and when filters are to be replaced

5
Purchased gases should have an identification number, a material specification, vendor certificates, and should be supported by audit data and
receipt testing.
ISPE Good Practice Guide: Page 21
Critical Utilities GMP Compliance

3 Validation Lifecycle and Quality Systems

This chapter outlines the elements required to maintain the CU systems in a continually validated state, and the
requirements of the quality systems to support this validated state. These elements are often reviewed by an auditor
during regulatory inspections.

3.1 Validation

The topic of validation is well addressed through both the ISPE Baseline® Guide: Volume 5 – Commissioning
and Qualification [2], and the ISPE Good Practice Guide: Approaches to Commissioning and Qualification of
Pharmaceutical Water and Steam Systems [25].

Within the context of this ISPE Good Practice Guide: Critical Utilities GMP Compliance, validation documents
should be presented to address the request or question specifically. They should show integration with the required
elements, including risk assessment, drawings, change control, and calibration and PM programs, to demonstrate
that the validated state of this system is controlled and maintained through these ongoing quality processes.

Fundamentally, the presentation of CU validations in an inspection should demonstrate the assessment of risk to
establish the validation scope and sampling plans, qualification of the equipment included within the scope, and
documented verification of system performance to predetermined acceptance criteria when operated using approved
procedures and materials within normal operating conditions. Variables and sampling plans to consider during the
validation are derived from the risk analysis and documented in the validation protocol and report. Verification of
calibration, PM, document and drawing change control, and equipment change control should be in place prior to the
closure of validation to maintain the validated state going forward.

Validation efforts should always be presented with the linkages to these systems in mind so that as an inspector
moves through a validation, the anticipated supporting systems described above are also available for review.

While most regulators have not codified what constitutes the requirements for commissioning, qualification, and
performance/process validation, enough best practice documents and regulatory guidances exist to establish basic
rules for the validation process of CU. Typically in CU, some aspects of the design are commissioned through Factory
Acceptance Testing (FAT) and/or Site Acceptance Testing (SAT), or drawing walk downs of installed piping. All other
testing is done using Installation and/or Operational Qualification Protocols (IQP, OQP, and/or IOQP), and where
required, Performance Qualification Protocols (PQP).

Any new CU installation or significant modification should begin with a validation plan and end with a detailed
validation summary report accompanied by a requirements traceability matrix.

3.1.1 Validation Plans for Critical Utilities

The validation plan should describe the system and incorporate a risk assessment process based on product
quality.6 It should lay out what activities will be performed in each stage of testing: commissioning, qualification, and
performance/process validation. The intended use of the CU should be clearly defined, so that an auditor reviewing
the validation plan can formulate what minimally should be tested. Where the CU installation or modification is part of
a larger design or site modification, it may be advantageous to develop a sub-plan for certain CU, such as PW, WFI,
or process gas systems in the validation plan. This sub-plan or project plan is desirable because often at the time of
initial design, the role of suppliers and supplier documentation in the validation of PW or WFI systems is not known.
A sub-plan can prevent the need to completely remodel the more encompassing validation plan, and can provide an
abridged package that can be presented to an auditor.

6
This is outlined in the ISPE Baseline® Guide: Volume 5 – Commissioning and Qualification [2].
Page 22 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Approval of the validation plan’s acceptability should be obtained from the system users’ management. Typically,
these approvers are production/packaging operations, laboratory management, Engineering, Automation/IT, and the
site Quality Management representative.

The plan should describe how commissioning documentation will be used, as well as what testing data will be
leveraged from FATs and SATs. Leveraging vendor FAT and SAT documentation decreases the build-to-in-operation
time.

The validation plan should define the system deliverables. Typical system deliverables for CU are:

• Validation Plan

• Users Requirements Specification

• System Risk Assessment

• Functional Requirements Specification or Detailed Design Specification

• Testing Protocols

• Procedures

• Training Plan

• Release Requirements

The development of a list of procedures required for the system to become operational can be beneficial early in the
lifecycle. These procedures include Standard Operating Procedures (SOPs) for operation, maintenance, sampling
and testing plans, trend analysis, and investigations. Some of these documents may form part of subsequent
qualification activities.

3.1.2 Commissioning Documentation

Typical commissioning documents include any FAT or SAT. Typically FAT and SAT is only on the vendor-supplied
automatic equipment and liquid storage tanks, but can include the distribution system components.

Additionally, some firms prefer to include verification of piping in a commissioning document. A walk down of the
piping to verify isometrics and slope should be done; however, that can be done in a commissioning document or in
the installation section of the IOQP.

3.1.3 Qualification Documentation

Depending upon the size of the utility, there may be a combined Installation/Operational Qualification (IOQ) or
separate IQP and OQP. Splitting the IOQ into distinct protocols still requires that most of the IQ be completed before
proceeding to OQ. The depth of OQ will be a function of how much vendor FAT and SAT is going to be leveraged.
The goal is to not repeat testing done deemed acceptable, provided there is rationale through risk assessment
that the functionality will be transferred to the final installation site, and that the vendor documentation meets good
documentation practices. The decision and rationale should be documented and approved in the validation plan.

3.1.4 Performance/Process Validation

Depending upon the utility type, performance verification may be required. Direct impact utilities such as any
pharmaceutical grade water also require performance validation.
ISPE Good Practice Guide: Page 23
Critical Utilities GMP Compliance

Sampling during PQ is performed to demonstrate that compendial parameters are met, including TOC, Conductivity,
and microbial requirements. This sampling should be done according to a sampling plan. Guidance for the
development of sampling plans is explored in detail in the ISPE Good Practice Guide: Sampling for Pharmaceutical
Water, Steam, and Process Gases [3].

The same applies to product-contact gases. In aseptic processes, nitrogen and argon are commonly used as head
space gases in some parenteral filling operations. Compressed air may be used for cleaning in all dosage form
operations. If the gas is a product-contact or potential product-contact gas, some form of performance or process
validation should be defined. In the case of gases that disperse into classified spaces (ISO 5, 7, 8 [26] or EU A, B, C, or
D [24]), testing of the gases should also verify they meet the particulate counts and hydrocarbon content for the space.

Process verification is not required for ready-to-use bottled gases.

3.1.5 Lifecycle Validation and Revalidation

All CU should be part of the site’s periodic review process. This process should review all change controls and
Corrective Actions and Preventive Actions (CAPAs) associated with the system, as well as the routine monitoring of
sampling results, system performance trends, PM, and calibration metrics. The frequencies should be risk-based,
considering the potential for the system to impact product quality. The goal of the periodic review is to assess
what has occurred on the CU and determine if requalification, installation, and/or operational qualification testing
is required. An evaluation of whether additional qualification is required should be based on the summation of the
periodic review.

If the periodic review identifies risks as a result of system changes that were not fully mitigated through appropriate
documented testing, then a revalidation plan should be developed and executed to prove that the system remains in
a state of control.

3.1.6 Decommissioning and Retirement

Prior to the decommissioning process, the replacement utility should be in place and properly qualified to the site
procedure. Decommissioning CU typically is finalized by demolition of the replaced equipment. Change control should
be written and organized to ensure that the replacement utility is in place and properly qualified before beginning the
decommissioning process of the existing utility. It may be advantageous to establish a separate change control for
the replacement utility, which is closed out before opening the change control to retire the old utility. Decommissioning
activities should document the revision or cancellation of associated records, such as maintenance records, PM
records, calibration records, drawings, library files, and SOPs. In addition, calibration of critical instruments should
be completed prior to demolition, in order to confirm that the system met requirements at the end of use as well as to
close the calibration period.

3.1.7 Procedures

Typically, a CU minimally has the following procedures:

• SOPs

• Sampling and attributes testing procedures

• Maintenance procedures

They should be governed by the site’s procedures for change control, training, CAPA, deviation and investigation, and
validation/qualification. All procedures pertaining to the system should be documented in the IQ test procedure.
Page 24 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

3.2 Change Control

ICH Q10 states [27]:

“Innovation, continual improvement, the outputs of process performance and product quality monitoring and
CAPA drive change. In order to evaluate, approve and implement these changes properly, a company should
have an effective change management system.”

“The change management system ensures continual improvement is undertaken in a timely and effective
manner. It should provide a high degree of assurance there are no unintended consequences of the change.”

The main purposes of a change control process are to:

• Ensure timely and effective changes with a high degree of assurance that there are no unintended
consequences of the change.

• Use quality risk management to evaluate proposed changes.

• Evaluate proposed changes to the applicable marketing authorization. There should be an assessment to
determine whether a change to the regulatory filing is required under regional requirements.

• Ensure the change is technically justified by the evaluation of the appropriate expertise and knowledge from
relevant areas.

• Confirm that the change objectives were achieved and that they had no deleterious impact on product quality by
performing an evaluation of the change after implementation.

• Provide the traceability that all documentation (SOPs, maintenance plans, Process and Instrumentation
Diagrams (P&IDs), floor plans, automation test plans) reflect the future state of equipment following change
execution.

As outlined in the ISPE Baseline® Guide: Volume 5 – Commissioning and Qualification [2], some companies often
use an Engineering Change Management (ECM) system designed to capture changes that occur during initial
qualification phase (commissioning, IQ, and OQ) prior to releasing the system or equipment for PQ and subsequent
product use. The company’s quality system change control is used to capture any changes outside this scope. The
ECM may also be applied at the site level during subsequent lifecycle management of changes to noncritical aspects,
components, or functions (as determined and documented by a system risk assessment). It is important to ensure
that if this approach is used, the boundaries are clearly documented.

The main types of change control are:

• Document Change Control

Consists of the initiation of a document or modification of approved documents including SOPs, method of
analysis, format/labels, qualification and validation protocols, stability protocols, validation master plan, policies,
and guidelines

• Facility/System/Equipment Change Control

Consists of the planned modification/installation, major maintenance, removal/decommissioning of equipment,

utility, facility, and automation
ISPE Good Practice Guide: Page 25
Critical Utilities GMP Compliance

The following sections should be part of a proposed change:

• Subject: Describes the details about the change and the documents, facility, and procedures where change is
required.

• Proposed Change: Explains what is changing.

• Scope: Describes the department, equipment, document, and process name, along with the extent of change,
i.e., what the change is about.

• Reason for Change: This section describes why the change is proposed. It may include the implication from
other changes, GMP requirements, changes in regulations, addition/deletion of equipment, adoption of new
processes, test methods, protocols, gap analysis during scheduled revision, CAPA, customer complaints,
validation.

• Existing Procedures, Equipment, Facility Documents: This describes the current state.

• Risk Assessment: Describes the impact of the change on aspects such as products, processes, stability,
regulatory, validation, qualification, training, packaging materials, documents, and parameters, and should be
analyzed using a centralized approach (i.e., not confined to the particular system undergoing the change).
The analysis should focus on evaluating and, if possible, quantifying the risk. (Section 3.3 discusses risk
management techniques that may be applied.) Ensure stakeholders from affected departments are involved in
the assessment.

• Dates: Included here are the proposed implementation date of the change, the actual implementation date, and
the change control closure. Any extensions should be properly documented and evaluated.

• Effectivity Check: Confirm that the change objectives were achieved by developing a target or measure of the
change to prove that there was no deleterious impact on product quality.

• Attachments: Attachments should be identified, and approved properly.

3.3 Risk Management

ICH Q9 Quality Risk Management (QRM) [28] as well as ISO 14971 [29] serve as industry references for risk
management. Per ICH Q9:

“Two primary principles of quality risk management are:

• The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the
protection of the patient; and

• The level of effort, formality and documentation of the quality risk management process should be
commensurate with the level of risk.”

A compliant manufacturing facility continually assesses and manages risks to product quality with respect to the CU
from design, installation, ongoing maintenance, and routine monitoring. An effective QRM approach can facilitate
a better understanding of potential risks and provide regulators with a greater confidence of a company’s ability to
mitigate risk and accept any identified residual risks.
Page 26 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

The QRM process is used to:

• Identify and assess the risk associated with:

- The normal operation, for example identification and further risk management of starting material (such as
source water) attributes or critical process parameters

- The failure or potential failure of an operation, a system, or a process

• Determine control strategies to mitigate the identified risks and implement these strategies with the goal of
minimizing risk to the ultimate user of the product or output. The aim of QRM is to reduce risk to an acceptable
level; however, it is not always possible to eliminate risk entirely. Some residual risk may need to be accepted
and will depend on factors associated with each case.

• Document and communicate information about risk and risk management between the decision makers and
others throughout the QRM process.

• Review or monitor events for effectiveness of implemented control strategies.

The ISPE Baseline® Guide: Volume 7 – Risk-Based Manufacture of Pharmaceutical Products [30] describes
commonly used approaches to risk management that could also be applied to CU systems. These techniques allow
complex systems to be broken down and Critical Control Parameters (CCP) and Critical Quality Attributes (CQA) to
be established. There are a variety of risk analysis techniques that can be used to evaluate the system or process,
such as:

• Failure Mode Effect Analysis (FMEA) [31]

• Failure Mode, Effects and Criticality Analysis (FMECA)

• Fault Tree Analysis (FTA)

• Hazard Analysis and Critical Control Points (HACCP)

• Hazard Operability Analysis (HAZOP)

• Preliminary Hazard Analysis (PHA)

• Risk ranking and filtering

• Supporting statistical tools

The following are examples of risks to consider or often overlooked when reviewing CU systems across the lifecycle
of the system:

• A risk review of a CU may identify the need to monitor upstream noncritical parameters that can indirectly impact
product quality or reliability. Monitoring these noncritical parameters ensures both the quality of the water and
its continuity of supply. For example, alert and action limits should be established for both the water softening
(reliability) and deionizing (quality) steps.

• As outlined in Chapter 2, the quality of the municipal feed water should be fully evaluated. Variations in hardness,
alkalinity, Total Dissolved Solids (TDS), as well as the impact of seasonal variations (e.g., spring runoff or lake
turnover effect), are all factors that can impact the efficiency and performance of the utility system on an ongoing
basis and can help identify any control strategies that apply to each plant.
ISPE Good Practice Guide: Page 27
Critical Utilities GMP Compliance

• The accumulation of rouge in stainless steel piping is a well-known phenomenon in high purity process systems.
An evaluation technique like FMECA may identify the detectability, probability, and severity of the rouge to
determine the risk to patient and product. This could help identify an appropriate control strategy that could
factor in the risks of treating the rouge, such as chemical contamination or surface degradation. A monitoring and
derouging program may improve the detectability and reduce the risk to an acceptable level.

The implementation of the ICH Q3D guidelines on ‘Elemental Impurities Risk Assessment’ [32] has also placed
renewed focus on the quality of water used to manufacture drug products and its impact on product quality. A review
of these guidelines and their potential impact on the ongoing quality monitoring of the organization’s water systems is
recommended. Additional waterborne impurities for risk consideration are listed in Table 3.1.

A more in depth analysis of system attributes and trends can be executed as part of an annual review of the water
system, a critical component of any risk management program. System review and trending is further discussed in
Section 4.5.

Table 3.1: Examples for Impurities to Consider in Risk Mitigation

Impurity Discussion

Chlorine/Chloramines Chlorine/Chloramines must be monitored primarily for downstream equipment

protection as it will rapidly degrade Thin-Film Composite (TFC) membranes
in Reverse Osmosis (RO) systems, contribute to chloride stress cracking in
distillation systems, and degrade Electrodeionization (EDI) units

Total Organic Carbon TOC is measured as a reflection of the available food source for microbial
organisms

Microbial Contamination Microbial contamination is a direct measurement of water quality and can have a
direct impact on non-sterile products lacking downstream microbial control, and a
significant impact on sterile products

Endotoxins (for WFI) Endotoxins are a measurement of degraded proteins of the outer portion of Gram
negative organisms. Endotoxins in sterile products can cause direct harm to
patients, resulting in fever and unanticipated immune responses

Conductivity Conductivity directly measures the chemical purity of the water based on the
absence of ionic species

pH* pH is a direct measurement of the hydrogen ion concentration and represents the
acidity or alkalinity of the water

*The testing of pH is a requirement for China and Mexico, as outlined in their respective pharmacopeias. Refer to
Appendix 4.

3.4 Drawings and Documentation

From a regulatory perspective there are no direct references to drawings as being explicitly required; however, they
are understood to be part of the system design and qualification documentation.

EudraLex Volume 4, Annex 15: Qualification and Validation [33] states:

“IQ should include, but is not limited to the following:

Verification of the correct installation of components, instrumentation, equipment, pipe work and services against
the engineering drawings and specifications.”
Page 28 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

The PIC/S Aide-Memoire, Inspection of Utilities [34], also specifies that pharmaceutical water systems
documentation, which includes drawings, is required to be up-to-date.

CU systems present a high level of risk to product; therefore, there are high expectations regarding the level of
documentation and risk management. Drawings are one form of this documentation.

3.4.1 Context of Drawings

Drawings are clearly understood to be important during the design, construction, and verification of a system (refer to
ISPE Baseline® Guide: Volume 5 – Commissioning and Qualification [2]). The importance of the system drawings is
seen throughout the lifecycle of the system for multiple reasons, including training, change control, and operation.

There are several categories of drawings important for different reasons. These must be kept current and should
include any changes made. In order of importance (from a regulatory perspective):

1. Process Drawings

a. The recommendation is that manufacturers use fully detailed and developed P&IDs, and use these drawings
to support their operations and inspections hosting.

b. Process Flow Diagrams may be used as an alternative to P&IDs; however, caution is recommended as
this creates a situation where the same content is covered on multiple drawings and both locations for that
content must be maintained.

2. Isometric Drawings and Distribution Piping Layouts

3. Electrical and Controls Drawings/Documents

As part of maintaining the system validated state, manuals, detailed equipment layouts, and general arrangement
drawings should be maintained as current and may be requested during an inspection.

When executing a system change (either planned or a corrective maintenance), one of the important activities is to
update the master drawing set to reflect the system change. Failure to do so is a failure to maintain the validated
state of the system (documentation of the system). All documentation related to a validated system should be suitably
controlled.

3.4.2 Master Set Drawings

The owner should maintain and control master drawings for their CU systems. The drawings should be an accurate
reflection of what is installed in the field, and as stated above, should be updated to reflect system modifications and
changes.

3.4.3 Piping and Instrumentation Diagrams

There are several GMP activities that are dependent on having accurate drawings. These activities are listed below in
order of importance from a regulatory perspective including recommendations for content on the drawings:

1. System Sampling and POU

a. Drawings should reflect the system POU and sampling points. They should be accurately represented on
drawings, both in quantity and in the location with respect to each other in the process flow. All sampling
points may not be routinely sampled. Refer to the ISPE Good Practice Guide: Sampling for Pharmaceutical
Water, Steam, and Process Gases [3] for sampling recommendations.
ISPE Good Practice Guide: Page 29
Critical Utilities GMP Compliance

Note: On/at line measurements for TOC and conductivity are considered samples and must also be shown
on drawings. If employed, rapid microbiology, endotoxin, or other measurements should also be shown.

b. Generally the interconnecting POU piping is not shown on the water system drawings, although the ISPE
Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3] identifies this
piping as being within the system boundary for the water system. Best practice is for the water system
drawing to show off-page connectors that reference the drawing number where the piping can be found
and possibly notes indicating that the sampling valve is shown on another drawing. See Figure 3.1 for an
illustration of this drawing practice.

Figure 3.1: Loop Valve to POU Off-Page Connection Sketch

Courtesy of Cheme Engineering Inc., https://www.cheme.ca/.

c. Other key instrumentation should be shown

i. Loop return pressure: this measurement is used to demonstrate that the loop is adequately pressurized
at all times, ensuring that water flows out of the loop and risk of contamination ingress is low.

ii. Loop temperature: this measurement is used to demonstrate controlled temperature at the end of the
loop in the water distribution system (minimum temperature for hot distribution systems, maximum
temperature for cold distribution systems).
Page 30 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

iii. Instruments that demonstrate sanitization

1) Temperature for heat-based sanitizations and other process temperature requirements

2) Dissolved ozone (for systems utilizing ozone sanitization)

A. An ozone sensor may be required on return to the loop for sanitization process. Grab
samples using a hand-held device may also be acceptable provided adequate procedures are
documented and executed.

B. An ozone sensor may be required after the loop Ultraviolet (UV) unit to demonstrate that ozone
is removed. See the ISPE Baseline® Guide: Volume 4 – Water and Steam Systems [4], and ISPE
Good Practice Guide: Ozone Sanitization of Pharmaceutical Water Systems [35] for details.

iv. Other important instruments (refer to the ISPE Baseline® Guide: Volume 4 – Water and Steam Systems
[4] for more detail)

1) Flow, if used, verifying delivery of water or confirming velocity

Note: Flow is not always required

2) Tank level used for process control

3) Burst indication – rupture disc integrity/tank contents

4) Vent filter temperature

2. SOP and Maintenance Execution

a. Components on drawings should be identified (on the drawing and in the field) using a tagging/numbering
system that provides a unique identifier to each component. This aids in locating devices to allow correct
execution of SOPs and PMs.

b. Sanitary clamps should all be shown (on P&IDs or on isometric drawings) or enumerated to facilitate change
out of gaskets for maintenance.

3. Training

a. System P&IDs should be used as a part of the staff training program, as the P&ID provides a map of the
entire process, and aids in understanding the operation of the system and its interconnectedness with other
systems. This training should start with the high level drawing, which also is used to support inspections.

4. Calibration

a. P&IDs that are well tagged, combined with field devices that are properly tagged, help to minimize the risk
of calibration mix ups. This can also be a safety issue if the incorrect (and possibly in service) instrument is
erroneously removed for calibration.

Level of Detail on P&IDs

During a regulatory inspection, it is recommended that drawings be made available for review with the inspector
as an overview of the system. The primary recommendation is that system P&IDs be used for this purpose. It is
recommended that the P&ID be printed in both a full size format and on tabloid size paper for portability.
ISPE Good Practice Guide: Page 31
Critical Utilities GMP Compliance

The superior approach to P&ID content is for the drawing to provide full details of the process showing sampling
valves, isolation valves, gauges and electronic instruments, connection to control systems, control loops, etc. It is
recommended that the competency level in the organization be developed such that understanding and maintenance
of drawings with this level of detail is possible.

There is an alternative and minimalist approach with respect to how much detail to put on a P&ID that will meet the
basic quality requirements/compliance. This approach may be desirable for a smaller manufacturer with a small
document management system. The minimalist approach is to only show the following on the P&ID:

• Major unit operations

• Sample points, including online instruments (TOC, conductivity/resistivity)

• POU

The disadvantage of this approach is that the missing details are not captured on the drawing and, from an
engineering perspective the drawing is of greatly reduced usefulness in training on the system, troubleshooting,
executing maintenance, and various other ways.

However, another suitable approach is to have a summary level drawing available to provide an overview of the
system from a lay-person’s perspective; a process flow diagram is a good level of drawing for this purpose. This
drawing should be formatted to fit onto a portable print format (letter or tabloid size preferable) to allow for review in
the field.

All of these drawings must be part of a change control system and properly managed, and printed to ensure that the
most current drawings are viewed, used, and shown during an inspection.

3.4.4 Isometric and Piping Layout Drawings

As a matter of Good Engineering Practice (GEP), isometric drawings and piping layouts are useful to ensure piping
can be found and modifications can be done accurately. After modifications are made these drawings should be
updated.

If the facility is in a seismically active area and/or system drainability is critical (for systems routinely chemically
sanitized), periodic reverification of slopes is advisable and can be documented on the isometric drawings.

When PM for replacement of sanitary clamp gaskets is employed, these drawings are useful in locating joints,
particularly ones that may be outside the main mechanical room.

3.4.5 Electrical Drawings

Electrical drawings are not often requested by auditors, but as a matter of GEP with respect to system maintenance,
are useful in support of calibration, troubleshooting, and reactive maintenance where component replacement is
required. Components within electrical enclosures are not always individually tracked in maintenance systems.
Drawings related to instrumentation, process control (PLCs), and access to the equipment (HMIs) require particular
attention. When not in a computerized system, the electrical drawing Bill of Material (BOM) is the only record of what
is actually in the panel, and what the specifications for a replacement component should be. Likewise, drawings
related to instrumentation, process control (PLCs) and access to the equipment (HMIs) can be useful and are
suggested to be kept up-to-date and available during an inspection.
Page 32 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

3.5 Investigations and Corrective Actions and Preventive Actions

Per ICH Q10 [27]:

“The pharmaceutical company should have a system for implementing corrective actions and preventive actions
resulting from the investigation of complaints, product rejections, non-conformances, recalls, deviations, audits,
regulatory inspections and findings, and trends from process performance and product quality monitoring. A
structured approach to the investigation process should be used with the objective of determining the root cause.
The level of effort, formality, and documentation of the investigation should be commensurate with the level of
risk, in line with ICH Q9. CAPA methodology should result in product and process improvements and enhanced
product and process understanding.”

During routine operation of any utility system, unpredictable anomalies may occur. These occurrences may be related
to the water quality (exceeding the alert or action levels for microbial counts (see Section 4.2), TOC, conductivity,
etc.), equipment (e.g., mechanical failures), or to operation of the system (e.g., missed calibrations, power outages).
All of these anomalies should be reviewed and, when appropriate, investigated to assess product impact and
determine the root cause, and when possible and reasonable, actions taken to prevent recurrence. The investigation
should include an assessment about whether the issue is isolated or a recurring problem. The status of actions from
similar issues should be reviewed in the investigation for recurring issues. The investigation and any actions taken
should be well documented.

ICH Q7 Section 2.16 [5] also requires that:

“Any deviation from established procedures should be documented and explained. Critical deviations should be
investigated, and the investigation and its conclusions should be documented.”

It is not uncommon for companies to receive observations from regulators for failure to follow their own procedures, or
failing to investigate when it is detected that the procedure was not followed. Care should be taken when procedures
and logs are developed to ensure that requirements are clear and that there is a distinction between items that
are not critical to quality, (e.g., differential pressure, level control) and the items that indicate a critical quality issue
(such as exceeding a Quality Control (QC) microbiological limit). The organization may know the difference, but
that difference may be less apparent to the inspector if the governing procedure is not clear. A description of these
differences with respect to different reasons for sample collection can be found in the ISPE Good Practice Guide:
Sampling for Pharmaceutical Water, Steam, and Process Gases [3].

Some companies manage the difference in investigation of critical and noncritical items by categorizing the issues.
Exceeding a limit on a noncritical measurement might only be recorded as having occurred and be acknowledged
by the quality unit. Exceeding a specification at the conclusion of a planned shutdown during return to service
activities (but where production has not yet begun, so there is clearly no impact on any product) might be elevated to
a deviation investigation. Exceeding that same specification during routine production might involve the use of more
formal root-cause analysis tools or a higher level of approval on the final investigation.

3.5.1 Handling Out of Specification (OOS) Events

3.5.1.1 Defining an OOS Event

An investigation should occur every time an OOS result is received for a grab sample from the utility system, or
when the specification is exceeded during the use of online monitoring to show compliance to the specification.
Systems should be in place to notify the appropriate personnel in the event of an OOS result. For grab samples, the
LIMS should be set to test the sample result against the specification and notify the user of any failure. When online
monitoring instrumentation is used, the associated automation system can be configured to alarm at the appropriate
value.
ISPE Good Practice Guide: Page 33
Critical Utilities GMP Compliance

USP <1231> Section 9.4 [36] contains suggestions for how to properly implement alert and action levels, and how to
respond if those levels are exceeded.

3.5.1.2 Trends

Trends such as repeated alert-level excursions or warning alarms may also be encountered. These types of trends
should be investigated similarly to OOS events, although it is typically not necessary to assess product impact
because no specification or critical alarm limit has been exceeded.

3.5.1.3 Investigations

EU GMP Chapter 1 Section 1.8 (vii) [37] requires that:

“Any significant deviations are fully recorded, investigated with the objective of determining the root cause and
appropriate corrective and preventive action implemented.”

An investigation should identify the cause of the issue and provide the rationale for CAPAs. It should be
comprehensible, traceable, and well documented to ensure that the circumstances can be well communicated upon
request. It should be clear what was included in the scope of the investigation, and if any items were specifically
excluded and why. Root-cause tools, for example, 5 Whys/Kepner-Trego Analysis (KTA)/Cause and Effect Analysis
(5M+, Fishbone, or Ishikawa Diagram)/FMEA, etc., should be used, particularly for more complicated investigations.
The investigation should include a review of past investigations for recurrence over a relevant period of time, typically
12 months unless, for example, if the issue is seasonal, in which case the time period may be longer.

Investigations should be science-based, meaning that they should start with a problem statement (defining also the
boundaries of the investigation) and one or more hypotheses that should be proved or disproved.

Factors to consider during the investigation are listed below (not a comprehensive list). Not all of these factors will
need to be considered for every investigation, but the appropriate ones should be applied based on the issue.

Environment:

• Was nonroutine work occurring in the area?

Equipment:

• Is instrument failure or calibration drift related to the issue? Power related?

• Was nonroutine work being performed on the system?

• Were maintenance interventions and recovery carried out correctly (even if routine)?

• Have there been changes, such as idling of an area or piece of equipment, that may contribute to usage patterns
or the sampling environment?

• Is the use point or sampling outlet retaining water due to improperly sloped piping, surface tension in a narrow
tube, or improperly sized gaskets being installed?

• If hoses are used at the outlet, are they treated correctly (disconnected after use, sanitized/drained/dried if
reusable)?

• Is product impacted? Product made since the last passing sample should be evaluated. The product-impact
assessment is generally limited to product made using the specific outlet involved with a microbial failure, but is
generally expanded to assess all products supplied by a loop or system for chemical failures.
Page 34 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

• Should additional samples be collected as part of the investigation or to show that the system has returned to
normal? Is additional sampling part of an approved SOP or do the additional samples need to be preapproved by
the quality unit?

• For microbial failures, was the organism identified? This can help determine the root cause of the failure
(organisms intrinsic to the water system versus external contamination of the sample) and may also be useful for
the product-impact assessment.

Personnel:

• Is sampling error a concern?

- Was good aseptic technique used?

- Was the correct outlet/utility/system sampled (potable water versus purified)?

- Is it possible that the sample was contaminated, such as if the same hose could be used for both potable
and PW in the same area?

- Was the sampling procedure followed correctly (any required outlet flushing, cleanliness of any hoses or
accessories)?

• Is laboratory error a concern? It is typical for analytical laboratories to conduct an investigation for each failing
result that is generated to ensure that there is no obvious laboratory cause for the failure.

• If personnel errors become a recurring theme during investigations, is the training program adequate? Are the
SOPs clear and accurate?

A product risk assessment should be conducted as part of the investigation. This must assess the impact of
specification excursions on products associated with the water around the time of the excursion. A product can be
associated with the excursion if the water was used as an ingredient or if the water was used to clean the equipment
used to manufacture the product. The assessment should include a discussion of any processing conditions that
may impact the specific excursion (extremes of pH, toxic ingredients, or low water activity in the event of a microbial
excursion, for example). The assessment should also include the impact of any specific organisms identified from
microbial results. This assessment should conclude with a statement indicating that the product is either fit for use or
being rejected and whether a product recall is warranted.

The investigation should be completed in a timely manner in accordance with site procedures and the associated risk.
After the investigation, consideration should be given to how the issue will be presented during an audit. Complicated
investigations may benefit from supplemental materials such as story boards or concise presentation slides. The
visual tools utilized during formal root-cause analysis activities (e.g., fish bone) are frequently good additions to these
presentations. The subject matter expert who will discuss the investigation with the auditor should have thorough
knowledge of the investigation, and may benefit from a practice audit with personnel not directly involved in the initial
investigation during a site self-assessment.

A complete list of all investigations for the system over a period of time (typically 2 years or since the end of the last
inspection) should be continuously controlled and ready at the start of the inspection. Some companies may maintain
a list of investigations on an ongoing basis, and others may use their investigation tracking system to generate such
a list on demand. Personnel should refresh themselves on the complicated investigations prior to the inspection when
possible.
ISPE Good Practice Guide: Page 35
Critical Utilities GMP Compliance

3.5.2 Corrective Action and Preventive Action Management

CAPA are required throughout the pharmaceutical and medical device regulations. ICH Q10 Section 3.2.2 [27] states
that:

“The pharmaceutical company should have a system for implementing corrective actions and preventive
actions...CAPA methodology should result in product and process improvements and enhanced product and
process understanding.”

21 CFR 820.100 [38] states that:

“Each manufacturer shall establish and maintain procedures for implementing corrective and preventive
action. The procedures shall include requirements for:...Identifying the action(s) needed to correct and prevent
recurrence of nonconforming product and other quality problems.”

There are three types of actions that may result from an investigation: immediate actions, corrective actions, and
preventive actions.

Immediate actions are taken when the event occurs to return the system to normal. Examples include restarting the
system if it is off and sitting stagnant, outlet flushing, extra sanitization, and replacement of worn/damaged/incorrect
parts. Consideration should always be given to whether extra sampling is required to verify that the system has been
returned to a state of control. An immediate action may also be required with regard to protecting patients (e.g., recall
of potentially affected finished product batches) based on risk assessment to patient safety.

Corrective actions are defined by ISO 9000:2015 [39] as those actions taken:

“to eliminate the cause of a nonconformity[…]and to prevent recurrence.”

These actions should be based on the root-cause analysis portion of the investigation. Typical examples include:

• Adjustment of PMs (either tasks or frequency)

• Changes to the sanitization cycle (duration, frequency, or addition of flushing during the cycle)

• Addition or modification of alarm set points to provide earlier notification

Recurring issues may warrant more invasive corrective actions such as system design changes. Examples include
improved pressure control to manage several concurrent users, or the addition of a generation or polishing step such
as a UV light to limit microbial proliferation.

Preventive actions are defined by ISO 9000:2015 [39] as those actions taken:

“to eliminate the cause of a potential nonconformity[…]or other potential undesirable situation.”

These actions should be based on the root-cause analysis portion of the investigation, but applied to systems not
directly involved in the event. For example, if a firm has two similar water distribution systems at a site (routine
temperature, turnover, volume, etc., are similar), and a microbial problem is observed in one system that requires
an increase in the sanitization frequency to prevent recurrence, a preventive action to make a similar change to the
sanitization frequency for the other system should also be considered.

Regardless of the type of action, Quality approval is needed to fully close out the actions.
Page 36 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Checks to ensure the effectiveness of the CAPA should also be performed after a period of time that is sufficient to
detect recurrence of the issue. These checks might include retrospective analysis of sampling data or examination of
PMs to show a reduction in failures. These checks may happen quite a while after the investigation and corrective/
preventive actions are complete, so a robust tracking system must be in place to ensure these checks are performed
at the appropriate time.

As an example of how these items fit together, consider the case of a water distribution piping system with a blown
rupture disc. The immediate actions might include replacing the rupture disc, restarting and sanitizing the system, and
cleaning up any water spilled due to the burst disc. Corrective actions might include adjustments to how the system
pump ramps up in response to an increase in demand, or limiting the rate at which a large volume use point can
draw water to reduce the potential for water hammer in the distribution system. Preventive actions could be taken to
apply the corrective actions from this investigation to similar systems at the site. An evaluation of the loop pressure
readings from the data historian could be performed to show that the actions have reduced the pressure fluctuation
after a period of time that is sufficient to capture a variety of demands on the system.

The list of investigations (as described in Section 3.5.1) should include the associated CAPAs and effectiveness checks.
This can also be used to ensure that all CAPAs and checks are closed within the required due date or that due date
extensions have been properly documented, assessed for additional risk, and approved by Quality. Where possible,
all of the investigations, and resulting CAPAs and effectiveness checks should be closed prior to the inspection.

3.6 Sampling and Testing

Sampling and testing are always fertile territories for GMP deficiencies. Although sampling and testing practices could
apply to finished products, in-process intermediates, raw materials, and compressed gases, this section focuses on
water system sampling and testing. Of all the on-site utilities present in a manufacturing facility, it is the water systems
that could have the greatest impact on finished products because of their potentially dynamic and sometimes difficult-
to-control fluctuations in quality, requiring close monitoring to ensure acceptability.

The ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3] is a good
reference for practical guidance on how to implement sampling programs to help ensure regulatory compliance.
Ongoing sampling (i.e., after completion of PQ) is typically planned based on the results in the PQ, with adjustments
to frequency based on the risk level of the utility.

3.6.1 Sampling Ports and Points of Use

A common source of confusion in sampling is the purpose of the sample location from which results are obtained.
In the absence of differentiation from the system owner, sample results are often treated as all being QC based.
There are several other reasons for which sampling is conducted: process control, and diagnostic testing being the
other primary reasons. A sampling program that defines the rationale for specific sampling locations should be in
place and available for discussion with an auditor. Typically, this sampling program also provides the documented
rationale for the limits in place for the various parameters at their locations. The ISPE Good Practice Guide: Sampling
for Pharmaceutical Water, Steam, and Process Gases [3] provides detail on sampling plan development and
implementation.

When sampling for QC purposes from POU, the correct sampling process is to take water from the end of that
delivery train in exactly the same manner as manufacturing uses it – same hose, same outlet sanitization and flushing
practices as manufacturing uses (if any), plus the same flow meters, same heat exchangers, etc. The intent is to
exactly duplicate the quality of water that manufacturing is using.

If the sampling process does not match the routine water use process (e.g., using sterile hoses for sampling but
manufacturing does not; or vigorously flushing before sampling where manufacturing does not flush before water
use), then the sample’s microbial counts do not reflect the water routinely used. Such a sampling process is not GMP
compliant for QC sampling. Additional information is given in Appendix 3.
ISPE Good Practice Guide: Page 37
Critical Utilities GMP Compliance

Sampling Maps and Charts

It is necessary to have adequate controls to ensure a sampling plan is defined and followed. The plan should include
information about what outlets are sampled on which days. Furthermore, drawings should be available showing
where the outlets are located. A map of the outlet locations in the facility along with the most expeditious routes to
take for collecting samples may be of advantage, useful as an effective employee training aid and reference, and can
simplify the review for an inspector.

Sample plans, drawings, maps, and other necessary sample information can be part of the site’s sampling SOP, but
other kinds of documents are sufficient.

Sometimes, the official outlet numbering system is cumbersome, creating a tendency to establish a simpler unique
outlet numbering system for the samplers and associated data. This should be avoided if possible, since it creates
the need for double labeling outlets with the engineering number and the laboratory number. A table or legend to
correlate the two sets of outlet numbers is needed when, for example, only the laboratory numbers appear in data
trends and only the engineering numbers appear on site drawings. It is best to eliminate ambiguity by using one set of
outlet numbers in both sampling charts and maps, as well as generated data and data trends.

3.6.2 Microbial Testing of Water Samples

Care must be taken that the established testing meets the requirements of the applicable pharmacopeia. In the case
that an approach with adapted test procedures has been adopted, it must be proven that these procedures are at
least as reliable as those described by the pharmacopeia. Discussion of considerations such as selection of nutrient
media, incubation temperature, and incubation time can be found in Appendix 5.

3.6.3 Rapid Microbial Methods

The ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3] contains a
comprehensive discussion on the applicability of rapid microbial monitoring to sampling. The discussion below does
not include rapid endotoxin testing, which is adequately addressed in the ISPE Sampling GPG.

Rapid microbial monitoring is any technique that provides data more quickly than standard plate count methods,
whether in half the normal time or closer to instantaneous. Rapid microbial monitoring can be used off-line on grab
samples or online. Online rapid microbial monitoring is presently deployed as a process control tool/measurement
to provide more timely information about the state of control of a water distribution system (not POU) compared to
traditional plate count methods that require several days to enumerate. Some of the benefits presented by an online
process control rapid microbial monitoring method are:

• To rapidly identify sudden microbial upsets

• To monitor long-term, slow changes that are not easily observed by plate counts

• To identify the need for component service or sanitization

• To provide added confidence to produce water after a shutdown/restart, with less risk, without waiting days for
microbial test results

• To open up possibilities for reduced QC sampling

Page 38 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Since many of the most rapid techniques are destructive or do not capture the microorganisms for further study, they
do not allow for identification and speciation of a detected microorganism. Also, these online methods are typically not
deployed at points of water use. Therefore, use of this technology as a QC tool/method for compendial water has not
yet been adopted by the industry. The determination of the species of bacteria present is critical to understanding if a
water system is compliant for use in products where certain bacteria could be considered objectionable. For example,
Ralstonia pickettii could be considered objectionable in some non-sterile liquid product applications while for oral solid
dosage forms, it is typically not considered objectionable because the product processing and its dryness usually kills
the organism.

However, this technology provides great value for process control purposes and may, in the future as the technology
evolves, become a valuable QC tool. There is current regulatory guidance on the expectations of the technology and
its deployment in the following references:

• USP <1223> “Validation of Alternative Microbiological Methods” [40]

• Ph. Eur. Chapter 5.1.6 “Alternative Methods for Control of Microbiological Quality” [41]

• PDA “Evaluation, Validation and Implementation of Alternative and Rapid Microbiological Methods,” Technical
Report No. 33., Revised 2013 [42]

In order for rapid microbial monitoring technologies to replace traditional plate count techniques, it is necessary to
prove that the results of the rapid microbial monitoring are at least as reliable and informative as the results of the
laboratory tests referenced by the pharmacopeia. Further information about this topic can be found in ISPE Good
Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3].
ISPE Good Practice Guide: Page 39
Critical Utilities GMP Compliance

4 Ongoing Operations
4.1 Data Integrity, Handling, and Automation

Process utilities have direct product contact or indirect contact via product-contact equipment surfaces, such as
during cleaning. This leads to the necessity for pharmaceutical manufacturers to clearly design and control the
generated or processed data from CU systems7, which is subject to data integrity. Process utility data is often trended
and evaluated by the quality unit as part of routine batch release and investigations. The trueness of the process
system data is just as important as the data associated with product release.

This is underscored by the focus given by regulatory bodies worldwide on the handling and integrity of GMP-critical
data during inspections [43, 44, 45]. Numerous warning letters and noncompliance letters have been issued due to
falsified data. See Section 6.8 for an example.

Regulatory documents worldwide describe the requirements to achieve data integrity. The most recognized ones are:

• 21 CFR Part 11 (US) [46]

• FDA Guidance for Industry: Data Integrity and Compliance with Drug CGMP Questions and Answers (US) [47]

• EU GMP Guidelines Annex 11 (EU) [48]

• MHRA ‘GXP’ Data Integrity Guidance and Definitions (United Kingdom) [49]

• WHO Technical Report Series, No. 996, Annex 5: Guidance on good data and record management practices
(International) [50]

• PIC/S Draft Guidance: Good Practices for Data Management and Integrity in regulated GMP/GDP Environments
(International) [51]

• Aide Mémoire 07121202 der ZLG (Annex 11): Überwachung computergestützter Systeme (Germany) [52]

Additionally, ISPE has publications to help firms ensure the integrity of their data:

• ISPE GAMP® 5 Guide: A Risk-Based Approach to Compliant GxP Computerized Systems [53]

• ISPE GAMP® Guide: Records and Data Integrity [43]

• ISPE GAMP® RDI Good Practice Guide: Data Integrity – Manufacturing Records [45]

One thing these regulations, standards, and industry guides have in common is the ALCOA+ principle:

• Attributable

• Legible

• Contemporaneous

• Original

• Accurate

7
Refer also to 21 CFR Part 11.30 [46].
Page 40 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Plus:

• Complete

• Consistent

• Enduring

• Available

When these key concepts are applied to each identified type of GMP data over its lifecycle, a methodology can be
developed to be fully compliant. ISPE GAMP® 5 [53] offers a systematic approach to help organizations comply with
regulations.

To ensure data integrity during the design and later during the lifecycle of a utility system, it is necessary to judge the
criticality and the complexity of the system. The categories presented in the ISPE GAMP® 5 [53] can help to classify
the system. As pharmaceutical utility systems often consist of several different pieces of computerized equipment, it is
helpful to describe the data flow of the entire system. An example for a water system is shown in Figure 4.1.

Figure 4.1: GMP-Critical Data Flow in a Critical Utility

To begin to apply the ALCOA+ attributes, it is important to differentiate between raw data and metadata [47, 49].
ISPE Good Practice Guide: Page 41
Critical Utilities GMP Compliance

Raw data is considered as the first data generated and usually directly describes the quality of a product, such as
data generated during manufacturing operations or analyses. Examples for raw data are:

• Measurements of Critical Process Parameters (CPP) or CQA

• Entries in a batch record (usually not existing in any utility system)

Metadata is defined as “data about data” hence, data that is necessary to understand the raw data. Examples for
metadata are:

• Units

• Log files

• Audit trails

• Parameters

• Limits

• Access lists

• Software

It is important to understand that the metadata must follow the same principles and requirements as the raw data
[51], including the requirements to not differentiate between paper-and-ink-data and electronic data. Data copied from
a CU system for investigation, trending, or batch release should be maintained in the format in which it was copied. If
the person using the data needs to process it for analysis, then that copied data should be transferred to the analysis
format. Both the original copy and the analysis-formatted data should be maintained in the file with the document
produced, so that the data can be transferred from copy to analysis.

Audit trails are a regulatory expectation. An audit trail records who has changed what, when, and why, and may be
accomplished electronically or through paper records such as a daily logbook.

Most utility systems today are fully automated and include several computers, PLCs, and configurable signal
transmitters (i.e., multiparameter transmitters for conductivity, temperature, and pH on a single device with control
capability), which all are considered to be within the data integrity scope. The following sections explain ways to set
up and operate GMP-compliant computerized CU systems.

4.1.1 Storage of Data

GMP-critical data must be stored according to the retain policies of the pharmaceutical manufacturer [48]. Typical
time frames for data generated by utility systems are from 10 to 30 years.

As utility systems usually generate large amounts of data, it is not recommended and not good practice to create
new systems that store GMP-relevant data on paper8, although this may still be the case in older systems. In these
instances, compliance is possible, but data on paper can cumbersome to trend. Regulatory bodies have increased
the requirements concerning the holistic analysis of data including trending and statistics to evaluate limits and gain
control of pharmaceutical machinery (e.g., ongoing process verification). It is expected that requirements for trending
data will increase in the future,9 thus, the use of electronic data is considered state of the art.

8
In cases where data is printed on paper for long-term archiving, protection of the paper archive is required (e.g. suitable fire protection, access
control) to prevent the data from deterioration or loss. Access to paper archives must be controlled [50]. An index of paper archives enables
personnel to quickly find relevant information during regulatory inspections.
9
For example, in the light of Ongoing Process Verification [54] and [55].
Page 42 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

For GMP data stored electronically, it is common to store the data redundantly on servers for long-term storage (RAID
1 or RAID 5 redundancy systems are typical). The correct and complete data transfer from the utility system to the
server(s) must be verified during validation [48].

Typical activities during regulatory inspections in terms of data integrity are:

• The comparison of different logs or data sources, for example, a logbook and audit trail. The information must be
consistent.

• A check for data access rights of the documented user roles and their corresponding responsibility, including
verification that only current users have access to the system.

• A check for the number of administrators; there should not be many persons that have administrator rights.

• A check of password features (automatic log off, periodic password changes, minimum length, use of two
independent characters, avoidance of group passwords)

• Review of validation documents to see the data integrity features implemented, and to confirm that data and
metadata transfer has been verified to be ALCOA+.

Older utility systems sometimes lack sufficient software functionalities to protect GMP data (e.g., suitable audit trail
or password features). If it is not possible to provide software updates for the system, these deficiencies can be
compensated with organizational solutions, for example, the documentation of changes in a logbook or frequent
manual password changes. Manual processes must be described in SOPs or other instructions.

Additionally, many older systems do not allow for individual accounts; this should be addressed when providing
access, as logons may be shared. Where system security allows for individual logons, shared logons should be
avoided, especially when the logon can access the system data.

Data in utility systems is often transferred to several storage media as shown in Figure 4.1. If the automated transfer
has been verified and validated, the “true copy” may be kept instead of the original data [49]. A description of which
set of data is being used for further GMP-related activities needs to be in place.

4.1.2 Applicability of Electronic Signatures

The differences between a logon and an electronic signature should be clearly distinguished in terms of automated
systems for pharmaceutical use. An electronic signature is required when master production or laboratory records are
created (for references, see 21 CFR 211.186 (a) [56] and 21 CFR 211.188 (a) [57] and EU GMP Guidelines, Chapter
4, [58]). This is usually not the case concerning automated utility systems.

It may, in certain circumstances, be possible that computerized equipment is directly used in the manufacture or
release of products or ingredients. (For example, when the conductivity or TOC are alarmed by the PLC and the
release of the final product is decided through this PLC, not by separate software or paper documentation.) In this
case, the regulations of electronic signatures apply to those users that have an impact on the release of a final
product. In practice, these alarms are frequently hard coded into the PLC logic, so a signature is not always required.

In most situations, the quality-critical data of a utility system is transferred to other media, and the production or
release-relevant actions or decisions are carried out in separate systems. Consequently, the utility control system
only contains a logon function to prevent data from deterioration or loss, and to create an audit trail.

The decision whether or not an electronic signature is required should be documented during the design of the utility
system. Independent of the final system design, the criteria for the logon or the electronic signature should be defined
in advance and may be subject to evaluation during regulatory inspections.
ISPE Good Practice Guide: Page 43
Critical Utilities GMP Compliance

4.1.3 Periodic Review

Like raw data, metadata is subject to regular review. Data entry should be checked at least once. In addition, the
computerized system must be kept in a continuously validated state. This is achieved in part by performing a periodic
review or evaluation according EU GMP Annex 11 [48] and other international regulations.

A periodic review evaluation consists of:

• Execution of complete raw data and metadata review

• Changes to the system

• Software version in use

• User access rights

• Password features

• User roles

• System performance/security/business continuity

• Disaster recovery

In practice, a frequency of 1 to 3 years has been shown as feasible for CU systems. Periodic review of the system
should be based on the corporate and local policies and include frequency of system changes and updates.

Frequently asked questions during inspections involve the above topics. The integrity of the data with the
corresponding testing documentation must be available upon request.

4.2 Sanitization and Microbial Control in Pharmaceutical Water Systems

The Canadian GMP C.02.005 Interpretation states [59]:

“3. Operate equipment in a way that prevents contamination.”

“3g. Operate water purification, storage and distribution equipment in a way that ensures a reliable source of
water of the proper chemical and microbial purity.”

This section reviews questions or issues raised by regulatory inspectors/investigators in the course of an inspection
regarding water system microbial control (and discrepancies therefrom) and its relation to the firm’s sanitization
processes. This section does not discuss the wide variety of sanitization options for a water system. For that
information, refer to ISPE Baseline® Guide: Volume 4 – Water and Steam Systems [4].

From a regulatory perspective, the procedure used to sanitize the water system is of secondary concern. Evidence
showing how effective the procedure is in achieving microbial control is subject to investigational review, including
documentation that the manufacturer follows the procedure. The evidence should show that a sanitant concentration
or temperature has been maintained over a threshold value for a period of time. This evidence may be provided in
electronic or paper form (see Section 4.5.1), provided data integrity is protected.

Demonstration of the procedure’s suitability (including demonstration of efficacy in response to system intrusion/
maintenance; for details see the ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and
Process Gases [3]) during water system validation is important, but more important is its long-term demonstration of
ongoing efficacy in microbial control.
Page 44 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Typically, regulatory attention to the sanitization process used for a water system is triggered by its apparent lack
of efficacy in microbial control and its negative impact on the suitability for use of the system’s water. This generally
means that a sanitization procedure should be a proactively scheduled event rather than being conducted in reaction
to system discrepancies. Reactive sanitizations may be acceptable early in a system’s lifecycle when an effective
sanitization schedule is being determined. Repeated reactive sanitizations after this time are indicative of a system
not in a state of control.

4.2.1 Role of Sanitization in Distribution System Microbial Control

Microbial control in a water system’s distribution system is not accomplished solely by an effective sanitization
process. Nor is the lack of microbial control caused solely by a failure of the sanitization process. Sanitization is one
of several elements of microbial control. Other elements include system materials of construction and design, routine
system maintenance, water purity, routine microbial monitoring, etc. When one or more of these elements is not
ideal, the remaining elements, including sanitization, may need to be more vigilantly exercised or modified in order to
achieve and maintain microbial control.

4.2.2 Role of Sanitization in Purification System Microbial Control

Microbial control within the purification portion of water systems, and specifically within its various unit operations,
also has a role in the microbial purity of the finished and distributed water and its suitability for use. Just like in
the distribution system, microbial control within the purification system is accomplished by system materials of
construction and design, routine maintenance (including regular backwashing and regeneration), and sanitization.
The lack of microbial control in these unit operations could impact their functionality in chemical purification,
potentially creating finished water that does not comply with the minimum-required chemical purity (i.e., conductivity
and TOC). However, in pretreatment systems the function of some necessary unit operations such as activated
carbon will result in an increase in microbial load. Provided that the increase in microbial load due to such unit
operations is controlled by subsequent unit operations this is viewed as acceptable.

The functionality of some unit operations may not directly impact the finished water quality because they are intended
to protect downstream unit operations to optimize their purification processes, or to protract a routine maintenance
frequency or unit operation element’s usable lifetime. However, poor microbial control in these secondarily important
unit operations could have a domino effect on the function of crucial downstream unit operations.

4.2.3 When Water System Sanitization Becomes Important in an Inspection

System sanitization is often incorrectly perceived by the system owner as the universal and sole corrective activity
needed whenever there is a microbial discrepancy in the water system, without understanding the underlying cause
of the discrepancy and without an effective investigation into the cause. Blindly resanitizing the system by the routine
sanitization procedure only temporarily stops the discrepancies. In the event that biofilm is present, for example,
sanitizations may only disturb the biofilm but not remove it, which may be observed in subsequent samples. In this
example, the symptom of the discrepancies has been addressed but not the underlying cause, making recurrence
almost certain. This may result a trend of repeated discrepancies and ineffective remediations, including ineffective
sanitizations.

Because a regulatory inspector typically reviews the microbial monitoring data for a facility, this trend will be a
cause for concern. This often leads to further scrutiny into how the organization addresses such trends and the
other processes involved, such as investigation practices. When firms blindly repeat ineffective actions, regulatory
confidence is diminished.

While a water system is a complex and dynamic process when it comes to microbial control, a trend in repeated
discrepancies and ineffective remediation may lead an inspector to conclude that the organization does not have the
expertise needed to maintain the water system appropriately.
ISPE Good Practice Guide: Page 45
Critical Utilities GMP Compliance

In addition, this may prompt the inspector to delve deeper into other systems throughout the organization to look for
similar deficiencies.

4.2.4 Effectively Investigating Microbial Control Discrepancies

There are many potential causes of microbial discrepancies. The sanitization process may or may not be the culprit.
Often it is more than one of the deficiencies discussed in the following sections.

4.2.4.1 Poor Sanitization Processes

The sanitization process can be ineffective for a number of reasons. Among them are:

• The process is not employed often enough to avoid significant post-sanitization regrowth that is too thick for the
sanitant to completely penetrate and kill.

• In the execution of the sanitization process, there is not sufficient contact time allowed for the sanitant to
penetrate and kill the biofilms, or the sanitant is not used at an effective concentration, or its coverage of all
wetted surfaces is incomplete. (For example, the tank dome is not covered by sprayballs; or loop sampling or
POU valves or instrument side streams are not flushed with sanitant.)

• A less aggressive sanitizing chemical with too weak an oxidation potential was used.

• The sanitant exposure is through a stagnant soak rather than the more effective rapid recirculation, which can
slough off the outer killed biofilm layers and allow the sanitant to penetrate more quickly than merely by diffusion.

Unfortunately, these are sanitization efficacy concepts often not considered during ineffective discrepancies
investigations.

4.2.4.2 Poor System Materials and Designs

Sometimes, a poor system design can create locational opportunities where biofilm can develop. Examples of such
locations include:

• Dead legs

• Long Ts to sampling/POU valves

• Flanged joints instead of hygienic clamp fittings or smooth welded joints

• Glued joints (with PVC systems that also leach plasticizers and become TOC in the water, greatly degrading its
purity and providing biofilm food)

• Incorrectly sized/shaped joint gaskets creating crevices where biofilm can sequester out of the reach of sanitizing
chemicals

Sometimes poor system designs are exhibited when there are no microbial-controlling unit operations in the system.
Examples include not having sanitizing UV units and/or bacteria retentive filters at the beginning of a loop, or where
freshly purified water enters the distribution system from the purification system.

If a design deficiency is the cause of the microbial discrepancies in this kind of system but not identified as such in a
root-cause investigation, it is likely because the system design was deemed acceptable by the organization. It may
also signal to an inspector that the organization lacks sufficient expertise to adequately maintain their water systems.
Page 46 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

4.2.4.3 Inadequate System Maintenance

If pharmaceutical water system maintenance is only reactive rather than proactive, there will almost certainly be a
microbial control impact. For instance, valve diaphragms need to be periodically replaced before the valves become
leaky, which they eventually will. The associated elastomers develop stress cracks and lose elasticity from frequent
use and valve over tightening, as well as from exposure to extreme temperatures or oxidizing chemicals. Leaking
gaskets and valves wet a path to the outside surfaces of water systems (as well as surrounding floors), allowing
external contaminants to develop biofilms along the wetted path and grow back into the water system, contaminating
the entire system.

Likewise, if deionizing resins are not regenerated and backwashed frequently prior to their complete exhaustion, the
chemical quality of the water could suffer from chemical impurity breakthrough as well as from biofilms allowed to
grow on those resin surfaces, resulting in inefficient water impurity removal and eventual costly replacement of those
resins.

Granular Activated Carbon (GAC) beds notoriously need microbe-controlling maintenance since they concentrate
biofilm food, allowing biofilms to grow quite quickly from the plentiful food adsorbed from the water. Frequent
backwashing, thorough heat sanitization (hot water is preferable to steam), and periodic bed replacement are the only
microbe-controlling activities available to GAC beds. If not executed frequently, microbial levels in the effluent could
reach TNTC CFU/ml and seriously compromise unit operations (often an RO unit) downstream.

The mechanism of action by an RO system promotes biofilm development and scale deposition on the upstream
concentrate surfaces of the RO membrane. If not periodically cleaned and sanitized, the membrane will be
permanently fouled and lose water permeability, and along the way to complete failure, produce impure water from
the high water flux through a small fraction of the original membrane’s unfouled surface area. Though effluent
microbial impurities are usually not an issue with poorly maintained RO systems, chemical impurities are, which could
overtax the efficacy of any downstream purification unit operations such as deionization or ultrafiltration, causing
them to prematurely and successively fail. These chemical impurities will likely make it into the finished water and fuel
biofilm growth in the distribution system.

If an organization waits to repair/replace system components only after they fail, not only is there the potential for
water system contamination issues, but the unscheduled system shutdowns could be devastating to manufacturing
productivity. Although regulatory inspectors often see the efficiency of a firm’s operations as a business concern,
they realize that when a firm’s productivity targets are compromised by such unscheduled interruptions, poor quality
decisions may result.

4.2.4.4 Incorrect System Sampling

It is very common for artificially high microbial counts in system samples to have been caused by the incorrect
sampling of sampling ports – usually from inadequately vigorous pre-flushing. It is equally common for artificially
low microbial counts at POU to be caused by incorrect sampling in a fashion that is “cleaner” than routine water
use practices. Regulators may look for differences between routine POU water use practices and POU sampling
practices. In such situations, there is a risk of a regulatory citation that the firm is acting fraudulently by intentionally
making the data show better quality water than is actually used.

Poor sampling can substantially add to the number of water system discrepancies reported. Even though it is likely
that the majority of these discrepancies are artifactual, it is difficult to definitively prove. Often employee error is the
stated cause and retraining the preventive action, but this can bring unwanted attention to the firm’s training program,
especially when repeated retraining occurs.

If instead the cause of the discrepancy is attributed to a hypothetical periodic floc of released biofilm, the typical first
reaction is to resanitize the water system. If this root-cause determination is incorrect, the sanitization process is
brought into focus because more discrepancies are sure to occur.
ISPE Good Practice Guide: Page 47
Critical Utilities GMP Compliance

Appendix 3 discusses this more in depth. Refer to ISPE Good Practice Guide: Sampling for Pharmaceutical Water,
Steam, and Process Gases [3] for optimal water sampling (and use) practices.

4.2.4.5 Deficient Training and Vague, Incorrect SOPs

Often, when employee error is the assignable cause of microbial discrepancies and retraining is the preventive fix, the
problem is not the employee or the training program. The problem is usually the SOP, which may contain incorrect
or vaguely worded procedures that either state poor practices to be used or allow user execution variability. Where
the SOP is vague, it is often the training program’s responsibility to provide the missing sampling execution detail.
Appendix 3 examines this further.

Poor sampling practices usually generate data falsely resembling poor water system microbial control when
appropriate environmental monitoring controls are not followed during sampling and testing, and when correct
sampling practices are not clearly stated in detail in the SOPs.

4.3 Maintenance

21 CFR Part 211.67 [60] states that equipment:

“shall be … maintained … as appropriate for the nature of the drug....Written procedures shall be established
and followed for … maintenance … Records shall be kept of maintenance”

21 CFR Part 211.68 [61] states that equipment:

“shall be routinely calibrated, inspected, or checked according to a written program designed to assure proper
performance. Written records of those calibration checks and inspections shall be maintained.”

The principles presented in the ISPE Good Practice Guide: Maintenance [62] and the ISPE GAMP® Good Practice
Guide: A Risk-Based Approach to Calibration Management [63] should be applied in establishing the systems and
requirements listed as follows.

Inspection teams may request evidence that the following systems and requirements are established and routinely
performed:

• Maintenance Program: This includes:

- Demonstration of a risk-based approach to defining critical equipment and instruments

- Creation and revision of PM tasks and quality oversight of this process

- Documentation of the scheduling and completion of maintenance, including detailed task descriptions and a
process to address overdue PMs

- Execution and quality review of nonroutine tasks, repairs, and on demand work orders outside of the PM
process

- Trending of nonroutine repairs to determine the need to modify the PM program

- Evidence of personnel training

Page 48 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

• Calibration Program: This should be as outlined in Section 4.6. Similar to the maintenance program,
documentation should demonstrate the scheduling and completion of the calibration program. As a best practice,
a documented risked-based rationale should be available to explain the tolerances (that cover the operating
range of the instrument), calibration frequencies, and test methods. In the event that discrepancies or out-of-
tolerance conditions are found, a documented review process should be followed that includes review by the
quality department.

• Management of Planned System Shutdowns and Start-ups: This can include a documented approach to
tracking the completion of all invasive maintenance and calibrations against scheduled maintenance plans
during planned shutdowns. Start-up plans post shutdown typically include sanitization, monitoring, and review of
process data and QC sampling results.

• Emergency System Shutdown/Start-up Procedures: The PIC/S Aide-Memoire – “Inspection of Utilities,” PI

009-3 [64] provides a guidance checklist for inspectors that indicates a key focus of an inspection could include
the:

“interaction between unplanned maintenance and requalification.”

The response taken during emergency shutdowns/start-ups of CU should be documented, and the potential
impact on product quality should be assessed and approved before equipment is returned to operation. This
documentation may take the form of a procedurally required risk assessment or be included as part of a deviation
investigation. Emergency shutdowns and corrective maintenance should be easily distinguished from PM in the
maintenance tracking program.

• Spare Parts Strategy: Maintenance procedures should be established to define when a part is like-for-like or
when parts constitute a change to be captured in the site change management process. Material traceability
requirements of spare parts should also be documented.

• Contract Management and Outsourcing: The expectation is any contract work has the same review and
compliance as in-house maintenance work. This can be demonstrated via contractor approval processes and
documented review and oversight of contract work by site Subject Matter Experts (SMEs) in real time.

4.3.1 Housekeeping and Wetness

Of fundamental importance to GMP compliance is housekeeping. If the floor is cracked or uneven, or the area
appears to be wet or has chronically been wet (as revealed by floor stains from standing water puddles), then
microbial biofilms are likely growing in those areas. These could contaminate the manufacturing or sampling
operations occurring in the same area, or be tracked and spread by manufacturing operatives passing through and
going to active manufacturing areas. How personnel move through the areas and what precautions are taken are
important aspects of compliance. For instance, do they gown up to sample, and then de-gown before leaving the
area?

In these manufacturing areas, especially wet areas, there may be grate-covered wash pits, floor drains, and/or sinks
used to discharge the water from hose flushing or parts and equipment cleaning. These areas are typically wetted
frequently through normal use. Because of the normal chronic wetness of these drains, biofilms that can grow here
should be controlled through periodic sanitization. If not controlled adequately, these wet sinks and drains can be
a source of direct contact or aerosolization of biofilm contaminants during hose flushing, which could contaminate
whatever activities are occurring there. An auditor may ask about drain maintenance and sanitization. It is helpful to
have nearby the SME or other knowledgeable person to answer, and for the backroom personnel to be able to quickly
retrieve the records documenting the execution of these processes if requested.
ISPE Good Practice Guide: Page 49
Critical Utilities GMP Compliance

4.3.2 Equipment and Piping Condition and Tagging

Water or process piping should be identified as to the “contents” of that piping and its flow direction, and possibly the
associated utility system as well. If there are gauges/sensors, control or delivery valves, valves used for sampling,
or pieces of equipment, they should be clearly and unambiguously tagged or labeled, and that physical identification
consistent with associated SOPs and drawings. There should not be multiple tags for the same gauges, ports, or
equipment, such as can occur when equipment or valves have a legacy designation as well as a current designation,
or when an SOP for sampling or calibration uses a different location designation. A single identifying designation
should be chosen and used in all drawings, SOPs, and physical tagging. However, if this is unavoidable and multiple
ID numbers are used, extra care should be taken to ensure consistency in documentation and drawings.

If there is piping insulation that is frayed, stained, or disintegrating, or if the piping is stained or crusted with corrosion,
or the valves drip or are in an apparent state of disrepair, this condition will be noted along with the valve location/
room number for future reference (such as when the auditor reviews excursion investigations, rejected product
investigations, or product complaint investigations). Such disrepair, even if associated with only a single location
in an otherwise well-maintained room with other acceptable outlet locations and insulation/piping conditions, is an
indication of poor manufacturing practices.

4.3.3 Pest Control

It could be argued that pest control is an element specific to a utility audit. Utilities are frequently placed in peripheral
locations of a manufacturing facility, often with doorways to the outside or partially located outside in milder climates,
making utilities at particular risk of vermin infestations. At a minimum, the pest control program includes a map with
the location and identification of traps or bait stations and a schedule for their inspection and replenishment.

Vermin bait stations should be used in the warmer, more vermin-active periods of the year. Such stations could
also be used inside the facility, but only in a safe manner and in locations unlikely to contaminate environmentally
unclassified manufacturing areas. There should be no evidence of rodent presence, or birds or insects in the
warehouse, raw material storage, or manufacturing areas.

An overview of the pest control program should be part of audit/inspection preparation activities. A good reference is
the ISPE Japan Affiliate: Pest Control Manual (English Translation) [65].

4.4 Hoses

All hoses should have unique identifying designations for usage and cleaning documentation/tracking purposes.
Hose usage and location should be well managed including how and where hoses are stored when cleaned, or when
dirty and awaiting re-cleaning. Clean and dirty hold times and their derivation/validation should be documented and
available. Properly stored and reused water hoses are acceptable, but they should be hung in an upside down “U”
orientation for draining and located very near the outlets where they are used, but not touching the wall or floor, and
away from any process splattering. They should not be left connected to their outlets after use unless they are to be
reused within minutes. There should not be more than a single hose intended for use at any given water outlet so
water samplers know which hose to use for sampling.

The handling of hose-end gaskets for reused hoses is an issue that has less defined industry-standard practices,
but the organization’s procedure needs to ensure hygienic handling during storage and placement. For example,
bulk gasket storage in bins accessed unhygienically is a noteworthy poor practice that can lead to water or product
contamination.

Cleaned, sanitized, or sterile hoses to be used at outlets should be packaged with or separate from their end-fitting
gaskets and labeled indicating their condition (i.e., clean, sanitized, sterilized). Documentation of the cleaning and
sanitization process, associated SOPs, and qualification of those processes should be available for review. Such
“refreshed” hoses and gaskets should be packaged or otherwise protected from external contamination, but do not
need to be hung in any particular orientation prior to use unless their process leaves them wet.
Page 50 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Typically no rationale or validation is required if the frequency of refreshing hoses is daily, every shift, or with
every use; however, if the frequency is less than daily, there is an expectation that a documented rationale and
validation for how often hoses are reused be provided. Alternatively, robust sampling data from the POU (i.e., end
of hose) demonstrating compliance throughout the use period can be provided. An “as needed” frequency of hose
replacement is not a best practice and it can be difficult to demonstrate good compliance with this approach.

4.5 Routine System Reviews

This section outlines the routine system reviews demonstrating that CU systems meet operational targets and
compliance aspects. Well established system reviews provide inspection teams a clear indication of ongoing system
health and reliability.

4.5.1 Daily Logs

Records of maintenance, cleaning, sanitizing, and inspection required by 21 CFR Part 211.67 [60] should be available,
with minimal effort required to prepare for a regulatory inspection. Depending on the level of automation used at a site,
daily logs could be manual (paper based) or managed via automated systems. Manual systems tend to be used at
smaller sites and can be equally effective from a regulatory perspective if they comply with GMP documentation practices.

Daily logs can be used for the documentation of:

• Routine sanitizations

• Filter changes

• Manual interventions (maintenance work, OOS remedial actions)

• Daily system inspections (plant walks)

• Monitoring of operating parameters

4.5.2 Alarm Logs

Validated automated systems have the ability to monitor CPPs or CQAs. Alarm conditions to notify users of
discrepancies or OOS events should have been established and tested during system qualification. The departments
that manage CU should categorize the parameters/alarms (critical (Quality) and noncritical (Engineering)) and
should establish a documented process to cover alarm response, including the level of escalation required for critical
or noncritical attributes/operational parameters. Documentation should be up-to-date as inspectors expect timely
reviews and response to identified discrepancies.

As best practice, a periodic review of system alarms is conducted to demonstrate ongoing system health and
reliability of CU systems. Be aware that a large number of noncritical (non-quality) alarms could also be considered
an issue, potentially showing that the system is not under control.

4.5.3 System Trending

There are several guidance documents that are of interest with respect to trending. EU Annex 1, 2020 Draft10,
Section 6.4 [66] states that:

“Results for critical parameters and critical quality attributes of high risk utilities should be subject to regular trend
analysis to ensure that system capabilities remain appropriate.”
10
Annex 1, 2020 [66] is presently a draft document for public consultation so the content and paragraph numbering may change prior to final
publication of the document.
ISPE Good Practice Guide: Page 51
Critical Utilities GMP Compliance

Annex 1 (draft) is intended to provide guidance for sterile medicinal products; however, some of the principles and
guidance may be used to support the manufacture of other products not intended to be sterile.

It is a general requirement to monitor process performance and product quality and to perform continued process
verification. This requirement leads to the need for system trending; therefore, the following guides may also be of
interest. Although not explicitly named in every case, the guides can usually also be applied to utilities.

• ICH guideline Q10 on pharmaceutical quality system, 2008 (deals with the monitoring of process performance
and product quality) [27]

• US FDA Guide for Industry: Process Validation, 2011 (refers also to ICH Q10) [55]

• PIC/S Recommendation on the Validation of Aseptic Processes, 2011 [67]

• EU GMP Annex 15: Qualification and Validation, 2015 (refers also to ICH Q10) [33]

• WHO Supplementary Guidelines on GMP: Validation, 2005 [68]

Trending of CPPs or CQAs for utility systems should show:

• The system is maintained and operated in a validated state.

• The system operates in a state of chemical and microbial control. This includes ensuring the effectiveness of
sanitizations and other ongoing microbial controls (e.g., UV, filtration, routine outlet flushing, consistently high
chemical purity).

• There is a proactive approach established to identify if CPPs or CQAs are not performing as intended (prior to
reaching specification levels).

• The effectiveness of CAPAs after significant investigations.

The trending process established should list the CPPs or CQAs being trended and have a rationale in place for
trending review frequency (monthly/quarterly, etc.). This trending should be summarized in reports that are approved
by the quality unit. As a best practice, the trending process includes a periodic review that examines and recalculates
the alert and/or action levels designed to allow water system remediation before water exceeds specifications.
Recalculation of alert and/or action levels is also recommended after significant design changes.

The best way to provide a scientific rationale to change or to keep alert and action levels is statistical analysis. Before
calculating the process capability of a parameter, a suitable statistical distribution model needs to be identified. The
best-known and most useful distribution model is the normal distribution, but this distribution model often cannot be
applied on water system data, especially microbial data, which typically does not follow normal distribution. A good
alternative may be the gamma distribution or the negative binomial distribution (see Gordon, Goverde, Pazdan, et al.
[69]), but the suitability of one of these models must be proven as well.

Once a distribution model has been identified, the capability and robustness of the process can be analyzed. If no
distribution model fits to the data, the last possibility is to show x-bar charts and apply trending rules (e.g., Western
Electric rules or Nelson rules). In addition, a typical trending report also lists deviations and changes that have
occurred during the review period. This is currently the best approach to analyze any process data.
Page 52 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

Once a trending process is established to monitor the CU, the following are a guide for what additional preparation
should be completed prior to an inspection:

• Have trend data formatted for presenting to an auditor with key parameters/attributes for each system.

• Prepare a summary list of all OOS or out of trend results and ensure each has a corresponding investigation
completed. Results of any investigations should also be summarized in a format that can easily be presented to
inspectors.

4.6 Calibration

Generally speaking, the regulatory codes do not directly comment on the calibration of water system instrumentation;
however, calibration of equipment used to test product and maintain control of the water system is a universal
requirement. A key component to maintaining control of a system is the ability to accurately measure system
performance parameters using instruments. A robust calibration program needs to be in place to ensure the accuracy
of these measurements. Instruments used for GMP critical-to-quality measurements generally require more frequent
calibration than similar instruments used for process control.

The Canadian GMPs, Equipment C.02.005 [59] has requirements that are typical of other regulators:

“The equipment with which a lot or batch of a drug is fabricated, packaged/labelled or tested shall be designed,
constructed, maintained, operated, and arranged in a manner that

(a) permits the effective cleaning of its surfaces;

(b) prevents the contamination of the drug and the addition of extraneous material to the drug; and

(c) permits it to function in accordance with its intended use.”

Interpretation of C.02.005 [59]:

“5. Design, locate and maintain equipment so that it serves its intended purpose.

5a. Ensure measuring devices are of a proper range, precision and accuracy. Calibrate this equipment on a
scheduled basis and keep records.”

4.6.1 General Calibration Program Expectations

There is an expectation that calibrations are carried out on a scheduled basis for direct impact instruments. No
impact instruments may not require as frequent calibration. Examples of no impact instruments include chilled water
temperature and pressure gauges on the utility side of heat exchangers.

The calibration schedule should be determined based on a combination of:

• Instrument manufacturer recommendations, where available

• Required level of measurement reliability based on the level of risk associated with the measurement

• Level of robustness of the instrument; for example, pH sensors are less robust than temperature sensors and
therefore, in applications of equivalent-required reliability and risk, the pH sensor needs more frequent calibration
ISPE Good Practice Guide: Page 53
Critical Utilities GMP Compliance

A good calibration should include:

• Documentation of the calibration

- A calibration certificate capturing raw data that has been reviewed by a quality representative

- An executed work order capturing raw data with a review process (in electronic format this may be
automated)

• Point(s) spanning the full operating range of the process (i.e., different instrument types will have unique
requirements for the number of points required; for example, conductivity is a single point, pH is 2 points,
temperature has a 3 point span)

- If the calibration is an intermediary calibration check between full calibrations, a single point calibration is
sometimes conducted and considered to be adequate.

- The calibration should include the as-found calibration data. If adjustments are made to the instrument,
calibration as-left results should also be recorded.

> For as-found results failing calibration on GMP-critical direct impact devices, an investigation should
be conducted evaluating risk to product since the last satisfactory calibration and possibly prompting
revision of calibration frequency.

- If using calibration certificates or printed work orders, they should include the acceptance criteria/tolerances
for the calibration.

> Reviewers should review the raw data to ensure that calibration acceptance criteria are met.

> If using an electronic work order based system, the acceptance criteria should be included in the
electronic system.

• Good documentation practices must be followed when documenting the calibration results.

• An expiry date for the calibration should be created and tracked.

- Recalibration should occur prior to the expiry.

- Some sites will “sticker” the calibrated device indicating when it was calibrated, by whom, and the expiry
date. Other sites have a work process where no instruments are stickered, and electronic and paper records
are used for tracking instrument calibration.

Calibration records should be kept in an organized fashion, readily available for the inspector.

4.6.2 Online Measurement of TOC and Conductivity

As discussed at length in the ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam and Process
Gases [3], TOC and conductivity may be measured online and used by QC in lieu of grab samples. In order for these
measurements to be used in lieu of grab samples, an equivalency study should be performed or a suitable alternative
method utilized as described in the ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam and
Process Gases. This study needs to be reviewed and approved by the quality department, and should be available
for review during a regulatory inspection.

If grab samples are used by QC, then the online instruments are considered to be used for process control. The use
of the instruments should be clearly documented.
Page 54 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

USP 42 <1231> Section 7 [36] has very good guidance on measurement of TOC and conductivity, along with the
requirements in USP <643> [70] and <645> [71].

4.6.2.1 Specific TOC Calibration Requirements for Real Time Release

TOC analyzers whose results are used for the release of compendial water must pass a system suitability test
administered on a regular basis. The test interval should be determined based on the level of risk to product, business
risk, level of redundancy of TOC measurements on the system, instrument stability, and expected TOC levels.

USP <643> [70] describes the requirements of the testing. Other pharmacopeias have similar testing requirements.

4.6.2.2 Specific Conductivity Calibration Requirements for Real Time Release

Conductivity sensors whose results are used for the release of compendial water must take the measurements
uncompensated for temperature, and be calibrated following the procedure outlined in the USP <645> [71] (or other
relevant pharmacopeia).

4.7 Training

A thorough training program includes:

• Ensuring the presence of a job description

• Creating a training plan with the proper curricula

• Conducting, documenting, and tracking the completion of training

• Maintaining the training system to ensure training effectiveness

Qualification documentation for each employee should contain a job description, prior qualifications, curricula, and
training records.

The main purposes of a training program are to:

• Ensure GMP/GxP training is a precursor to performance of GMP activities. In addition, a robust training program
should provide a broad knowledge base to ensure adoption of best practices and lessons learned.

• Ensure new employees are properly oriented and trained per the new hire orientation process.

• Ensure all associates take required general, job-specific, and regulatory training.

• Ensure personnel performing work affecting product quality are competent based on appropriate training, skills,
and experience.

• Ensure that all personnel, as part of their training, are aware of product defects and resulting consequences that
may occur from the improper performance of their specific jobs (as applicable).
ISPE Good Practice Guide: Page 55
Critical Utilities GMP Compliance

4.7.1 Job Description

Each employee (or group of employees if there are multiple employees with similar duties) must have a job
description [72]. The duties described in the job description should be used to select the job-specific curricula that will
populate the training plan.

Functional management, with input from Quality, the health and safety group, and the training department, defines the
job-specific training requirements for each job title/function within their area of responsibility. Newly hired, internally
transferred, temporary agency contracted, or cross trained employees should have a training plan assigned prior to
starting in his/her new position.

4.7.2 Training Plan

The training plan for each employee contains the minimum-required curricula that the employee needs to complete in
order to be qualified to perform the duties of his/her position. Every employee has a training plan that consists of site
core curricula and other curricula that are job-specific.

The training department assigns the identified curricula to an employee’s training plan as informed by the employee’s
supervisor.

4.7.3 Completing Scheduled Training

Management or trainers determine the appropriate method to evaluate training effectiveness and employee
understanding (read and sign only, supervised demonstration of required skills/activities, etc.) prior to execution of the
training. The methodology used to check effectiveness is proportionate to the risk associated with the work for which
the training is being provided.

All training assigned to an employee should have a due date. Employees should not perform any unsupervised GxP
activities until they are trained. Each employee and their supervisor are responsible to ensure that the employee has
completed the required training prior to performing job tasks related to that training. Completion of training should be
tracked manually or electronically.

Employees have the responsibility to record all the training that they complete. Records of training need to be
retained according to company procedures and/or the record retention schedule. Completed training may be
documented manually or electronically.

4.7.4 Ongoing Maintenance of Employee Training

The responsibility for creating, maintaining, and reviewing training curricula is to be described in the company training
procedure(s). A frequency should be defined for review of an employee’s training plan by the manager and the
employee to determine if it needs to be updated.

Ongoing maintenance of employee training occurs through periodic training on new and revised procedures that are
part of the assigned curricula, and awareness and refresher training as needed to ensure that employees are:

• Always trained on the current revision of documents

• Made aware of current applicable standards and requirements, general policies, and guidelines

• Retrained when training is identified as the assignable/root cause of an investigation, or as deemed necessary
by management
ISPE Good Practice Guide: Page 57
Critical Utilities GMP Compliance

5 Legacy Water Systems

Legacy water systems offer unique challenges to being compliant by today’s GMP expectations. These systems are
often noncompliant or marginally so, and present a potentially higher level of risk if used (or planned to be used)
for pharmaceutical operations. Some sort of remediation is usually needed for a legacy system to become GMP
compliant.

Legacy compressed air and medical gas systems typically do not present major compliance challenges since the
engineering best practices and standards have seen far less change over the last 20 years than water systems. Most
often, deficiencies are seen with water systems because of their unique microbial control difficulties; therefore, they
are the focus of this discussion. In addition, legacy systems may include legacy controls/automation systems. These
controls/automation systems should be assessed for risk and remediated. Guidance on control/automation systems is
provided in Chapter 4.

5.1 Sources of Legacy Systems

Problematic legacy utility systems intended for use in current manufacturing processes originate through several
scenarios. Legacy systems are often associated with acquired facilities, but may also be found in ageing site
buildings. Sometimes manufacturing facilities are acquired from defunct pharmaceutical companies driven out
of business by regulatory non-compliance and/or product recalls. In these cases, the sites may carry regulatory
baggage from the original owners who chose facility closure over the cost of remediations. If available, the
compliance issues that caused the shutdown of the facility can assist in the remediation processes.

Legacy systems could also be associated with repurposed buildings whose utility systems were never validated, were
validated by outdated approaches, were never designed for GMP operation, or had been abandoned and require the
reactivation of long-idle utility equipment. Whatever the source of these legacy systems, the utility is outdated and
most likely does not comply with GMP.

5.2 Types of Deficiencies and What Can Be Done

The sources of these legacy systems often correlate with the nature of the deficiencies relative to current
expectations, each with its own remediative challenges. System age is usually a factor; however, there is often more
than one deficiency in need of remediation. Most remediations follow a common pattern:

1. Where possible, accommodate existing system deficiencies with new or modified procedures, including perhaps
performing extensive initial microbial remediations and validations if absent or original studies are flawed.

2. If GMP compliance is not possible with the current system design, modify the system as needed and qualify the
changes or revalidate if there are substantial changes.

When planning the remediation of a legacy system, a gap assessment should be conducted and risk assessed. The
risk assessment can then be used to target the highest risk deficiencies first. In addition, the level of risk reduction
required by the risk assessment will determine whether engineered controls versus procedural controls are likely to
be adequate.

5.2.1 Poor, Unreliable, or Otherwise Noncompliant Distribution System Design

In these instances, the system design is inadequate or substandard, causing its noncompliance or its inability to
consistently produce good product.
Page 58 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

5.2.1.1 Branched One-Way/Dead Leg/Non-Loop Distribution System

Dead legs and non-loop water distribution systems can present challenges to maintaining control. However the
definition of what constitutes a dead leg (in the ASME BPE Standard [73]) has changed from 6D to 3D and now to
2D; significantly, this definition is not a compendial definition and the ASME BPE specifically identifies it as optional.

Many systems, with what would today be considered dead legs, have decades of operating data supporting that the
system is in control. Sampling data is used to support that risks posed by dead legs are adequately managed.

It should be noted that not all dead legs are equivalent in terms of risk. For instance, a dead leg of 6D on a system
that is continuously hot presents a far lower risk than the same dead leg on a system that is ambient or even
intermittently ambient. When evaluating a legacy system for risk with respect to dead legs the nature of the system
needs to be taken into account.

Performance of some systems may be mitigated by heavy use or frequent flushing of all branches to create periodic
vigorous flow – assuming that the dead legs and branches can be opened and are not just stagnant water traps.
These accommodating activities require thoroughness, unfailing diligence, and can be maintenance-costly to the
point where, in many circumstances, they may not be realistic or effective long-term. More often than not, these
accommodating activities are not diligently executed; therefore, procedural success and reduced risk is more likely to
be achieved through engineering controls such as automation rather than manual procedures alone.

Often the developed biofilm, especially where sanitization has been infrequent or water flow is stagnant, is so
extensive that remediation is nearly impossible due to the non-recirculating design. In instances where problems
repeatedly occur because of a lack of diligent maintenance, or where there are unaddressed pockets of biofilm, it
may be more cost effective to redesign/renovate the system to remove dead legs and/or create a looped distribution
system.

However, for systems with an excellent set of consistent operating data that are assessed as low risk, an organization
may conclude, with justification, that remediation of dead legs for the sake of meeting ASME BPE [73] is not required.

5.2.1.2 Non-Hygienic Valves and Fittings

Another microbial control-compromising design deficiency in legacy water systems is the use of non-hygienic
valves and valve fittings.11 Common examples are ball valves, butterfly valves, connect fittings, and compression/
friction-fit/mechanically attached-type fittings. Any components that contain undrainable locations, or water trapping
crevices that cannot dry easily, or otherwise stay wet after use easily grow biofilm in these areas. These locations
are impossible to completely chemically sanitize. Only heat sanitization approaches (which are infrequently used or
incompatible with legacy systems) are able to do so, with continuously hot systems fully mitigating this risk for PW.
(Butterfly valves have been shown to function under control in continuously ozonated parts of some systems.)

Except for systems with continuously sanitizing conditions, such non-hygienic valves and connectors are usually not
correctable procedurally and need to be replaced with hygienic versions, typically, diaphragm valves and hygienic
clamp style fittings and gaskets.

5.2.1.3 Inadequate Flow Rate or Loop Pressure Control

Low flow rates and low system pressures in the distribution piping system are detrimental to microbial control. These
issues are usually accompanied by distribution system piping diameters that are too narrow, undersized distribution
pumps with no distribution system pressure control at the loop return, or both. This leads to slow water delivery and
very limited concurrent outlet use without outlet backflow, encouraging loose biofilm development within the piping.

11
On newly built systems the use of non-hygienic valves, such as butterfly valves and ball valves, in the sanitary portion of the systems is inadvisable.
ISPE Good Practice Guide: Page 59
Critical Utilities GMP Compliance

Simple solutions involve using larger capacity pumps with end-of-loop flow restrictions. But if hampered by narrow
piping diameter, piping replacement may be needed. Such changes need appropriate system requalification.

5.2.1.4 Inferior Materials of Construction and Joining Designs

Although still allowed (by not being specifically disallowed), PVC piping in distribution systems is problematic relative
to plasticizer/glue leachables that affect the water TOC during low use periods. These leachables also promote
biofilm development on the piping surfaces, particularly at the glued joints, which are not smooth. PVC joints often
squeeze joint material into the piping lumen beyond the piping surface and are full of voids where biofilm can develop
and be impossible to completely kill with chemical sanitizers. Although advances in installation and weld technology
have improved recently, legacy PVC distribution systems can be an immediate red flag for microbial control problems.

Far cheaper than smooth welded piping joints are flanged joints; however, the flanges and associated gaskets create
crevices that are difficult to chemically sanitize, presenting potential microbial control problems.

In addition, the choice of materials, usually plastics other than Polyvinylidene Fluoride (PVDF) such as polypropylene,
limit compatibility with the best sanitization approaches, hot water and ozone. Although it is possible to procedurally
accommodate these poor materials and joining methods with more frequent chemical sanitization and TOC polishing,
it is sometimes more cost effective in the long run to replace those inferior system materials with smoother joining,
heat-resistant materials to facilitate the best sanitization option.

5.2.2 Inadequate Purification System Functionality, Reliability, Capacity, or Design

The purification approaches originally used in legacy water systems have likely long since evolved into more automated
and easier to clean and maintain approaches. Such systems may not produce the necessary water purity or water
output for current or anticipated manufacturing needs, or not do so reliably, as discussed in the following sections.

5.2.2.1 Antiquated Unreliable Purification Technology

Antiquated purification systems may use older, inefficient, manually operated, and maintenance-costly purification
unit operations. If the maintenance cost can be accommodated (e.g., frequent replacement of vendor-regenerated
deionization beds) and the design does not lead to periodic poor chemical and/or microbial control from poor manual
maintenance and accidental oversights, then no changes are needed in order to maintain compliant water quality.
However, the investigative and product cost (as well as negative regulatory attention) of even a single untimely
maintenance slip could make such designs cost-ineffective and argue for more conventional current purification
technology with more automatable routine operation, regeneration, and cleaning.

5.2.2.2 Insufficient Water Chemical Purity

If the legacy water system pre-dates the USP chemical attribute changes in the PW and WFI monographs of 1996,
then the water may not consistently comply with the current USP Conductivity and TOC requirements [70, 71].
Almost certainly, one or more of the purification system unit operations needs to be replaced with current technology
components in order to bring the water system into compliance.

5.2.2.3 Undersized Water Purification, Storage, or Distribution Capacity

Some legacy systems are simply too small and do not produce or store enough water for modern manufacturing
needs. It is possible that a larger storage tank could accommodate the added water need if there is a long enough
daily non-water use period to allow the low output system to make and store enough water to meet the higher
demand. But if the system output is inadequate to make up for this demand during low use periods, then either
manufacturing must change its heavy use schedule or a larger capacity purification and/or water storage system must
be installed. This could take the form of an added purification system to the existing system, a replacement of the
rate limiting unit operation in the existing system, or simply a larger system replacing the smaller system feeding the
existing storage and distribution system.
Page 60 ISPE Good Practice Guide:
Critical Utilities GMP Compliance

5.2.3 Absent/Inadequate Validation, Missing Documentation, or Unqualified Changes

Although this scenario of absent/inadequate validation, missing documentation, or unqualified changes may be found
in a facility with a poor change control process, it is more likely to occur through a facility acquisition process. Historic
validation documentation from original owners may have been inadvertently destroyed, lost, or never transferred to
the new owners. But even if it had been, this documentation is often either poorly executed by current standards, is
missing documents, or has changes made after the original validation that were inadequately controlled. This results
in an unvalidated water system, unusable for GMP manufacturing.

However, if a substantial amount of routine monitoring (at least 6 months) had been performed by the previous
owners since their most recent system changes, and the data is reliable and acceptable, then a quality plan should
be created including a risk assessment (with a gap analysis) that incorporates acceptance of lower risk elements and
verifies higher risk elements of the IQ and OQ. The risk assessment should include an evaluation of using the water
system in ongoing activities; that is, justifying validating the system concurrently in use (at risk) for manufacturing.

If the data is not reliable in any way or contains unaddressed deviations, then it cannot be used as PQ data. The
water system cannot be used for manufacturing and the causes of the deviations must be corrected. Once the
needed remediations are made and the IQ and OQ appropriately changed, a prospective PQ can be mounted with
manufacturing beginning per the company validation policy after a period of data is generated and there is at least a
degree of confidence created in the water system.

Note: Some regulators specifically disallow retrospective validation, so before utilizing this approach with a legacy water
system, check your local regulatory requirements for validation. For example, EudraLex Volume 4, Annex 15 [33] states:

“Retrospective validation is no longer considered an acceptable approach.”

5.2.4 Absent Inadequate Maintenance Causing Intractable Biofilm

For any number of reasons, a legacy water system may have been abandoned and turned off while full of water or
incompletely drained, or simply not maintained properly in its final period of use, allowing biofilm to develop without
any effort to control it. Depending on the system design, all reasonable (and even heroic) efforts to bring the system
back under control may have failed, even after selective design and procedural changes have been instituted. In such
situations, rather than continue to struggle with incremental improvements with no assurance of success, especially
if significant fundamental design flaws cannot be mitigated, it may be more cost effective to replace the legacy water
system with a new system. It may be possible to salvage components from the legacy system for use in the new
system (in order to incrementally reduce the total system cost), but more likely it is wiser to start afresh with new,
current technology system components designed to efficiently operate together.

5.3 Regulatory Impact of Legacy Systems

In the world of ever-changing GMP expectations, legacy water systems often utilize older water purification and
distribution technologies, having been created under older perceptions of what is acceptable for pharmaceutical
product manufacture. “Old” is not necessarily bad and “new” is not necessarily good.

The challenge of utilizing legacy water systems is to contemporize them into a consistently GMP-compliant water
system without starting from scratch. One way to achieve this is demonstrating sufficient water system knowledge to
make adjustments as needed to accomplish water system reliability. It is, in part, this process knowledge that gives
the regulatory inspector or a customer auditor a good sense that the water system is under control, regardless of its
age. Additionally, it must be demonstrated through validation and whatever data has been generated since then that it
works reliably, is maintained in a fashion that preserves that reliability, with well documented data as proof of such.
ISPE Good Practice Guide: Page 61
Critical Utilities GMP Compliance Appendix 1

6 Appendix 1 – Typical Regulatory Citations/

Appendix 1
Warning Letters
This appendix provides examples of regulatory citations as evidenced by recent warning letters on topics presented
in this GPG, such as validation, water monitoring, water testing and system failures, microbial control, and inadequate
investigation of deviations.

The letter excerpts in this appendix are from the US FDA [74] as it has the most searchable database.

6.1 Letter 1 – Failure to Validate and Monitor the Water Purification System

Date: 19 February 2013

Subject: CGMP/Active Pharmaceutical Ingredient (API)/Adulterated [75]

“1. Failure to validate and monitor the water purification system to ensure that water is of appropriate quality.

Your firm uses water in the final purification step of ..., an API intended for use in sterile drug products. However,
your firm failed to demonstrate that your purified water system can consistently produce water that is suitable for
use in the manufacture of this API.

This is a repeat observation from the July 21-August 8, 2010 inspection. In your response to observations made
at the 2010 inspection, your firm promised actions it would take to assure reliable water quality. However, those
changes were inadequate, as you continued to get periodic out-of-specification (OOS) endotoxin and total
organic carbon (TOC) test results.

In your response to the observations noted during the 2012 inspection, you indicated your firm’s intention
to conduct a comprehensive gap analysis of the purified water system. However, you have failed to indicate
when you will initiate this gap analysis and when it will be completed. Your firm also failed to detail how you
will determine the source(s) of high endotoxin and TOC in your purified water and how your firm will remedy
identified problem(s). We note that, for example, your firm installed an endotoxin removal unit on your purified
water system in January 2011 in response to the OOS results for endotoxin in the water used for API. However,
your firm has not demonstrated that the water produced by the purified water system is now suitable for use
in production. The operational parameters and effectiveness of the new endotoxin removal unit have not been
qualified. Your firm does not monitor the microbial and chemical attributes of the feed water, and have no
assurances that the purified water system is capable of consistently producing water that meets specifications
for a given quality of feed water. Your gap analysis should also include evaluation of factors such as feed water
quality, whether each component of the purified water system is meeting its performance specifications, and
whether the system’s output is reproducible. Your firm has not determined the source of the endotoxin failures
in the past, and it is essential that you demonstrate that changes in design and operational procedures have
resulted in a reliable water system.”
Page 62 ISPE Good Practice Guide:
Appendix 1 Critical Utilities GMP Compliance

6.2 Letter 2 – Failure to Test Water Used in Drug Product Manufacture

Date: 2 December 2013

Subject: CGMP/Finished Pharmaceuticals/Adulterated [76]

“1. Your firm failed to withhold each lot of components, drug product containers and closures from use until the
lot has been sampled, tested or examined as appropriate and released for use by the quality control unit (21
C.F.R 211.84(d)(2)).

For example, you have not tested the water used in the manufacture of your Over-the-Counter (OTC) drug
products to ensure the absence of objectionable microorganisms since 2006. Several microorganisms including
Pseudomonas aeruginosa, Cronobacter sakazakii, Burkholderia pseudomallei and Acinetobacter ursingii were
isolated and identified from the water samples that our investigators collected during the inspection.

In your response you state your firm will increase water sampling to (b)(4) times per year and explore the use of
specialized media. Your response is inadequate because your firm uses deionized water to manufacture drug
products intended for human use. Water utilized in the production of finished human drug products must, at a
minimum, meet the Purified Water, USP, monograph as well as appropriate limits for microbial count. In addition,
your firm continues to fail to monitor water quality routinely as you only commit to collecting (b)(4) samples per
year. Your response also does not include an investigation into the root cause of the unsatisfactory microbial
control of your water system.

To facilitate compliance with CGMPs, please refer to FDA’s guidance on water system design, control, and
monitoring entitled Guide to Inspections of High Purity Water Systems for more information.

It is essential that your firm’s topical products be produced in a manner that is appropriate in View of their
intended uses. We note that some of your firm’s products are used in either a hospital or nursing home setting, or
applied on broken skin. It is critical that your firm considers the intended uses of your products when determining
manufacturing and testing standards. These products should be consistently manufactured to minimize
bioburden and be free of objectionable microorganisms.

This is a repeat observation from the June 2011 inspection.”

6.3 Letter 3 – Inadequate Purified Water System Controls

Date: 12 June 2014

Subject: CGMP/Deviations/Biologics License Application (BLA) Microbiological Control [77]

“2) Controls for the purified water system at your facility are inadequate to prevent bioburden and endotoxin
excursions. For example:

a. The 2012 Annual Product Quality Review report for water indicates that there were many bioburden
excursions in purified water system (b)(4)(Loop (b)(4)). Water from Loop (b)(4) is used in part to humidify air
in (b)(4). Different types of bacteria were found, but in the majority of cases, the microorganisms found were
Ralstonia pickettii and Achromobacter spp.

b. Deviation #200217554, initiated on March 7, 2012, indicates that a water-borne organism, Achromobacter
xylosoxidans, found in water from one of the farms, and in water from one of the hatcheries, was also isolated
from the purified water system in your facility.
ISPE Good Practice Guide: Page 63
Critical Utilities GMP Compliance Appendix 1

c. The 2013 Annual Product Quality Review report for water concludes that four alert limits and one action
limit were reached for water system (b)(4) (Loop (b)(4)). Water from Loop (b)(4) is used in part for equipment
washing. Organisms isolated from these five excursions included Ralstonia pickettii and Achromobacter
xylosoxidans. Achromobacter xylosoxidans and other water borne gram negative bacteria have been implicated
in product contamination issues at your facility as far back as 2011.

d. There is no set schedule for disinfection of your water system. The system is only disinfected on (b)(4).
The system was disinfected twice in 2011, five times in 2012, four times in 2013, and once in 2014 to date. In
addition, the water system is circulated at (b)(4) temperature and is cleaned with (b)(4). No (b)(4) is used in the
system.”

6.4 Letter 4 – Water System Failures

Date: 23 February 2016

Subject: CGMP/Finished Pharmaceuticals/Adulterated/Misbranded [78]

“a. Water System Failures:

Your firm failed to maintain your reverse osmosis (RO) water system for topical drug products. During the
inspection, our investigators observed leakage in the RO water system. Your Director of Operations told our
investigators that your RO water system had been leaking for more than six months since August 2014. No
action was taken to repair the leaks during that entire time.

Our investigators also determined that your monitoring, inspecting, and repair of the RO water system was
inadequate in ensuring that it was maintained in a validated state. Beyond the failure to maintain your RO system
from January 8, 2014, through October 8, 2014, microbiological test results from water sampled at the RO (b)(4)
were TNTC [Too Numerous To Count] on (b)(4) occasions. Without justification, you discontinued sampling at the
RO (b)(4) that yielded these results. We note that the finished product lots that you rejected in 2013 for microbial
contamination included gross contamination with Pseudomonas aeruginosa, a microorganism commonly found
in water.

In your response to the FDA 483, you stated that you replaced the gaskets of the RO membrane housings during
the inspection, and leaks had stopped. You also updated procedure (b)(4) (Operation and Maintenance of the
USP Water) to require (b)(4) leak checks for the RO system and the water loop.

However, your response is inadequate. You stated that high microbial counts from the RO (b)(4) are not a
cause for concern because the water is further purified (b)(4). However, you provide no scientific rationale to
justify (b)(4) counts as high as TNTC in your system at the RO purification stage. The presence of waterborne
microorganisms at levels TNTC in your finished product indicates that other components (b)(4) of your RO
system are insufficient to prevent contamination of your finished products.

In your response to this letter, please provide trending results of (b)(4) microbial testing at all water purification
system ports to demonstrate the effectiveness of your replaced gaskets, including counts and microbial
identification; water system maintenance procedure(s) including the replacement frequency of filters and (b)(4);
sampling plans to monitor water quality; data to demonstrate to what degree the (b)(4) and (b)(4) filter installed
immediately (b)(4) of the production points-of-use can control bioburden; a summary of your investigation to
determine if gaskets were indeed the sole root cause of contamination; and an update on any further risk controls
and improvements in system design that have been implemented as a result of your investigations.”
Page 64 ISPE Good Practice Guide:
Appendix 1 Critical Utilities GMP Compliance

6.5 Letter 5 – Inadequate Investigations

Date: 30 June 2016

Subject: CGMP/Active Pharmaceutical Ingredient (API)/Adulterated [79]

“2. Failure to adequately investigate critical deviations and implement corrective and preventive actions.

A. Microbial contamination in (b)(4) water systems

From April 20, 2014, to February 17, 2015, you investigated at least 25 breaches of the alert level ((b)(4) colony
forming units) or action level ((b)(4) colony forming units) for microbial contamination in your water system loops
in Building (b)(4). You used water produced from this system to manufacture (b)(4) API. Of note, you identified
Burkholderia cepacia, a waterborne organism known to contribute to biofilm formation in water systems, in
several of your alert-level and action-level investigations.

Your investigations failed to adequately establish root causes. In 16 of the 25 investigations, you concluded that
the root cause was sampling error but had no supporting evidence. You did not determine a root cause in the
remaining nine investigations. Our inspection also found that you were not sanitizing the (b)(4) water system
loops (b)(4), as required in your procedure PAA219 Operation & Maintenance for (b)(4) Plant (b)(4) Water
System.

In your response, you acknowledged that your (b)(4) water system investigations were not robust. However, you
made no commitment to conduct a comprehensive investigation into the breaches and overall adverse trends.

In response to this letter, provide a summary report of your reassessment and remediation of (b)(4) your (b)(4)
water systems. Also include sampling use points and sampling schedules.

B. (b)(4) API batch (b)(4) with out-of-specification bioburden

Our investigators found that three of the (b)(4) of (b)(4) (batch (b)(4)) had bacterial counts (bioburden) exceeding
your specification. (b)(4) had more than (b)(4) colony forming units of Sphingomonas paucimobilis per milliliter
of product. Sphingomonas paucimobilis, an opportunistic pathogen, is one of the organisms you identified in the
water system used to manufacture this batch. Notably, Sphingomonas paucimobilis was also found in (b)(4), but
this (b)(4) was released based on passing microbial count testing.

Following an investigation, your firm elected to reject the (b)(4) that failed microbiological quality control testing.
However, microbial contamination by its nature rarely occurs uniformly. Therefore, rejecting the specific (b)
(4) that failed final QC testing, while releasing the remaining (b)(4), may not prevent exposure of customers to
potentially objectionable contamination.

In your response, you attributed the high bioburden root cause to an extended (b)(4) hold time. Your response is
inadequate. Your firm has no established maximum (b)(4) hold time. You failed to include any supporting data to
correlate your (b)(4) holding times with increased API bioburden. You did not extend your investigation into the
(b)(4) other (b)(4) with similar or longer (b)(4) hold times.

In response to this letter, include a reassessment of your water system and how it may contribute to high API
bioburden. Also provide your corrective action and preventive action plan to prevent recurrence.”
ISPE Good Practice Guide: Page 65
Critical Utilities GMP Compliance Appendix 1

6.6 Letter 6 – Failure to Validate and Monitor the Water Purification System

Date: 2 March 2017

Subject: CGMP/Active Pharmaceutical Ingredient (API)/Adulterated/Misbranded [80]

“1. Failure to validate and monitor the water purification system to ensure that water is of appropriate quality and
suitable for its intended use.

During the inspection, our investigators found that your water purification system was not adequately monitored
and controlled. Because you use water as a drug component and for cleaning your facility and equipment, these
failures pose significant risk to the safety of your drugs.

Source water

You failed to test the source water for your (b)(4) water system. The source water emanates from a nearby river
and passes through farmland, where it is subject to agricultural runoff and animal waste, before reaching your
facility. Your firm stores the source water in an (b)(4) tank that has a large (b)(4)-facing hole that is open to the
environment. Your storage method does not protect your water from dirt and other contaminants, or from the
ingress and proliferation of pests and objectionable organisms.

Sanitization and validation

You did not follow your own sanitization procedures for your (b)(4) water system. Your procedures specify (b)(4)
of sanitization at (b)(4), yet our investigators identified instances where you sanitized for as little as 10 minutes
without justification.

During the inspection, you stated that in March 2016 you initiated, but have not yet completed, a performance
qualification of the (b)(4) water system. Your firm has used this unqualified system routinely since its installation
in 2014, despite having no scientific evidence that the system is capable of producing water of adequate quality.

Testing

Our investigators found that you were aware that the total aerobic microbial counts (TAMC) for all in-process
water samples (b)(4) had exceeded your limit of (b)(4) colony forming units (cfu)/mL for multiple months. You
failed to investigate these deviations.

Furthermore, your firm did not demonstrate an adequate understanding of the process that your (b)(4) water
system relies on to kill microorganisms. (b)(4) is typically (b)(4) sanitization steps. However, you only use (b)(4)
to reduce TAMC to acceptable levels in the (b)(4) water. This suggests that it is a critical step in your process, but
you did not consider operating parameters that affect performance, such as water flow rate, (b)(4), water (b)(4),
and (b)(4) age. Additionally, your interpretation of your results is confounded by the fact that your methods are
not verified.

In your response, you committed to testing your source water for microbiological contamination. You indicated
that you set microbial limits of (b)(4) cfu/mL for the source water, and that you removed the microbial limits for the
in-process samples of your (b)(4) water system.

Your response is inadequate. You failed to provide sufficient detail about how you will remediate your (b)(4) water
system. In response to this letter, provide:

• a plan to address the open (b)(4) source-water storage tank

• a status update of the performance qualification that you initiated in March 2016
Page 66 ISPE Good Practice Guide:
Appendix 1 Critical Utilities GMP Compliance

• corrective and preventive actions if source water test results exceed the limits

• scientific rationale for setting microbial limits

Contaminated (b)(4) water has been the root cause of multiple recalls by other drug manufacturers of non-
sterile (b)(4) liquids, including instances of adulteration with Burkholderia cepacia, an opportunistic pathogen.
Therefore, it is imperative that appropriate action and alert limits be established based on validation data; these
limits must be low enough to signal significant changes from normal operating conditions.”

6.7 Letter 7 – Failure to Validate Purified Water System

Date: 26 January 2017

Subject: CGMP/Finished Pharmaceuticals/Adulterated/Misbranded Failure to Validate Purified Water System [81]

“Failure to Validate Purified Water System

You have not validated the purified water system that you have been using for at least three years to
manufacture products that are ingested, inhaled, or applied topically. Some of these products are indicated to
treat irritated tissues or wounds that may be more vulnerable to infection. Although you partially documented
the results of validation activities you conducted in 2013 following relocation of your water system in a report
dated April 28, 2014, your report does not include the results of microbiological tests, (b)(4) tests, or (b)(4) tests
that you performed during your validation activities. The same report states the microbial load of your purified
water system steadily increased following the (b)(4)-day validation period in May, 2013, and that additional
maintenance activity was required to address the increased microbiological load. You failed to validate the
purified water system after completing the required maintenance activities.

Additionally, on multiple occasions, components of the water system failed. At least one of these incidents
resulted in the water system operating without (b)(4). For example, on February 26, 2015, the (b)(4) of the
(b)(4) failed and the system was (b)(4) until the (b)(4) was rebuilt on March 4, 2015. You did not conduct an
investigation to evaluate the effects of this or other failures on the quality of the products you manufactured and
released for distribution during this time.

Your August 31, 2015, response states you have contracted with a third party company to conduct a full
validation of your water system. In response to this letter, provide the validation protocol and the final validation
report.”
ISPE Good Practice Guide: Page 67
Critical Utilities GMP Compliance Appendix 1

6.8 Letter 8 – Data Integrity Failures

Date: 16 February 2018

Subject: CGMP/Active Pharmaceutical Ingredient (API)/Adulterated [82]

“1. Failure to have laboratory control records that include complete data derived from all laboratory tests
conducted to ensure your API complies with established specifications and standards.

Our investigator found that your firm was falsifying laboratory data. For example, the number of colony-forming
units (CFU) found on (b)(4) plates for (b)(4) water point-of-use tests differed substantially from the number
recorded on your (b)(4) water report. For multiple points of use, your analyst reported far fewer CFU than
observed on the plate by our investigator. In addition, while you reported absence of growth on a selective
media plate used to detect objectionable microorganisms, our investigator observed growth on this plate. This is
concerning because you use (b)(4) water to manufacture products, such as (b)(4) API, that are intended for use
in sterile injectable dosage forms.

We acknowledge your decision to suspend production of (b)(4) and (b)(4) API based on your risk assessment,
and your commitment to a third party data integrity assessment. We also acknowledge your commitment to
conduct a risk analysis and data review for distributed products, and to sanitize and validate the (b)(4) water
system. We request that you notify FDA before resuming production of (b)(4) and (b)(4) API for U.S. supply.

In response to this letter, provide your data integrity remediation efforts as requested in the Data Integrity
Remediation section of this letter below. In addition, provide the following:

• An independent assessment of your water system design, control, and maintenance;

• A comprehensive corrective action and preventive action (CAPA) plan for improving design, control, and
maintenance of your water system;

• Your (b)(4) water system validation report;

• A summary of improvements made to your water system design, as well as to your program for ongoing
control and maintenance;

• The total count and endotoxin limits that you currently use for this system.”
Page 68 ISPE Good Practice Guide:
Appendix 1 Critical Utilities GMP Compliance

6.9 Letter 9 – Lack of or Insufficient Investigation of Water System Failures

Date: 12 January 2018

Subject: CGMP/Finished Pharmaceuticals/Adulterated [83]

“1. Your firm failed to thoroughly investigate any unexplained discrepancy or failure of a batch or any of its
components to meet any of its specifications, whether or not the batch has already been distributed (21 CFR
211.192).

Your firm failed to investigate test results showing that your water exceeds the allowable limit for microorganisms.
Your tests on samples from your water system indicated that microorganism levels were too numerous to count
(TNTC) on 25 out of 96 days. You use this water as a major component in manufacturing over-the-counter (OTC)
drug products. Your failure to investigate violated your written procedures which require an investigation when
results are above (b)(4) colony-forming units/milliliter (cfu/mL).

This system is fundamentally flawed as it is not capable of producing water that is suitable for use in
pharmaceutical manufacture. In your response, you state that bulk product tests met drug product microbiological
specifications. Your response is inadequate because quality control testing of a limited sample is insufficient to
establish that a product is acceptable. Because microbiological contamination is not uniformly distributed and
difficult to detect during testing, it is essential that stringent upstream controls be employed to assure the quality
of a batch.

We note that you plan to eliminate dead legs in your water system. However, you did not commit to
comprehensively redesign your system and create a new program for ongoing control, maintenance, and
monitoring that ensures your firm consistently produces purified water that meets USP monograph specifications
and appropriate microbial limits.

Your response is also inadequate because it did not address your failure to investigate the frequent, excessive
levels of microorganisms in your water system. You did not explain how you will ensure adequate and effective
investigation of out-of-limit test results moving forward.

In response to this letter, provide the following:

• A comprehensive evaluation of the water system design along with thorough corrective and preventive
actions to be taken to install a suitable system.

• An effective program for ongoing control, maintenance, and monitoring that ensures the system consistently
produces water that meets the purified water USP monograph specifications and appropriate microbial
limits. Regarding the latter, it is important to note that total count limits that are significantly tighter than (b)(4)
cfu/mL are appropriate for most topical products.

• A detailed risk assessment of the potential effects of the observed water system failures on the quality
of each of your drug product lots within expiry, and notification to your customers of these significant
deviations. This assessment should prioritize review of all lots made on a day that a water system sample
was found to have TNTC levels. The assessment should not be restricted to products made with water
solely from the sampling point that yielded excessive contamination, but also extend to other potentially-
affected lots made with water from the system when it yielded this excessive contamination. Also, include
other corrective actions and preventive actions (CAPA), including recall, if appropriate.

• A thorough assessment of your overall systems for investigating deviations, atypical events, out-of-
specification (OOS) results, and failures. Your CAPA should include but not be limited to assuring that you
promptly review various sources of variation in your operations that may cause errors, deviations or failures,
and enhanced oversight and final approval of investigations by the quality unit.”
ISPE Good Practice Guide: Page 69
Critical Utilities GMP Compliance Appendix 2

7 Appendix 2 – Inspection Hosting Good

Appendix 2
Practices and Readiness Checklist
Maintaining compliant CU is a continual process. Demonstrating that compliance can best be achieved by planning
and preparedness. The main chapters of this Guide include inspection expectations specific to CU, for example,
having the latest water system microbial monitoring data readily available. This appendix offers preparation
suggestions that apply to any type of audit and inspection, such as plans for retrieving the documents anticipated for
review, identifying the personnel who will participate in an inspection, and determining site logistics. These broadly
applicable recommendations are included here for completeness.

Some general themes covered in this chapter include:

• Inspection hosting and management

• Availability of support documentation

7.1 Inspection Hosting and Behaviors

In order for audits and inspections to proceed efficiently, there are logistic and hosting activities an organization may
identify before an inspection, including informing personnel of their roles.

• Reception

Processes should be in place to receive a regulatory inspector. This should take place at the secured main
entrance to the facility. The process includes verifying the inspector’s credentials, signing into the facility,
notifying management of the inspector’s arrival, and conducting a site safety orientation of the inspectorate staff.
Best practice for notification includes a list of individuals and alternates to be notified and the order in which they
are notified, or a call tree.

The inspector should be greeted by trained audit support personnel in as little time as possible.

• Rooms

At a minimum one room should be secured to host the inspector. If there are multiple inspectors, it may be
beneficial to secure separate rooms for each, if feasible, to avoid confusion caused by multiple conversations
occurring at once.

Inspection hosting best practice includes the use of a backroom or preparation room. The backroom supports
inspection management activities such as tracking the inspector’s requests for documentation, preparing SMEs,
and formulating responses to inquiries. In addition, the requested documentation is reviewed in the backroom,
prior to giving it to the inspector, to ensure the request is addressed properly.

• Personnel

The following roles are recommended to facilitate a successful inspection:

- Host/Escort – Typically a host or escort is designated for each inspector. This individual serves as the
primary liaison with the inspector and remains with them at all times. The inspector should not to be left
unescorted within the facility. The host should be familiar with both the company’s quality system and
manufacturing operations so that they can field questions without the assistance of SMEs when feasible.
Page 70 ISPE Good Practice Guide:
Appendix 2 Critical Utilities GMP Compliance

- Scribe – A scribe is assigned to each inspector to record information requests, questions, and discussions.
This recorded information is shared with runner and support staff. (Using an electronic system can quickly
and efficiently update backroom support personnel.)

- Tour Guide – Typically inspectors and auditors request a tour of the facility. This may be led by one person
(and a scribe) with general knowledge of the facility, or a small group in which SMEs are available for the
area of focus.

- Runner and Support Staff – Runners and support staff obtain documents requested by the inspector from
the backroom to allow the scribe and host to continue working with the inspector without interruption or
delay.

- SME – Ideally SMEs are on hand in the backroom. If this is not possible, SMEs are readily available to
answer questions and explain processes when needed. SMEs are typically the process owners of the
subject to which they will speak.

- Backroom Lead – This lead manages the activities of the backroom and ensures document requests and
SME availability are met in a timely manner.

- Interpreter – If necessary, an interpreter/translator should be brought in to help in translating requests from

the inspectorate staff.

• Inspection Interaction

An inspection is a formal process and should be treated as such. The inspector should be addressed and
conversed with in a professional and respectful manner. Questions should be answered truthfully without
embellishment. If there is uncertainty for an answer, site personnel are advised to not speculate; it is acceptable
to take notes on the request and follow-up with an answer later. If it is not clear what the inspector is requesting,
discuss the question for clarification.

7.2 Opportunities for Improvement

An early part of a regulatory inspection is usually a tour of the facility, often a specific portion of the facility that could
be the focus of the audit. Having available an up-to-date blueprint of the facility, including the layout of the CU, helps
to identify the route for the tour.

The first thing a regulatory inspector or site auditor sees when entering a manufacturing or manufacturing support
area is its general physical condition and upkeep. After that, specific areas become apparent, such as wetness;
hose handling; equipment and piping design, condition, and tagging; pest control efforts; and the competence and
knowledge of the tour guides.

First impressions are important and can set the tone for the audit and where the auditor directs his/her focus
thereafter. An unkempt facility implies a disregard for GMP and sensitizes the auditor to look for other poor
manufacturing processes or poor GMP attitudes that could directly affect product quality. It should be remembered
that anything out of the ordinary, or not as clean as possible, may raise questions from the auditor. If the answers do
not alleviate the inspector’s concerns, the focus of the audit may become intent on finding deficiencies. Having a well-
maintained facility that meets a stringent level of cleanliness helps to show that the facility is committed to meeting
GMPs.
ISPE Good Practice Guide: Page 71
Critical Utilities GMP Compliance Appendix 2

7.2.1 Identifying Opportunities for Improvement

Sometimes things that an auditor may not typically see may be “normal” for facility personnel since they have lived
with or accommodated non-optimal conditions for a long time. Long-term, single-employer personnel and managers
are more prone to this than experienced, multiple-employer personnel. There is benefit to preparatory audits
conducted by auditors familiar with regulatory expectations but unfamiliar with the facility. One such source could be
third-party auditors, possibly by customers of a contract manufacturing operation. Auditors from sister sites within the
company as well as consultants could also be used for auditing the facility. The intent of these audits is to identify
deficient operations, designs, and other issues at the site that may have been overlooked by site personnel. The
findings offer opportunities for the site to address prior to a regulatory audit, if possible, or to develop remediation
plans with defined timelines.

7.2.2 Tour Guide Competence

The CUs tour guide should be an SME on the CU, knowledgeable not only of this process but other manufacturing
processes as well. If this person is not intimately familiar with the CU system procedures (which may give a negative
impression to the auditor), then they may defer an answer until after reviewing the SOP on the subject.

There is a delicate balance in the impression given to an auditor by a quick, authoritative verbal response of
inaccurate information versus a tentative response deferred to an SOP for verification. If it is a tentative answer from
someone who should be a knowledgeable area manager, it implies a lack of understanding of the practices they
oversee.

7.2.3 SOPs and Logbooks

There should be a company policy that addresses sharing documentation with regulators that should be part of the
staff’s training requirements. With respect to CU the policy should allow for sharing of all information. The regulator
should be provided with copies of the requested documents, or specific pages.

During the tour, the auditor may ask for a copy of an SOP associated with an observed practice or operation. The
auditor should be informed that a copy of the SOP will be provided after returning to the interview room (if consistent
with company policy) unless they want to view it immediately. In this case, the auditor should be shown the SOP
utilized by the manufacturing personnel in that area. The accuracy of any verbal response as well as the availability
of that SOP in the area where it is executed will be noted by the auditor as another indication of good or poor
manufacturing procedures.

The procedures should be the effective versions and may be centrally located, or hanging or posted in the area
where they are used. The auditor may note the revision number of the SOP, and after returning to the interview room,
may ask for the effective SOP to see if it has the same revision number. If it does not, this is an indication of poor
document control. Another indication of poor compliance is the use of locally posted unofficial procedures, such as
hand-written notes and reminders. These are another indication of uncontrolled documentation processes.

The auditor may ask to see a logbook where drain cleaning activities are recorded (which could also reveal an
inaccurate verbal response of cleaning frequency). If no logbook or SOP exists for this activity, this negative
impression may lead the auditor to conclude that not all manufacturing activities are described in SOPs or recorded in
logbooks, and that the activity may be subject to variable execution and frequency.

Some facilities no longer utilize paper procedures and logbooks; thus, when an auditor requests information found
in electronic systems, printouts of the requested information should be provided. Such electronic documentation
systems facilitate access to information, so it is less likely for documentation to be lost, misplaced, or outdated as
might occur with paper documentation systems. Evidence of compliance to electronic records regulations may be
requested.
Page 72 ISPE Good Practice Guide:
Appendix 2 Critical Utilities GMP Compliance

Regardless of how SOPs and logbooks are managed, they should be current and readily available for use by area
personnel, which in turn makes the requested information readily available for an auditor or inspector.

7.3 Inspection Readiness Checklist

Table 7.1 is an example checklist to help organizations prepare for a regulatory inspection or audit.

Table 7.1: Inspection Readiness Checklist

Element Requirement Verification of Completion

Logistics Procedure in Place for Inspector

Reception

Call List Established

Initial Reception Room Identified

Front Room Identified

Backroom Identified

Responsibility for Refreshments for

Front and Backrooms Assigned

Site Wide Communication that an

Inspection is Underway prepared

Personnel Hosts Identified

Scribes Identified

Runners Identified

Backroom Lead Identified

SMEs Identified

Supporting Staff Identified

Documentation Review of Last Audit – Evidence

that CAPAs have been addressed

SOPs Reviewed and Latest

Revision Available

Housekeeping and Gowning

Process and Procedures Available

QC Testing Methods and Latest

Revisions Available

Drawings Reviewed and Latest

Revisions Available

Drawings (for Tour) – Sized Suitably

Maintenance Records Reviewed

and Up-to-Date

Calibration Records Reviewed and

Up-to-Date
ISPE Good Practice Guide: Page 73
Critical Utilities GMP Compliance Appendix 2

Table 7.1: Inspection Readiness Checklist (continued)

Element Requirement Verification of Completion

Documentation (continued) Training Records Reviewed and

Up-to-Date

Passivation Records Available

Change Control Records –

Reviewed and Closed Out

Deviation Reports – Reviewed and

Closed Out

Validation Master Plan Available

Qualification/Validation Protocols
and Reports Available

Trending Reports Available

Pest Control Records Available

Area Check Area Clean, No Leaks

Verify Printed Documents Up-to-

Date or Not Present

Verify Alarm Logs (Omissions,

Review Signatures)

Verify Logbooks (Omissions,

Review Signatures)

Verify In-Place Calibration Stickers/

For Information Only

Confirm Physical and Logical

Security

All Personnel Appropriately

Gowned/PPE

Equipment Status – Clear and

Unambiguous
ISPE Good Practice Guide: Page 75
Critical Utilities GMP Compliance Appendix 3

8 Appendix 3 – Sampling Practice and

Appendix 3
Planning Supplemental Information
Refer to ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3] for a
complete discussion of sampling best practices including the design and execution of sampling programs.

8.1 Testing SOP and Test Materials Preparation

As with any routine procedure performed in a GMP facility, the water testing SOP and laboratory operations SOPs
should contain specific details describing how to perform the testing, including preparation of the materials and
apparatus used, as well as the preparation of the personnel and their practices.

Poorly performed water sample testing can cause results resembling water system contamination (false positives,
consuming investigation and action resources). Thus, it is important that laboratory SOPs not only be detailed, but
also include all relevant activities. The instructions contained in employee training programs should also be specified
in SOPs. For example, laboratory SOPs need to describe in detail the surface sanitization activities of the hood where
the testing is performed in addition to the surface sanitization of sample containers and expendables placed in the
hood for use in the test.

Written procedures should cover the donning and use of appropriate protective clothing, sterile sleeves, gloves, etc.,
as well as the appropriate method and contact time for sanitizing (particularly the gloves) with alcohol. A laboratory’s
vacuum system can be a source of test contamination, so if a reused vacuum manifold apparatus is used for the
filtration test, then written procedures should specify that this unit be autoclaved every day (nightly for a day shift
laboratory operation). The specifics of the aseptic techniques used in testing need to be captured in laboratory SOPs.

8.2 Examples of Good and Poor Water Sampling and Water Use Practices

Poor water sampling practices can result in microbial data discrepancies of user-defined action levels or
specifications.12 These preventable excursions then call into question the validity of results from the sampling
program in general and will rightly draw attention from regulatory officials.

Note: Water sampling practices should reflect manufacturing practices. If a poor manufacturing practice is in place,
the sampling procedure should not be changed until the manufacturing procedure is improved.

Regardless of ideal sampling procedures, there are some outlet use activities and related design features that
frequently contribute to contaminated samples. This is especially true if using chemical sanitizers rather than hot
water or steam, and where biofilm has been allowed to develop.

• Poorly orienting the hose during storage so that water can puddle within or not drain efficiently from the hose

• Leaving hoses connected and wet so that they never dry

• Allowing the end of the hose to contact the floor or sink bottom before or after use

• Using very long hoses (> about 10 feet) that, even though properly stored, never completely dry between uses

12
Investigation and remedial measures should be taken when results approach or exceed action limits. The determination of these limits, and
investigations and CAPA are explored in the ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3].
Page 76 ISPE Good Practice Guide:
Appendix 3 Critical Utilities GMP Compliance

• Having long unrefreshed hose use periods (> 1 week) that could allow long-term biofilm development within the
hose, especially with frequently used hoses that do not have a chance to dry between uses

• Not flushing the hose or pipe to drain prior to every water transfer for manufacturing use*

• Incorrect or insufficient connecting piping slopes to allow complete drainage between uses

• Poorly sequenced valve actuation in connecting piping from water systems that trap water within the piping

• Very long connecting piping runs (> 10 feet) between the water system and the equipment that compromise
drainability after use

*It is common for older-style piping connections (ones installed before the awareness of the need to flush before use)
not to be designed for flushing to drain and therefore flushing is not done. Also, there may be areas without readily
accessible drains or easy ways of flushing the volume of water at the fast flow rate needed for an effective flush, so
personnel do not flush at all or flush at an ineffective velocity.

The following list contains examples of good water use practices that can mitigate the microbial contamination that
often causes discrepancies:

• Vigorously flushing water through the use port and its connector prior to use and sampling

Note: The flushing technique used prior to sampling should be the same as that used when dispensing water for
use in production.

• Properly disconnecting and storing a reused hose so that the water drains out and the hose is allowed to dry
(upside down “U” orientation)

• Frequently replacing reused hoses with freshly sanitized or sterile hoses or always using a fresh sterile hose for
any water transfer

Note: The level of diligence in adhering to this best practice is determined by the purity, temperature, and
composition of the water dispensed (i.e., dispensing hot water or ozonated water may sanitize the hose)

• Sanitizing the use port valve, connector (e.g., hose or hard-piped connection), and associated devices (e.g., flow
meter, flow-reducing orifice, or heat exchanger) whenever the water system is sanitized by flushing the sanitizing
agent through the connected flow path and devices

• Sanitizing the water-receiving vessel along with the piped connector and downstream surfaces of the use port
valve on the water system prior to water transfer to the vessel

• Capturing in SOPs precise and complete details for outlet sanitization, hose and gasket storage, hose use
handling practices, and outlet pre-use flushing specifications (such as valve opening degree and flush duration
or volume) and not leaving such details to training programs. Vague procedures invite variable execution and
variable test results.

8.3 Microbial Discrepancies Caused by Poor Sampling Methods

Microbial discrepancies could be indicative of true microbial control problems within the water system. Unfortunately,
many if not most microbial discrepancies seen in the testing of water system samples are preventable, caused
by poor or inconsistent sampling practices. In either case, an auditor or inspector typically reviews microbial
discrepancies and how they are addressed.
ISPE Good Practice Guide: Page 77
Critical Utilities GMP Compliance Appendix 3

Regardless of the cause of the discrepancy, whether real or a sampling artifact, it must be resolved and prevented.
Recurring discrepancies are a sign that the underlying cause has not been properly identified and mitigated. This
often leads to increased scrutiny during an audit or inspection. (See Section 6.5 for an FDA warning letter issued
for inadequately handled microbial discrepancies.) Many times mitigation is simply the institution of better or more
consistent sampling practices. However, if those sampling practices are poor as a result of mimicking poor water
use practices, then the recurring discrepancies can be mitigated by simply improving water use practices, which the
sampling practices can then emulate.

For optimal water sampling (and use) practices, refer to ISPE Good Practice Guide: Sampling for Pharmaceutical
Water, Steam, and Process Gases [3]. There are numerous potential contributors to inadequate sampling practices,
one of which is incorrectly or vaguely described sampling methods in SOPs. This leads to the use of inconsistent
approaches among samplers and at different outlets. In addition, this procedural vagueness may cause highly
variable test results, an indicator that the sampling methods are the reason for the discrepancies. For example, the
discrepancies are rarely reproducible when “correctly” resampled.

Often the sampler is blamed for inconsistent sampling results (not “doing it right”) and retraining is the preventive
measure; however, human error may not be the root cause. Again, this could be from a lack of clarity and the
absence of specific detail in the sampling SOP. When the SOP contains unambiguous, precise detail of how to
achieve, for example, the needed flow rate velocity during flushing [3], sampling may be done consistently by every
sampler without sole reliance on perhaps forgotten verbal details provided during training.

One goal of water sampling for QC purposes is to reflect the quality of water used when manufacturing products. At
POU, proper sampling exactly duplicates how personnel obtain water from the distribution system for manufacturing
purposes. In other words, the samplers must use the exact hose used by manufacturing (not just a similar one or
a recently cleaned one (unless manufacturing only uses recently cleaned hoses)), using the same outlet/hose-
end sanitization process as manufacturing (if any), employing exactly the same flushing practice (if any), etc. If
QC sampling at the POU is performed in a fashion that differs from routine manufacturing so as to yield the lowest
possible microbial count, there is a risk of a regulatory citation that the firm is acting fraudulently by intentionally
making the data show better quality water than is actually used.

8.4 Sampling Plan

8.4.1 General Issues and PW System

The ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases [3] goes into detail
regarding sampling plans and typical frequencies for various types of water systems. Sampling plans are often the
subject of inspector scrutiny, especially if the plan contains inordinately infrequent sampling of system outlets that
could allow significant biofilm development to occur undetected between samplings (i.e., monthly or less frequent
outlet sampling), or usable but unsampled use port outlets with no risk analysis or justification for not being sampled.

Unflushed and unsampled outlets are a risk to the microbial control of the entire water system since biofilm
development in such a side leg could spread throughout the system. The simple act of outlet flushing (usually
associated with a sampling event) provides a degree of microbial control at that outlet by flushing away loose biofilm
within the outlet. Thus, periodic outlet flushing of every port, whether sampled at that time or not, ensures a degree of
outlet microbial control at every port. This microbial control phenomenon should be considered in a risk analysis when
there is a desire for less frequent outlet sampling as well as the desire not to sample unused outlets. Periodic outlet
flushing without sampling could provide the needed level of microbial control to little-used or unused and unsampled
outlets.

Outlets used for perceived inconsequential purposes that are not sampled is another poor practice. A risk-
based rationale should document why the use of the unsampled outlet is appropriate and does not increase risk
unacceptably.
Page 78 ISPE Good Practice Guide:
Appendix 3 Critical Utilities GMP Compliance

An additional reason for not taking water samples at an outlet could be inconvenience, possibly compounded by a
design deficiency. For example:

• No installed sampling port near the equipment end of a hard-piped connector between the water system and the
equipment

• No valving or automation allowing for pre-use flushing of hard-piped connections between the water system and
the equipment

• No convenient way to disconnect a “permanent” hose connection for sampling

• Inability to adequately flush:

- A large outlet transferring an uncontrolled large volume of water that cannot be easily sampled due to high
flow rate

- Due to no convenient way to collect and dispose of flushed water because of an absence of nearby drains or
the volume of flushed water13

• A sample port only on the use port valve that allows samples of the distribution loop water, not transferred water

• A perceived risky area for outlet flushing (e.g., in a clean room with no drains or because of close proximity to
electrical equipment)

• Outlet installed in an ergonomically challenging location where routine access for sampling is difficult

These deficiencies may be viewed by an investigator or auditor as insufficient reasons for not sampling and
an unsound rationale. These scenarios should be brought into compliance quickly. If this is not possible, a risk
assessment should be developed documenting mitigation activities. Refer to the ISPE Good Practice Guide:
Sampling for Pharmaceutical Water, Steam, and Process Gases [3] for advice on corrective actions.

8.4.2 WFI System

For WFI systems, the expected sampling pattern and frequency are more rigid than for PW. Industry common
practice is to sample every POU (not just use port) at least weekly, and then rotate through those outlets over the
course of the week, and sampling somewhere in the system daily [1]. Sampling intervals should be adjusted based
on risk assessment as discussed in the ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and
Process Gases [3]. To use a WFI outlet that is not sampled is particularly risky unless a thorough risk analysis justifies
this otherwise unacceptable situation.

An outlet no longer in use and not sampled is also a significant risk, especially considering the microbial control
afforded by outlet flushing prior to sampling and the very tight microbial limits for WFI systems, where essentially no
biofilm development is tolerated in the distribution system. As in the PW discussion in Section 8.4.1, the potential
negative consequences to microbial control could be addressed by routine outlet flushing without sampling.
Nevertheless, a risk assessment is needed to justify this scenario.

13
Note: Adequate water velocity during the flushing of the water piping/hoses/valves is very important. It is recommended that velocities higher than
8 ft/sec be used for flushing [3].
ISPE Good Practice Guide: Page 79
Critical Utilities GMP Compliance Appendix 4

9 Appendix 4 – Compendial Water

Appendix 4
Specifications
Table 9.1 lists the pharmacopeial specifications for GMP water used for manufacturing. These should be considered
when there is a need to replicate manufacturing conditions. This table was originally published in ISPE Baseline®
Guide: Volume 4 – Water and Steam Systems [4].
Page 80 ISPE Good Practice Guide:
Appendix 4 Critical Utilities GMP Compliance

Table 9.1: Specification Summary for Various Pharmacopeial Water Grades – Part 1: European, Japanese, US,
and Indian Pharmacopoeias [4]

Organization/ European Pharmacopoeia 9.8 Japanese Pharmacopoeia XVII US Pharmacopeia 42 (2018) Indian Pharmacopoeia
Reference (2019) (2016) (2018)

Water Grade or Purified Water for Highly Water Purified Water for Purified Water for Purified Water for
Type Water Injection Purified Water Injection Water Injection Water Injections
Water(5)
Specified Drinking Drinking Japanese “Water” Water or Drinking Drinking Drinking Purified
Source and Water Water Drinking Source; Purified Water Water Water Water
Purification Source; Source; Water RO, UF, Water Source; Source (US, Source; Source;
Approaches Dist or DI Distillation (Water Deionization, Source; Suitable EU, Japan, Dist or DI or Distillation
or RO or Supply Law, Distillation, Distillation process WHO); RO or other or
or other purification Ordinance or a or RO-UF Distillation or suitable equivalent/
suitable process No.101, combination equivalent/ methods superior
European Pharmacopoeia (Ph. Eur.) Commission Suppressed Highly Purified Water (HPW)

methods equivalent Article 4, thereof superior process

2003) process
Description Clear and Clear and * Clear and Clear and * * Clear, Clear,
colorless colorless colorless colorless colorless, colorless,
liquid liquid liquid having liquid having odorless odorless
no odor no odor liquid liquid

pH value at * * * * * * * * *
from the Ph. Eur. effective 01APR2019

25°C (inclusive
range)
Acidity or * * * * * * * MRed – MRed –
Alkalinity not red, not red,
BTBlue – BTBlue –
not blue not blue
Conductivity 5.1(1) 1.3(1) * 2.1(2) 2.1(2) 1.3(1) 1.3(1) 5.1(1) 1.3(1)
µS/cm @25°C, [1.3(1) in [1.3(1) in
maximum JP Info JP Info
Ch 21] Ch 21]
TOC (as C), 0.5 mg/l 0.5 mg/l * 0.50 mg/l 0.50 mg/l Instrument Instrument 0.5 mg/l 0.5 mg/l
maximum (500 ppb)(3) (500 ppb)(3) (500 ppb)(3) (500 ppb)(3) response to response to (500 ppb)(3) (500 ppb)(3)
[Alt to Ox 0.50 mg/l 0.50 mg/l [Alt to Ox
Sub] standard standard (500 Sub]
(500 ppb)(3) ppb)(3)
Oxidizable Negative to * * * * * * Negative to *
Substances test of test of
(Permanganate 0.1 ml of 0.1 ml of
Red. Subst.) 0.02M 0.02M
KMnO4 KMnO4
[Alt to TOC] [Alt to TOC]
Residue after * * * * * * * * *
evaporation
on heating at
105°C, mg/100
ml, maximum
Notes:
*Not Specified, Not Required, Not Applicable, or No Limit
1. In-line/Stage 1 Conductivity specification at 25°C with other values at other temperatures. Ph. Eur.’s WFI and USP’s PW and WFI additionally have off-line Stage 2 and 3
specifications which may alternatively be met.
2. Performed as an atmosphere and temperature equilibrated test. Alternatively, per JP Chapter 21, the test may be performed in-line with the specified limit at 25°C and
other values at other temperatures. There is no USP <645> Stage 3-like option in JP.
3. Due to significant figures, Ph. Eur.’s, MP’s, and IP’s TOC specifications are not greater than 549 ppb, whereas JP’s, ChP’s, BrP’s and USP’s are not greater than 504 ppb.
4. Not required if Conductivity meets WFI specifications.
5. Deleted in 2019.
6. If private sourced water is used, must comply with Japanese Drinking Water, plus this Ammonia limit.
7. Used where high biological quality required.
ISPE Good Practice Guide: Page 81
Critical Utilities GMP Compliance Appendix 4

Table 9.1: Specification Summary for Various Pharmacopeial Water Grades – Part 2: Chinese, Brazilian,
Mexican, and International Pharmacopoeias [4]

Organization/ Chinese Pharmacopoeia Brazilian Pharmacopoeia 5 Pharmacopoeia of the International

Reference (2015) (2010) United Mexican States 12 Pharmacopoeia
(2018) 8th Edition
(2018)
Water Grade or Purified Water for Purified Water for Ultrapure Purified Purified Water for Purified Water for
Type Water Injection Water Injection Water Water Water Injection Water Injections
Level 1 Level 2(7)
Specified Drinking Purified Drinking Properly Purified Drinking Drinking Potable Suitable Potable or
Source and Water Water Water Treated Water Water Water Water Water Purified
Purification Source; Source; Source; Water Source; Source; Source; Source; Source; Water
Approaches Dist or DI Distillation Dist or DI Source; supplemental Dist or RO e.g., Dist or Dist, DI, Source;
or RO or RO Distillation purification or DI or 1P/2P RO; equivalent RO, or Distillation
or other or other with Dist, Other UF, DI, EDI other
suitable suitable DI, RO, suitable
methods methods other methods

Description Clear, Clear, Clear, Clear, Clear, Transparent Transparent Transparent Clear, Clear,
colorless colorless colorless, colorless, colorless, and colorless and colorless and colorless colorless
liquid, liquid, tasteless, tasteless, tasteless, liquid liquid colorless liquid; liquid;
odorless odorless odorless liquid odorless odorless liquid odorless odorless
liquid liquid
pH value at * 5.0–7.0 * * * 5.0–7.0 * * * *
25°C (inclusive
range)
Acidity or MRed – * MRed – MRed – * * * * MRed – MRed –
Alkalinity not red, not red, not red, not red, not red,
BTBlue – BTBlue – BTBlue – BTBlue – BTBlue –
not blue not blue not blue not blue not blue
Conductivity 5.1(1) 1.3(1) 1.3 1.3 0.1 5.1(1) 1.3(1) 1.3(1) * *
µS/cm @25°C, (Alt to NH3, (Alt to NH3,
maximum Ca/Mg, Cl, Ca/Mg, Cl,
NO3, SO4) NO3, SO4)
TOC (as C), 0.50 mg/l 0.50 mg/l 0.50 mg/l 0.50 mg/l 0.05 mg/l 0.5 mg/l 0.5 mg/l 0.5 mg/l * *
maximum (500 ppb)(3) (500 ppb)(3) (500 ppb)(3) (500 ppb)(3) (50 ppb) (500 ppb)(3) (500 ppb)(3) (500 ppb)(3)
[Alt to Ox [Alt to Ox Sub] [Alt to Ox [Optional, [Alt to Ox
Sub] Sub] application- Sub]
specific]
Oxidizable Negative to * Negative to Negative to Negative to * * Negative to Negative to
Substances test of test of test of test of test of test of
(Permanganate 0.10 ml 0.2 ml of 0.2 ml of 0.1 ml of 0.5 ml of 1% 0.2 ml of
Red. Subst.) of 0.02M 0.02M KMnO4 0.02M 0.02M KMnO4 0.02M
KMnO4 [Alt to TOC] KMnO4 KMnO4 KMnO4
[Alt to TOC] [Alt to TOC] [Alt to TOC]
Residue after 1 1 * * * * * * 1 (5 mg 1 (5 mg
evaporation from 500 ml) from 500
on heating at ml)
105°C, mg/100
ml, maximum
Notes:
*Not Specified, Not Required, Not Applicable, or No Limit
1. In-line/Stage 1 Conductivity specification at 25°C with other values at other temperatures. Ph. Eur.’s WFI and USP’s PW and WFI additionally have off-line Stage 2 and 3
specifications which may alternatively be met.
2. Performed as an atmosphere and temperature equilibrated test. Alternatively, per JP Chapter 21, the test may be performed in-line with the specified limit at 25°C and
other values at other temperatures. There is no USP <645> Stage 3-like option in JP.
3. Due to significant figures, Ph. Eur.’s, MP’s, and IP’s TOC specifications are not greater than 549 ppb, whereas JP’s, ChP’s, BrP’s and USP’s are not greater than 504 ppb.
4. Not required if Conductivity meets WFI specifications.
5. Deleted in 2019.
6. If private sourced water is used, must comply with Japanese Drinking Water, plus this Ammonia limit.
7. Used where high biological quality required.
Page 82 ISPE Good Practice Guide:
Appendix 4 Critical Utilities GMP Compliance

Table 9.1: Specification Summary for Various Pharmacopeial Water Grades – Part 1: European, Japanese, US,
and Indian Pharmacopoeias [4] (continued)

Organization/ European Pharmacopoeia 9.8 Japanese Pharmacopoeia XVII US Pharmacopeia 42 (2018) Indian Pharmacopoeia
Reference (2019) (2016) (2018)

Water Grade or Purified Water for Highly Water Purified Water for Purified Water for Purified Water for
Type Water Injection Purified Water Injection Water Injection Water Injections
Water(5)
Specified Drinking Drinking Japanese “Water” Water or Drinking Drinking Drinking Purified
Source and Water Water Drinking Source; Purified Water Water Water Water
Purification Source; Source; Water RO, UF, Water Source; Source (US, Source; Source;
Approaches Dist or DI Distillation (Water Deionization, Source; Suitable EU, Japan, Dist or DI or Distillation
or RO or Supply Law, Distillation, Distillation process WHO); RO or other or
or other purification Ordinance or a or RO-UF Distillation or suitable equivalent/
suitable process No.101, combination equivalent/ methods superior
methods equivalent Article 4, thereof superior process
European Pharmacopoeia (Ph. Eur.) Commission Suppressed Highly Purified Water (HPW)

2003) process
Heterotrophic Action Level Action Level * Action Level Action Level 100 (optimal 0.1 (optimal 100 (R2A) 0.1 (10 cfu/
Bacteria 100 0.1 (10 cfu/ 100 (R2A) [in 0.1 (10 cfu/ medium) [in medium) (10 Absence 100 ml,
Count cfu/ml, [in 100 ml, Info 100 ml) Info cfu/ specified 200 ml
maximum monograph, 200 ml Ch 21,non- (R2A) Ch 1231, 100 ml, pathogens test) [in
mandatory] test) [in mandatory] [in Info non- 200 ml test) [in monograph,
monograph, Ch 21, non- mandatory] [in Info monograph, mandatory]
mandatory] mandatory] Ch 1231, non- mandatory]
mandatory]
from the Ph. Eur. effective 01APR2019

Bacterial < 0.25 < 0.25 * * < 0.25 * < 0.25 ≤ 0.25 ≤ 0.25
Endotoxins EU/ (dialysis (dialysis
ml or IU/ml (note solutions solutions
≤ or <) only) only)
Chloride µg/l, * * * * * * * * *
maximum
Sulfate, ppm, * * * * * * * * *
maximum
Calcium and * * * * * * * * *
Magnesium
ppm, maximum
Carbon Dioxide * * * * * * * * *
ppm, maximum
Ammonia ppm, * * 0.05(6) * * * * * *
maximum
Nitrates ppm, 0.2 0.2 * * * * * 0.2 0.2
maximum
Nitrites ppm, * * * * * * * * *
maximum
Aluminium ppb, 10 (dialysis 10 (dialysis * * * * * 10 (dialysis 10 (dialysis
maximum solutions solutions solutions solutions
only) only) only) only)
Heavy Metals 0.1(4) * * * * * * 0.1(4) *
ppm, maximum
Notes:
*Not Specified, Not Required, Not Applicable, or No Limit
1. In-line/Stage 1 Conductivity specification at 25°C with other values at other temperatures. Ph. Eur.’s WFI and USP’s PW and WFI additionally have off-line Stage 2 and 3
specifications which may alternatively be met.
2. Performed as an atmosphere and temperature equilibrated test. Alternatively, per JP Chapter 21, the test may be performed in-line with the specified limit at 25°C and
other values at other temperatures. There is no USP <645> Stage 3-like option in JP.
3. Due to significant figures, Ph. Eur.’s, MP’s, and IP’s TOC specifications are not greater than 549 ppb, whereas JP’s, ChP’s, BrP’s and USP’s are not greater than 504 ppb.
4. Not required if Conductivity meets WFI specifications.
5. Deleted in 2019.
6. If private sourced water is used, must comply with Japanese Drinking Water, plus this Ammonia limit.
7. Used where high biological quality required.
ISPE Good Practice Guide: Page 83
Critical Utilities GMP Compliance Appendix 4

Table 9.1: Specification Summary for Various Pharmacopeial Water Grades – Part 2: Chinese, Brazilian,
Mexican, and International Pharmacopoeias [4] (continued)

Organization/ Chinese Pharmacopoeia Brazilian Pharmacopoeia 5 Pharmacopoeia of the International

Reference (2015) (2010) United Mexican States 12 Pharmacopoeia
(2018) 8th Edition
(2018)
Water Grade or Purified Water for Purified Water for Ultrapure Purified Purified Water for Purified Water for
Type Water Injection Water Injection Water Water Water Injection Water Injections
Level 1 Level 2(7)
Specified Drinking Purified Drinking Properly Purified Drinking Drinking Potable Suitable Potable or
Source and Water Water Water Treated Water Water Water Water Water Purified
Purification Source; Source; Source; Water Source; Source; Source; Source; Source; Water
Approaches Dist or DI Distillation Dist or DI Source; supplemental Dist or RO e.g., Dist or Dist, DI, Source;
or RO or RO Distillation purification or DI or 1P/2P RO; equivalent RO, or Distillation
or other or other with Dist, Other UF, DI, EDI other
suitable suitable DI, RO, suitable
methods methods other methods

Heterotrophic 100 (R2A) 0.1 (R2A) 1 (100 cfu/ 0.1 (10 cfu/ 0.01 (1 cfu/ * * * * *
Bacteria [in (10 cfu/ 100 ml) using 100 ml) 100 ml,
Count cfu/ml, monograph, 100 ml, any valid 200 ml, 200 ml test)
maximum mandatory] 200 ml test) method; also using [in
[in absence of any valid monograph,
monograph, E. coli and P. method) mandatory]
mandatory] aeruginosa [in
[in monograph,
monograph, mandatory]
mandatory]
Bacterial * <0.25 * ≤ 0.25 * * * < 0.25 * ≤ 0.25
Endotoxins EU/
ml or IU/ml (note
≤ or <)
Chloride µg/l, * * pass pass * * * * pass pass
maximum
Sulfate, ppm, * * pass pass * * * * pass pass
maximum
Calcium and * * 1 1 * * * * pass pass
Magnesium
ppm, maximum
Carbon Dioxide * * * * * * * * pass pass
ppm, maximum
Ammonia ppm, 0.3 0.2 0.2 0.2 * * * * pass pass
maximum
Nitrates ppm, 0.06 0.06 0.2 0.2 * 0.2 0.2 0.2 pass pass
maximum
Nitrites ppm, 0.02 0.02 * * * * * * * *
maximum
Aluminium ppb, * * * * * * * * * *
maximum

Heavy Metals 0.1 0.1 * * * 0.1 * * pass pass

ppm, maximum
Notes:
*Not Specified, Not Required, Not Applicable, or No Limit
1. In-line/Stage 1 Conductivity specification at 25°C with other values at other temperatures. Ph. Eur.’s WFI and USP’s PW and WFI additionally have off-line Stage 2 and 3
specifications which may alternatively be met.
2. Performed as an atmosphere and temperature equilibrated test. Alternatively, per JP Chapter 21, the test may be performed in-line with the specified limit at 25°C and
other values at other temperatures. There is no USP <645> Stage 3-like option in JP.
3. Due to significant figures, Ph. Eur.’s, MP’s, and IP’s TOC specifications are not greater than 549 ppb, whereas JP’s, ChP’s, BrP’s and USP’s are not greater than 504 ppb.
4. Not required if Conductivity meets WFI specifications.
5. Deleted in 2019.
6. If private sourced water is used, must comply with Japanese Drinking Water, plus this Ammonia limit.
7. Used where high biological quality required.
ISPE Good Practice Guide: Page 85
Critical Utilities GMP Compliance Appendix 5

10 Appendix 5 – Microbial Enumeration:

Appendix 5
Consideration of Nutrient Media, Incubation
Temperature, and Incubation Time
10.1 Growth Medium Choice

There is much controversy over the appropriate microbial test method to use for water samples, regardless of
whether they were taken from sample ports or POU. The controversy centers primarily on the appropriate growth
medium, but also could involve incubation temperature and duration.

One side of this controversy favors the use of R2A Agar, a so-called “low nutrient” medium thought to be most
appropriate for recovering the greatest number of isolates in high purity water. R2A has been shown to be superior
to “high nutrient” media, such as PCA, or even richer media, for potable water testing. This superiority has been
simplistically ascribed to the R2A medium’s low nutrient concentrations because of the relatively low nutrient levels
in potable waters and the perception that a growth medium only slightly richer than the cultured environment should
avoid some of those microorganisms essentially “choking” on an overly rich medium. But R2A’s diversity of nutrient
types and the richer media’s less nutrient diversity may also be an important factors, especially for recovering the
nutritionally diverse microbiome of potable waters. Nevertheless, because of this low nutrient superiority perception,
R2A is specified in Ph. Eur. [13] PW and WFI monographs for microbial testing these even lower nutrient waters.

The other side of the controversy considers the concentration and diversity of nutrients in a growth media to
be relatively inconsequential because of the hypothetical “omnivorous” nature of a compendial water system’s
microbiome. These microorganisms survive and proliferate in the very pure water of a compendial water distribution
system because they utilize whatever nutrient type is available. These nutrient sources include organic vapors
entering the holding tank through vent filters; organic impurities not removed from the source water or that “break
through” the final purification steps; inadvertent introduction of nutrients during routine maintenance activities
(e.g., handling of valve diaphragms during replacement activities); extractables from system materials especially
plastics and elastomers; residual non-inhibitory levels of chemical disinfectants or their breakdown products, etc.
The potential nutrient sources are numerous and unpredictable in a water system; hence, the system’s ecological
selection for “omnivorous“ organisms that utilize a wide array of nutrient types present (even temporarily) in the water,
making it possible for media other than R2A to be effective.

Using “high nutrient” media other than R2A may provide equivalent test results with less incubation time needed
to plateau the microbial counts with R2A Agar, which is advantageous to timely process control and water release
activities.

However, in order to use media other than R2A, especially when testing Ph. Eur. [13] PW and WFI, organizations
need to provide equivalency data as justification for the change. This can be achieved through in-house media
comparison studies, where media of a variety of nutrient concentrations and types are tested, and the isolate
recovery determined when given adequate incubation time and appropriate incubation temperatures to allow the
colony counts to plateau for each media. A summary document14 with the data that supports the equivalency of a non-
R2A medium may provide a sound rationale to a regulator that water tested with this medium is compliant to Ph. Eur.

14
If compliance of the compendial water with a Ph. Eur. [13] monograph is claimed in the approved Marketing Authorization dossier, then companies
are not entitled to replace the test method by another one (even if equivalent).
Page 86 ISPE Good Practice Guide:
Appendix 5 Critical Utilities GMP Compliance

10.2 Incubation Conditions (Temperature and Duration)

There is a tendency in microbial testing in a pharmaceutical laboratory to use standard incubator temperature
ranges and durations. This may be suitable when testing finished products and raw materials other than water, but
may not be appropriate for water testing. Most products and raw materials have a bioburden through exogenous
contamination by environmental microorganisms. As such, these environmental contaminants typically fall into broad
groups with common incubation temperature optima and incubation durations.

This defined standard approach is not recommended for testing water. The bioburden in water has typically grown
there, and is not a result of recent exogenous environmental contamination. The environmental conditions within
the water system naturally select for organisms that prefer and grow best at that water system temperature. This is
not to say that these organisms cannot grow at temperatures outside of those conditions, but there are limits of that
tolerance. For example, for water systems that typically operate within 25°C–35°C, incubating microbial test samples
at 30°C–35°C usually allows the majority of the flora in those water systems15 to grow.

If a water system is consistently at 15°C–25°C, the microorganisms suited to grow at these temperatures may not
all produce colonies when incubated at 30°C–35°C. Incubation at 25°C–30°C may be more optimal for maximal
recovery. And for water systems that normally operate at even cooler temperatures, incubation temperatures may
need to be 20°C–25°C or even lower. The 30°C–35°C incubation temperature would almost certainly inhibit microbial
growth for some if not all of the indigenous flora of such cool systems, making this standard incubation temperature
range for pharmacopeial water testing unsuitable for testing water samples from cool systems. If sub-optimal
incubation temperatures are used, the microbial counts could be biased low and mislead the water system operator
and users into thinking the system is under microbial control. In such cases, an incubation temperature evaluation
should be done that allows the highest recovery levels.

The duration of incubation must also be tailored to the flora in the water system as well as the incubation
temperature. Some water systems have only fast growing bacteria colonizing them, but other systems may have
a mixture of fast and slow growers. Rather than blindly using a standardized incubation duration, a period should
be empirically determined that allows the colony count to stabilize, or plateau, so that no additional slower growing
colonies are seen. Warmer incubation temperatures tend to produce faster developing colonies than cooler
temperatures. But if beyond the maximal growth temperature of some fraction of the microbial population, those
warmer incubation temperatures will produce lower microbial counts than cooler incubation temperatures. Generally
speaking, the cooler the incubation temperature, the longer it will take for the colonies to develop. Ideally, the water
system owner should determine the conditions that result in the highest microbial count of the largest diversity of
microorganisms in the shortest time. Without this determination, the microbial counts could be biased low.

Inappropriate selection of the test temperature and duration could underestimate the true microbial count.
Consequently, there is a regulatory expectation that test methods used to enumerate a water system’s flora have
been optimized and the justification available for review.

15
With the exception of those microorganisms considered to be “Viable But Not Culturable” or VBNCs, which is not discussed here.
ISPE Good Practice Guide: Page 87
Critical Utilities GMP Compliance Appendix 6

11 Appendix 6 – References

Appendix 6
1. Guide to Inspections of High Purity Water Systems, July 1993, The Division of Field Investigations, Office of
Regional Operations, Office of Regulatory Affairs, US Food and Drug Administration, www.fda.gov.

2. ISPE Baseline® Pharmaceutical Engineering Guide, Volume 5 – Commissioning and Qualification, International
Society for Pharmaceutical Engineering (ISPE), Second Edition, June 2019, www.ispe.org.

3. ISPE Good Practice Guide: Sampling for Pharmaceutical Water, Steam, and Process Gases, International
Society for Pharmaceutical Engineering (ISPE), First Edition, December 2016, www.ispe.org.

4. ISPE Baseline® Pharmaceutical Engineering Guide, Volume 4 – Water and Steam Systems, International Society
for Pharmaceutical Engineering (ISPE), Third Edition, September 2019, www.ispe.org.

5. International Council for Harmonisation (ICH), ICH Harmonised Tripartite Guideline, Good Manufacturing
Practice Guide for Active Pharmaceutical Ingredients – Q7/Q7A, Step 4, 10 November 2000, www.ich.org.

6. Title 40 – Protection of Environment Chapter I – Environmental Protection Agency Subchapter D – Water

Programs Part 141 – National Primary Drinking Water Regulations, Code of Federal Regulations, US Food and
Drug Administration (FDA), www.fda.gov.

7. “Council Directive 98/83/EC of 3 November 1998 on the quality of water intended for human consumption,”
Official Journal of the European Communities, November 1998, eur-lex.europa.eu/legal-content/EN/TXT/PDF/?ur
i=CELEX:31998L0083&from=EN.

8. Guidelines for Drinking-Water Quality, Fourth Edition incorporating the first addendum, World Health
Organization (WHO), 2017, ISBN: 978-92-4-154995-0, www.who.int.

9. Ministry of Health, Labour and Welfare, Water Supply in Japan, “4. Water quality,” April 2004, www.mhlw.go.jp/
site_kensaku_english.html?q=dwqs.

10. FDA Compliance Program Guidance Manual, Compressed Medical Gases, Program7356.002E, March 2015,
www.fda.gov.

11. Food and Drug Administration Safety and Innovation Act (FDASIA) Public Law 112-144 – 9 July 2012,
www.fda.gov.

12. United States Pharmacopeia–National Formulary (USP-NF), www.usp.org/USPNF.

13. European Pharmacopoeia (Ph. Eur.), www.edqm.eu/.

14. ISPE Glossary of Pharmaceutical and Biotechnology Terminology, www.ispe.org.

15. 21 CFR Part 210 – Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of
Drugs; General, Code of Federal Regulations, US Food and Drug Administration (FDA), www.fda.gov.

16. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals, Code of Federal
Regulations, US Food and Drug Administration (FDA), www.fda.gov.

17. EMA Draft: Guideline on the quality of water for pharmaceutical use, EMA/CHMP/CVMP/QWP/496873/2018,
European Medicines Agency (EMA), November 2018, www.ema.europa.eu.
Page 88 ISPE Good Practice Guide:
Appendix 6 Critical Utilities GMP Compliance

18. Japanese Pharmacopoeia (JP) (English Version), www.pmda.go.jp/english/rs-sb-std/standards-development/

jp/0019.html.

19. Pharmacopoeia of the People’s Republic of China, Chinese Pharmacopoeia (ChP), www.wp.chp.cn.

20. European Standard BS EN 285:2015, Sterilization. Steam Sterilizers. Large Sterilizers, https://www.en-standard.
eu/bs-en-285-2015-sterilization-steam-sterilizers-large-sterilizers.

21. Health Technical Memorandum 01-01: Management and decontamination of surgical instruments (medical
devices) used in acute care, Part C: Steam sterilization, HTM 01-01, Department of Health & Social Care, United
Kingdom, March, 2013, www.gov.uk/government/publications/management-and-decontamination-of-surgical-
instruments-used-in-acute-care.

22. NFPA 99 Health Care Facilities Code, April 2018, www.nfpa.org.

23. ISO 8573, Compressed Air, International Organization for Standardization, (ISO), www.iso.org.

24. EudraLex Volume 4 – Guidelines for Good Manufacturing Practices for Medicinal Products for Human and
Veterinary Use, Annex 1: Manufacture of Sterile Medicinal Products, November 2008, http://ec.europa.eu/health/
documents/eudralex/vol-4/index_en.htm.

25. ISPE Good Practice Guide: Approaches to Commissioning and Qualification of Pharmaceutical Water and Steam
Systems, International Society for Pharmaceutical Engineering (ISPE), Second Edition, July 2014, www.ispe.org.

26. ISO 14644-1 Cleanrooms and Associated Controlled Environments – Part 1: Classification of Air Cleanliness,
International Organization for Standardization (ISO), www.iso.org.

27. International Council for Harmonisation (ICH), ICH Harmonised Tripartite Guideline, Pharmaceutical Quality
System – Q10, Step 4, 4 June 2008, www.ich.org.

28. International Council for Harmonisation (ICH), ICH Harmonised Tripartite Guideline, Quality Risk Management –
Q9, Step 4, 9 November 2005, www.ich.org.

29. ISO 14971:2019 Medical Devices -- Application of Risk Management to Medical Devices, International
Organization for Standardization (ISO), www.iso.org.

30. ISPE Baseline® Pharmaceutical Engineering Guide, Volume 7 – Risk-Based Manufacture of Pharmaceutical
Products, International Society for Pharmaceutical Engineering (ISPE), Second Edition, July 2017, www.ispe.org.

31. IEC 60812, Analysis Techniques for System Reliability – Procedure for Failure Mode and Effects Analysis
(FMEA), Second Edition, 2006, International Electrotechnical Commission (IEC), www.iec.ch.

32. International Council for Harmonisation (ICH), ICH Harmonised Guideline, Guideline for Elemental Impurities –
Q3D(R1), Step 4, 22 March 2019, www.ich.org.

33. EudraLex Volume 4 – Guidelines for Good Manufacturing Practices for Medicinal Products for Human and
Veterinary Use, Annex 15: Qualification and Validation, http://ec.europa.eu/health/documents/eudralex/vol-4/
index_en.htm.

34. PIC/S Guidance: PI 009-3 Aide-Memoire, Inspection of Utilities, 25 September 2007, Pharmaceutical Inspection
Co-operation Scheme (PIC/S), www.picscheme.org.

35. ISPE Good Practice Guide: Ozone Sanitization of Pharmaceutical Water Systems, International Society for
Pharmaceutical Engineering (ISPE), First Edition, July 2012, www.ispe.org.
ISPE Good Practice Guide: Page 89
Critical Utilities GMP Compliance Appendix 6

36. USP <1231> Water for Pharmaceutical Purposes, United States Pharmacopeial Convention, www.usp.org.

37. EudraLex Volume 4 – Guidelines for Good Manufacturing Practice for Medicinal Products for Human and
Veterinary Use, Chapter 1: Pharmaceutical Quality System, January 2013, http://ec.europa.eu/health/documents/
eudralex/vol-4/index_en.htm.

38. 21 CFR Part 820.100 – Quality System Regulation; Corrective and preventive action, Code of Federal
Regulations, US Food and Drug Administration (FDA), www.fda.gov.

39. ISO 9000:2015 Quality Management Systems – Fundamentals and Vocabulary, International Organization for
Standardization (ISO), www.iso.org.

40. USP General Information Chapter <1223> Validation of Alternative Microbiological Methods, United States
Pharmacopeial Convention – National Formulary (USP-NF), www.usp.org/usp-nf.

41. Ph. Eur. Chapter 5.1.6, “Alternative Methods for Control of Microbiological Quality,” European Pharmacopoeia
(Ph. Eur.), www.edqm.eu/.

42. Technical Report No. 33, Evaluation, Validation and Implementation of Alternative and Rapid Microbiological
Methods, Revised 2013, Parenteral Drug Association (PDA), www.pda.org.

43. ISPE GAMP® Guide: Records and Data Integrity, International Society for Pharmaceutical Engineering (ISPE),
First Edition, March 2017, www.ispe.org.

44. ISPE GAMP® RDI Good Practice Guide: Data Integrity – Key Concepts, International Society for Pharmaceutical
Engineering (ISPE), First Edition, October 2018, www.ispe.org.

45. ISPE GAMP® RDI Good Practice Guide: Data Integrity – Manufacturing Records, International Society for
Pharmaceutical Engineering (ISPE), First Edition, May 2019, www.ispe.org.

46. 21 CFR Part 11 – Electronic Records; Electronic Signatures, Code of Federal Regulations, US Food and Drug
Administration (FDA), www.fda.gov.

47. FDA Guidance for Industry: Data Integrity and Compliance With Drug CGMP Questions and Answers, December
2018, US Food and Drug Administration (FDA), www.fda.gov.

48. EudraLex Volume 4 – Guidelines for Good Manufacturing Practices for Medicinal Products for Human and
Veterinary Use, Annex 11: Computerized Systems, June 2011, http://ec.europa.eu/health/documents/eudralex/
vol-4/index_en.htm.

49. MHRA Guidance: ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018, Medicines &
Healthcare products Regulatory Agency (MHRA), www.gov.uk/government/organisations/medicines-and-
healthcare-products-regulatory-agency.

50. WHO Technical Report Series, No. 996, Annex 5: Guidance on Good Data and Record Management Practices,
World Health Organization (WHO), 2016, http://apps.who.int/medicinedocs/en/d/Js22402en/.

51. PIC/S Draft Guidance: PI 041-1 (Draft 3) Good Practices for Data Management and Integrity in Regulated
GMP/GDP Environments, November 2018, Pharmaceutical Inspection Co-operation Scheme (PIC/S), www.
picscheme.org/.

52. Aide Mémoire 07121202 der ZLG (Annex 11): Überwachung computergestützter Systeme Zentrale Leitstelle
Gesundheit (ZLG, Germany), www.ccs-innovation.com/aide-memoire-07121202-der-zlg-uberwachung-
computergestutzter-systeme/.
Page 90 ISPE Good Practice Guide:
Appendix 6 Critical Utilities GMP Compliance

53. ISPE GAMP® 5: A Risk-Based Approach to Compliant GxP Computerized Systems, International Society for
Pharmaceutical Engineering (ISPE), Fifth Edition, February 2008, www.ispe.org.

54. EMA Guideline on process validation for finished products - information and data to be provided in regulatory
submissions, November 2016, European Medicines Agency (EMA), EMA/CHMP/CVMP/QWP/BWP/70278/2012-
Rev1, Corr.1, https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-process-validation-
finished-products-information-data-be-provided-regulatory-submissions_en.pdf.

55. FDA Guidance for Industry: Process Validation – General Principles and Practices, January 2011, US Food and
Drug Administration (FDA), www.fda.gov.

56. 21 CFR Part 211.186 – Current Good Manufacturing Practice for Finished Pharmaceuticals, Master production
and control records, Code of Federal Regulations, US Food and Drug Administration (FDA), www.fda.gov.

57. 21 CFR Part 211.188 – Current Good Manufacturing Practice for Finished Pharmaceuticals; Batch production
and control records, Code of Federal Regulations, US Food and Drug Administration (FDA), www.fda.gov.

58. EudraLex Volume 4 – Guidelines for Good Manufacturing Practice for Medicinal Products for Human and
Veterinary Use, Chapter 4: Documentation, January 2011, http://ec.europa.eu/health/documents/eudralex/vol-4/
index_en.htm.

59. Health Canada, Good manufacturing practices guide for drug products (GUI-0001), February 2018, Health
Canada, www.hc-sc.gc.ca/dhp-mps/compli-conform/gmp-bpf/index-eng.php.

60. 21 CFR Part 211.67 – Current Good Manufacturing Practice for Finished Pharmaceuticals, Equipment Cleaning
and Maintenance, Code of Federal Regulations, US Food and Drug Administration (FDA), www.fda.gov.

61. 21 CFR Part 211.68 – Current Good Manufacturing Practice for Finished Pharmaceuticals; Automatic,
Mechanical, and Electronic Equipment, Code of Federal Regulations, US Food and Drug Administration (FDA),
www.fda.gov.

62. ISPE Good Practice Guide: Maintenance, International Society for Pharmaceutical Engineering (ISPE), First
Edition, May 2009, www.ispe.org.

63. ISPE GAMP® Good Practice Guide: A Risk-Based Approach to Calibration Management, International Society for
Pharmaceutical Engineering (ISPE), Second Edition, November 2010, www.ispe.org.

64. PIC/S Guidance: PI 009-3 Aide-Memoire, Inspection of Utilities, 25 September 2007, Pharmaceutical Inspection
Co-operation Scheme (PIC/S), www.picscheme.org.

65. ISPE Japan Affiliate: Pest Control Manual (English Translation), International Society for Pharmaceutical
Engineering (ISPE), Fifth Edition, August 2018, www.ispe.org.

66. Draft EudraLex Volume 4 – EU Guidelines to Good Manufacturing Practice Medicinal Products for Human
and Veterinary Use, Annex 1: Manufacture of Sterile Medicinal Products, February 2020, ec.europa.eu/health/
medicinal_products/consultations/2020_sterile_medicinal_products_en.

67. PIC/S Guidance: PI 007-6 Recommendation on the Validation of Aseptic Processes, 25 January 2011,
Pharmaceutical Inspection Co-operation Scheme (PIC/S), www.picscheme.org.

68. WHO Supplementary Guidelines on GMP: Validation, QAS/03.055/Rev.2, World Health Organization
(WHO), 2005, https://www.who.int/medicines/services/expertcommittees/pharmprep/Validation_QAS_055_
Rev2combined.pdf.
ISPE Good Practice Guide: Page 91
Critical Utilities GMP Compliance Appendix 6

69. Gordon, O., Goverde M., Pazdan J., et al, “Comparison of Different Calculation Approaches for Defining
Microbiological Control Levels Based on Historical Data,” PDA J Pharm Sci and Tech 2015, Vol. 69, Issue 3, pp.
383-398, https://journal.pda.org.

70. USP <643> Total Organic Carbon, United States Pharmacopeial Convention, www.usp.org.

71. USP <645> Water Conductivity, United States Pharmacopeial Convention, www.usp.org.

72. EudraLex Volume 4 – Guidelines for Good Manufacturing Practice for Medicinal Products for Human and
Veterinary Use, Chapter 2: Personnel, August 2013, http://ec.europa.eu/health/documents/eudralex/vol-4/index_
en.htm.

73. ASME BPE-2019: Bioprocessing Equipment, American Society of Mechanical Engineers (ASME), www.asme.org.

74. US Food and Drug Administration (FDA), www.fda.gov.

75. FDA Warning Letters, 19 February 2013, US Food and Drug Administration (FDA), www.fda.gov.

76. FDA Warning Letters, 2 December 2013, US Food and Drug Administration (FDA), www.fda.gov.

77. FDA Warning Letters, 12 June 2014, US Food and Drug Administration (FDA), www.fda.gov.

78. FDA Warning Letters, 23 February 2016, US Food and Drug Administration (FDA), www.fda.gov.

79. FDA Warning Letters, 30 June 2016, US Food and Drug Administration (FDA), www.fda.gov.

80. FDA Warning Letters, 2 March 2017, US Food and Drug Administration (FDA), www.fda.gov.

81. FDA Warning Letters, 26 January 2017, US Food and Drug Administration (FDA), www.fda.gov.

82. FDA Warning Letters, 16 February 2018, US Food and Drug Administration (FDA), www.fda.gov.

83. FDA Warning Letters, 12 January 2018, US Food and Drug Administration (FDA), www.fda.gov.
ISPE Good Practice Guide: Page 93
Critical Utilities GMP Compliance Appendix 7

12 Appendix 7 – Glossary

Appendix 7
12.1 Acronyms and Abbreviations

ALCOA+ Attributable, Legible, Contemporaneous, Original, Accurate, with the addition of Complete, Consistent,
Enduring, Available
API Active Pharmaceutical Ingredient
ASME American Society of Mechanical Engineers
BLA Biologics License Application
BOM Bill of Material
CAPA Corrective and Preventive Action
CCP Critical Control Parameter
CFU Colony Forming Unit
CGMP Current Good Manufacturing Practice (FDA)
ChP Chinese Pharmacopoeia
CIP Clean in Place
CMG Compressed Medical Gases
CPP Critical Process Parameter
CQA Critical Quality Attribute
CU Critical Utility
DI Data Integrity
ECM Engineering Change Management
EDI Electrodeionization
EMA European Medicines Agency
EPA Environmental Protection Agency
FAT Factory Acceptance Testing
FDA Food and Drug Administration (US)
FDASIA Food and Drug Administration Safety and Innovation Act (US)
FMEA Failure Mode Effect Analysis
FMECA Failure Mode, Effects and Criticality Analysis
FTA Fault Tree Analysis
GAC Granular Activated Carbon
GEP Good Engineering Practice
GMP Good Manufacturing Practice
GPG Good Practice Guide
GxP Good “x” Practice
HACCP Hazard Analysis and Critical Control Point
HAZOP Hazard Operability Analysis
HMI Human-Machine Interface
HVAC Heating, Ventilation, and Air Conditioning
ICH International Council for Harmonisation
ID Identification
Page 94 ISPE Good Practice Guide:
Appendix 7 Critical Utilities GMP Compliance

IOQ Installation/Operational Qualification

IOQP Installation/Operational Qualification Protocol
JP Japanese Pharmacopoeia
KTA Kepner-Trego Analysis
LIMS Laboratory Information Management System
MHRA Medicines and Healthcare products Regulatory Agency (UK)
NFPA National Fire Protection Association (US)
NMT Not More Than
NPDWR National Primary Drinking Water Regulations (US)
OOS Out Of Specification
OQ Operational Qualification
OQP Operational Qualification Protocol
OTC Over-the-Counter
P&ID Process and Instrumentation Diagram
PCA Plate Count Agar
PHA Preliminary Hazard Analysis
Ph. Eur. European Pharmacopoeia
PIC/S Pharmaceutical Inspection Convention and Pharmaceutical Inspection Co-operation Scheme
PLC Programmable Logic Controller
PM Preventive Maintenance
PPE Personal Protection Equipment
POU Point of Use
PQ Performance Qualification
PQP Performance Qualification Protocol
PVC Polyvinyl Chloride
PVDF Polyvinylidene Fluoride
PW Purified Water
QC Quality Control
QRM Quality Risk Management
RAID Redundant Array of Independent Disks
RO Reverse Osmosis
SAT Site Acceptance Testing
SIP Steam in Place
SME Subject Matter Expert
SOP Standard Operating Procedure
TAMC Total Aerobic Microbial Count
TDS Total Dissolved Solid
TFC Thin-Film Composite
TNTC Too Numerous To Count
TOC Total Organic Carbon
US EPA US Environmental Protection Agency
USP US Pharmacopeia
ISPE Good Practice Guide: Page 95
Critical Utilities GMP Compliance Appendix 7

UV Ultraviolet
VBNC Viable But Not Culturable
WFI Water for Injection
WHO World Health Organization
w/v Weight/Volume

12.2 Definitions

Critical Utilities (CU)

Utilities that have the identified potential to impact product quality or performance in a significant way.

Deviation (ICH Q7 [5])

Departure from an approved instruction or established standard.

Discrepancy

In the context of this Guide, a discrepancy is a condition that is unexpected or involves some variation from the
expected condition (i.e., an event or occurrence outside the acceptable limits for a system). This is also known as an
excursion.

Drinking Water

Drinking water is not covered by a compendial monograph but must comply with the quality attributes of the EPA
NPDWR15 or comparable regulations of the European Union, World Health Organization (WHO), or Japan. It may be
derived from a variety of sources including a public water utility, a private water supply (e.g., a well), or a combination
of more than one of these sources.

Medical Gases (FDA [10, 11])

“Compressed medical gases (CMG or medical gases) include gaseous and liquid (cryogenic) forms stored in
high-pressure cylinders that are administered as a gas. Types of compressed medical gases include, but are not
limited to, oxygen, carbon dioxide, helium, nitrogen, nitrous oxide, medical air, and combinations of these gases.”

“The term ‘medical gas’ means a drug that— ‘‘(A) is manufactured or stored in a liquefied, nonliquefied, or
cryogenic state; and ‘‘(B) is administered as a gas.”

Potable Water

Water that is suitable for drinking.

“Potable Water is not covered by a pharmacopoeial monograph but must comply with the regulations on water
intended for human consumption of a quality equivalent to that defined in Directive 98/83/EC, or laid down by
the competent authority. Testing should be carried out at the manufacturing site to confirm the quality of the
water. Potable water may be used in chemical synthesis and in the early stages of cleaning pharmaceutical
manufacturing equipment unless there are specific technical or quality requirements for higher grades of water. It
is the prescribed source feed water for the production of pharmacopoeial grade waters.” (EMA [17])

15
EPA NPDWR: US Environmental Protection Agency Primary Drinking Water Regulations
Page 96 ISPE Good Practice Guide:
Appendix 7 Critical Utilities GMP Compliance

Pure Steam (USP [12])

Water that has been heated above 100°C (212°F) and vaporized in a manner that prevents source water entrainment.
It is prepared from water complying with the US EPA Primary Drinking Water Regulations, or with drinking water
regulations of the European Union or Japan, or with WHO drinking water guidelines. It contains no added substance.
The level of steam saturation or dryness, and the amount of non-condensable gases are to be determined by the
Pure Steam application.

Note: Pure Steam is intended for use where steam or its condensate comes in contact with the article of the
preparation.

Purified Water (USP [12])

Water rendered suitable for pharmaceutical purposes by using unit operations that include deionization, distillation,
ion exchange, reverse osmosis, filtration, or other suitable purification procedures. It meets rigid specifications for
chemical purity, the requirements of the Federal Environmental Protection Agency (EPA) with respect to drinking
water, and it contains no added substances. Cannot be used as raw material for parenterals. Common uses are: a
rinse for equipment, vials, and ampoules, and as makeup for cosmetics, bulk chemicals, and oral products. For FDA
acceptance, Purified Water must contain less than 0.5 mg/l of TOC (Total Organic Carbon), and less than 100 CFU.

Purified Water (Ph. Eur. [13])

Water for the preparation of medicinal products other than those that require the use of water which is sterile and/
or apyrogenic. Purified Water which satisfies the test for endotoxins may be used in the manufacture of dialysis
solutions. Purified Water is prepared by distillation, by ion exchange or by any other suitable method that complies
with the regulations on water intended for human consumption laid down by the competent authority.

Water for Injection (WFI) (Ph. Eur. [13])

Water for the preparation of medicines for parenteral administration when water is used as a vehicle (WFI in bulk) and
for dissolving or diluting substances or preparations for parenteral administration (sterilized Water for Injection).

Water for Injection (WFI) (USP [12])

Prepared from water complying with the quality attributes of “Drinking Water.” Purified by distillation or a purification
process that is equivalent or superior to distillation in the removal of chemicals and microorganisms. Conductivity in
accordance with Stage 1, 2, and 3 tests and Conductivity Tables. Total Organic Carbon limit is at 0.5 mg/l. Typically,
viable microbial counts of less than 10 CFU/100 ml for microbiological acceptability. Less than 0.25 USP EU/ml.

WFI in bulk is produced by a purification process equivalent to distillation such as reverse osmosis, coupled with
appropriate techniques such as electrodeionization, ultrafiltration or nanofiltration. The use of non-distillation
technologies for the production of WFI requires that notice be given to the supervisory authority of the manufacturer
before implementation. Equivalence in quality does not simply mean compliance with a specification but also takes
into account the robustness of the production method.
600 N. Westshore Blvd., Suite 900, Tampa, Florida 33609 USA
Tel: +1-813-960-2105, Fax: +1-813-264-2816

www.ISPE.org