Will my cleaning validation survive an inspection, and where is the hole?

This is United States federal law, read for four product classes: drug products including over-the-counter drugs, dietary supplements, food under the preventive controls rule, and cosmetics. The finding goes first, because it changes what you are defending. Nothing in 21 CFR parts 111, 117 or 211 requires you to validate a cleaning procedure as such, and for cosmetics no such regulation is cited here. One obligation comes close and it reaches one class only: if your drug product purports to be sterile, the rule requires validation of all aseptic and sterilization processes, and equipment sterilization sits inside the cleaning clause. Everywhere else, cleaning is regulated and validating it is not.

The documents that do carry cleaning validation content are pharmaceutical documents. The harmonized guideline for active pharmaceutical ingredient manufacture is one, and the over-the-counter drug certification scheme is the other, and both are named and read below. If you make a supplement, a food or a cosmetic, that is where the material you have been reading comes from. It was written about somebody else’s rule. That does not make the work pointless. It moves who you are defending it to, and it moves where the hole is.

On this page: What the rule asks of your cleaning · Where validation is actually required · What the inspection record shows · Where the hole is · The pattern underneath it · Four things to check

What the rule actually asks of your cleaning

Drug products, including over-the-counter drugs. Part 211 carries the minimum current good manufacturing practice for preparation of drug products, excluding positron emission tomography drugs and medical gases, for administration to humans or animals (21 CFR 211.1(a)). Read the scope to its end before assuming it reaches you, because it carries a non-enforcement provision. Pending consideration of a proposed exemption published in the Federal Register of September 29, 1978, the requirements of the part are not enforced for over-the-counter drug products if the products and all their ingredients are ordinarily marketed and consumed as human foods, and which may also fall within the legal definition of drugs by virtue of their intended use; until further notice parts 110 and 117, and where applicable parts 113 through 129, are applied in determining whether those products are made under current good manufacturing practice (211.1(c)). Note the condition. It is not enough that the product is also an ordinary food. The product and every one of its ingredients have to be ordinarily marketed and consumed as human foods.

Where part 211 does reach you, this is what it says about cleaning. Equipment shall be of appropriate design, adequate size, and suitably located to facilitate operations for its intended use and for its cleaning and maintenance (211.63). Equipment and utensils shall be cleaned, maintained, and, as appropriate for the nature of the drug, sanitized and/or sterilized at appropriate intervals to prevent malfunctions or contamination that would alter the safety, identity, strength, quality, or purity of the drug product beyond the official or other established requirements (211.67(a)). Written procedures shall be established and followed for cleaning and maintenance of equipment, including utensils, used in the manufacture, processing, packing, or holding of a drug product (211.67(b)). That clause does not stop there. It says those procedures shall include, but are not necessarily limited to, six things:

• assignment of responsibility for cleaning and maintaining equipment (211.67(b)(1));
• maintenance and cleaning schedules, including, where appropriate, sanitizing schedules (211.67(b)(2));
• a description in sufficient detail of the methods, equipment, and materials used in cleaning and maintenance operations, and the methods of disassembling and reassembling equipment as necessary to assure proper cleaning and maintenance (211.67(b)(3));
• removal or obliteration of previous batch identification (211.67(b)(4));
• protection of clean equipment from contamination prior to use (211.67(b)(5));
• inspection of equipment for cleanliness immediately before use (211.67(b)(6)).

Records shall be kept of maintenance, cleaning, sanitizing, and inspection as specified in two other sections (211.67(c)), and both are worth following. The first says a written record of major equipment cleaning, maintenance except routine maintenance such as lubrication and adjustments, and use goes in individual equipment logs that show the date, time, product, and lot number of each batch processed, with entries in chronological order. The persons performing and double-checking the work date and sign or initial the log, and where the cleaning and maintenance is performed using automated equipment it is just the person verifying the automated equipment’s work who signs. Where equipment is dedicated to one product and lots follow in numerical order and sequence, individual logs are not required and those records are part of the batch record instead (211.182). The second is the one that matters most on the day: all records required under the part, or copies of them, shall be readily available for authorized inspection during the retention period at the establishment where the activities described in them occurred, and shall be subject to photocopying or other means of reproduction as part of that inspection (211.180(c)).

Read that set together and none of it asks you to validate a cleaning procedure. Part 211 does require validation, in two places, and it is worth being exact about both because they are the nearest thing to an answer a drug maker has. Drug product containers and closures shall be clean and, where indicated by the nature of the drug, sterilized and processed to remove pyrogenic properties, and such depyrogenation processes shall be validated (211.94(c)). And appropriate written procedures designed to prevent microbiological contamination of drug products purporting to be sterile shall be established and followed, and those procedures shall include validation of all aseptic and sterilization processes (211.113(b)). Put that second one beside 211.67(a), which requires equipment to be sterilized as appropriate for the nature of the drug, and the sterile-product maker does carry a federal validation obligation reaching equipment. It attaches to sterilization, not to cleaning generally, and it does not reach a non-sterile drug at all.

Dietary supplements. Part 111 applies to you if you manufacture, package, label, or hold a dietary supplement (21 CFR 111.1(a)), with one narrow carve-out: the requirements pertaining to holding do not apply where you hold at a retail establishment for the sole purpose of direct retail sale to individual consumers, and a retail establishment does not include a warehouse or other storage facility for a retailer, or one that sells directly to individual consumers (111.1(b)). The obligation is to maintain, clean, and sanitize, as necessary, all equipment, utensils, and any other contact surfaces used to manufacture, package, label, or hold components or dietary supplements (111.27(d)), with equipment taken apart as necessary for thorough maintenance, cleaning, and sanitizing (111.27(d)(1)), and equipment of appropriate design, construction and workmanship to enable it to be adequately cleaned and properly maintained (111.27(a)). You must establish and follow written procedures for fulfilling that subpart’s requirements, including for the maintaining, cleaning and sanitizing (111.25, 111.25(c)). The records are those written procedures themselves (111.35(b)(1)(iii)) plus documentation, in individual equipment logs, of the date of the use, maintenance, cleaning, and sanitizing of equipment, unless that documentation is kept with the batch record (111.35(b)(2)).

Of the 590 landed clauses in part 111, not one carries both the word clean and the word valid, and the word validation appears nowhere in the part in any form. The vocabulary the rule uses instead is microbiological: to sanitize is to adequately treat cleaned equipment, containers, utensils, or any other cleaned contact surface by a process that is effective in destroying vegetative cells of microorganisms of public health significance, and in substantially reducing numbers of other microorganisms, without adversely affecting the product or its safety for the consumer (21 CFR 111.3). Where your residue number comes from, and what part 111 asks of it, is the acceptance limit question next door and is not repeated here.

Food under the preventive controls rule. Buildings, fixtures and other physical facilities must be maintained in a clean and sanitary condition and kept in repair adequate to prevent food from becoming adulterated, and cleaning and sanitizing of utensils and equipment must be conducted in a manner that protects against allergen cross-contact and against contamination of food, food-contact surfaces, or food-packaging materials (21 CFR 117.35(a)). All food-contact surfaces, including utensils and food-contact surfaces of equipment, must be cleaned as frequently as necessary to protect against allergen cross-contact and against contamination of food (117.35(d)). Two paragraphs qualify that. Surfaces used for low-moisture food must be in a clean, dry, sanitary condition before use, and when wet-cleaned must, when necessary, be sanitized and thoroughly dried before subsequent use (117.35(d)(1)). And in wet processing, when cleaning is necessary to protect against allergen cross-contact or the introduction of microorganisms into food, all food-contact surfaces must be cleaned and sanitized before use and after any interruption during which they may have become contaminated; where equipment and utensils are used in a continuous production operation, the utensils and food-contact surfaces of the equipment must be cleaned and sanitized as necessary (117.35(d)(2)). On the equipment itself, all plant equipment and utensils must be so designed and of such material and workmanship as to be adequately cleanable, and must be adequately maintained to protect against allergen cross-contact and contamination (117.40(a)(1)). A separate paragraph reaches equipment that never touches food but sits in areas where food is manufactured, processed, packed or held, and asks that it be so constructed that it can be kept in a clean and sanitary condition (117.40(c)); another asks that holding, conveying and manufacturing systems, including gravimetric, pneumatic, closed and automated systems, be of a design and construction that enables them to be maintained in an appropriate clean and sanitary condition (117.40(d)).

Where cleaning is a preventive control, it is a sanitation control: procedures, practices, and processes to ensure that the facility is maintained in a sanitary condition adequate to significantly minimize or prevent hazards such as environmental pathogens, biological hazards due to employee handling, and food allergen hazards, and those controls must include, as appropriate to the facility and the food, procedures for the cleanliness of food-contact surfaces, including food-contact surfaces of utensils and equipment (117.135(c)(3), 117.135(c)(3)(i)). This is the one place in the four regimes where a rule addresses cleaning and validation in the same breath, and it does it in the negative. The part requires you to validate that the preventive controls identified and implemented are adequate to control the hazard (117.160(a)), and then names what you do not need to validate: the food allergen controls, and the sanitation controls in 117.135(c)(3) (117.160(c), 117.160(c)(1), 117.160(c)(2)). For a food facility, cleaning as a preventive control is expressly carved out of the validation obligation.

Check the exemptions before you rely on any of that, and read the section to its end, because it runs to paragraph (k) and the last paragraph is the one that reaches the clauses above. Except as provided by subpart E, subparts C and G do not apply to a qualified facility, which carries modified requirements instead (117.5(a)), and they do not apply to a facility with regard to manufacturing a dietary supplement in compliance with part 111 and the serious adverse event reporting section of the Act (117.5(e)). Neither of those touches subpart B, where the sanitary operations and equipment clauses sit. But subpart B itself does not apply to farms, to fishing vessels not subject to the registration requirements of part 1 subpart H, to establishments solely engaged in holding or transporting one or more raw agricultural commodities, to the activities of farm mixed-type facilities that fall within the definition of farm, or to establishments solely engaged in hulling, shelling, drying, packing or holding nuts without additional manufacturing or processing such as roasting (117.5(k)(1)), subject to one carve-back for a farm that dries or dehydrates produce into a distinct commodity (117.5(k)(2)). If you are in one of those five, none of the food clauses above reaches you. Of the 778 landed clauses in part 117, none carries both the word clean and the word valid.

Cosmetics. There is no federal good manufacturing practice regulation to be measured against yet. The statute directs the Secretary to establish good manufacturing practices for cosmetic facilities by regulation, consistent to the extent practicable and appropriate with national and international standards (21 U.S.C. 364b(a)), taking account of the size and scope of the businesses and providing sufficient flexibility, including simplified requirements for smaller businesses (364b(b)). The same section sets the clock: the Secretary shall publish a notice of proposed rulemaking not later than 2 years after December 29, 2022, and a final rule not later than 3 years after that date (364b(c)). That final-rule date has passed. A cosmetic is adulterated if it has been manufactured or processed under conditions that do not meet the good manufacturing practice requirements of that section (361(f)). No such regulation is cited here, and the final-rule date in the statute has passed, so check the current state of that rulemaking at its source before relying on any of this.

What fills the gap in practice is a voluntary international standard, and it binds nobody by force of United States law. It asks for a program rather than a study, in its own conditional language: equipment should be suitable for the intended purpose and capable of being cleaned and, if necessary, sanitized and maintained; all equipment should be subject to an appropriate cleaning and, if necessary, sanitization program; cleaning and sanitizing agents should be specified and effective; and where equipment is assigned to continuous production or to successive batches of the same product, it should be cleaned and, if necessary, sanitized at appropriate intervals (ISO 22716), at its clauses 5.1, 5.5.1, 5.5.2 and 5.5.3. Not one of that standard’s 262 clauses uses the word validation.

Where cleaning validation is actually a requirement

It is a real requirement. It is just not a federal one for most readers. A scheme binds you because you claimed it and a contract binds you because you signed it, and both are read by somebody other than an FDA investigator. The standards below are copyright documents read here but not reproduced, so what follows describes what each requires rather than quoting it.

The over-the-counter drug scheme is the one that asks for it plainly. Search its 678 landed clauses for ones using both the word clean and the word valid and ten come back; nine of them state a requirement and the tenth is its normative references list. Where cross-contamination could occur from a common piece of equipment, it requires cleaning procedures to be in place and validated. It requires cleaning validation studies to have been completed for product contact parts and equipment, and cleaning procedures to be aligned with those studies including clean and dirty hold times where risk assessment has not justified them. It sets out what the studies have to show removal of: components, in-process materials or drug products, cleaning or sanitizing chemicals, and microbial contamination appropriate to the equipment and its use. It accepts a risk-based approach using worst-case products and operational conditions where the rationale for the decisions is documented. It requires equipment and parts cleaning procedures to be validated and final rinse water for tanks or large vessels to be evaluated for chemical residue, and allows routine testing or verification to be reduced once validation is complete. It requires clean-in-place methods to be validated. And one clause ties the study to a daily consequence: where cleaning or maintenance is logged, both the person performing it and the person verifying it must sign, unless the activity is performed by a validated clean-in-place system meeting the drug rule’s requirements (NSF/ANSI 455-4), at its clauses 4.4.28.2, 4.5.10, 4.5.10.2, 4.5.10.3, 4.5.10.4, 4.5.21.2, 4.5.22.3 and 4.5.26.3.

The dietary supplement scheme asks something much weaker, and the difference is the point. Its one clause on the subject says that cleaning verification and validation records should be maintained where required. Should, not shall. Records, not studies. And conditioned on being required somewhere else (NSF/ANSI 455-2), at clause 4.4.22.4. What it does require is that procedures for cleaning and sanitization of all equipment, utensils and contact surfaces be established and records of sanitation maintained, with equipment disassembled as necessary. That is the federal obligation restated, not a validation obligation added to it.

The cosmetics scheme asks for verification. It requires cleaning procedures to be verified and equipment inspected, with bioluminescence or microbial testing supplementing visual inspection where that is difficult or impossible, deficiencies and corrective action documented and followed up, and final rinse water for tanks or large vessels evaluated for chemical residue. Its own note then says that once formal cleaning validation studies are performed, this routine testing or verification may be reduced or even eliminated as long as the validated system does not change (NSF/ANSI 455-3), at clause 4.5.7.2. Read that as it is written. Validation is offered as a way to earn relief from routine verification. It is not imposed as the baseline.

The document everyone quotes was written for active ingredient manufacture. The harmonized guideline on good manufacturing practice for active pharmaceutical ingredients is where the familiar cleaning validation content lives, and its scope clause narrows hard: it applies to the manufacture of APIs for use in human drug products, reaches sterile APIs only up to the point immediately prior to their being rendered sterile, excludes all vaccines, whole cells, whole blood and plasma, blood and plasma derivatives and gene therapy APIs, though it does include APIs produced using blood or plasma as raw materials, and it does not apply to medical gases, bulk-packaged drug products, control aspects specific to radiopharmaceuticals, or to steps prior to the introduction of the defined API starting material (ICH Q7, 1.3). Mark the standing before the content. It is not a United States regulation and it is not a scheme you are audited against. It reaches you only where something else brings it: a marketing application you filed, a customer who wrote it into a contract, or a scheme that adopts it.

What it says is worth reading anyway, because it is the source of most of what you have been told. Cleaning procedures should normally be validated, and in general cleaning validation should be directed to situations or process steps where contamination or carryover poses the greatest risk to API quality; in early production it may be unnecessary to validate equipment cleaning where residues are removed by subsequent purification steps (ICH Q7, 12.70). Validation should reflect actual equipment usage patterns, and where various APIs or intermediates are made in the same equipment and cleaned by the same process, a representative one can be selected, chosen on solubility, difficulty of cleaning, and the calculation of residue limits based on potency, toxicity and stability (ICH Q7, 12.71). The protocol should describe the equipment to be cleaned, the procedures, materials, acceptable cleaning levels, parameters to be monitored and controlled, and analytical methods, and should indicate the type of samples to be obtained and how they are collected and labeled (ICH Q7, 12.72). Sampling should include swabbing, rinsing or alternative methods as appropriate, to detect both insoluble and soluble residues, and the methods used should be capable of quantitatively measuring levels of residues remaining on equipment surfaces after cleaning (ICH Q7, 12.73). Validated analytical methods with sensitivity to detect residues should be used, the detection limit should be sufficiently sensitive to detect the established acceptable level, and the method’s attainable recovery level should be established (ICH Q7, 12.74). And after validation, cleaning procedures should be monitored at appropriate intervals to ensure they are effective when used during routine production (ICH Q7, 12.76).

Not one of those sentences is written in mandatory language. They say should, may and can. That is the guideline’s own vocabulary, and it is not the vocabulary a regulation uses.

What the inspection record shows

FDA publishes its inspection observation records. Below are the clauses in them that carry a cleaning obligation across the three good manufacturing practice parts, and what each one has actually been cited for. The clause selection is ours and it is not exhaustive: a cleaning problem can be, and is, written up under clauses outside this set, including plant condition, personnel hygiene and pest control.

Now the number this article is about. Those 6,940 citation rows carry 356 distinct observation texts between them. The word validation appears in none of them. Widen it to the whole record, 278,564 observations across 75,687 inspections and 19,800 distinct observation texts, and 489 of those texts do use the word validation. Not one of the 489 also uses the word clean.

What the texts say instead is short and repetitive, which is the useful part. The three most-cited wordings under the drug cleaning procedure clause are that written procedures are not established for the cleaning and maintenance of equipment, that they are not established and followed, and that they are not followed. Under the food equipment clause the dominant wording, 904 of its 1,100 rows, is that your equipment and utensils were not designed and constructed to be adequately cleaned or maintained to protect against contamination. Under the supplement cleaning clause it is that you did not clean and sanitize, or did not maintain, clean and sanitize, equipment and utensils. Under the equipment log clause the dominant family, roughly two hundred of its 318 rows, is that written records of major equipment cleaning, maintenance and use are not included in individual equipment logs; a smaller family reaches the missing signature and the missing date.

What these figures do not evidence. These are counts of citation rows and of the inspections they sit in, not counts of firms, and not of the inspections in which nothing was written. The clause selection is ours, so the totals are a floor rather than a census of cleaning findings. A clause cited for a procedure being absent is evidence that a document was absent; it is not evidence about the soundness of the procedures that do exist, and the wording of most of these clauses does not separate the two. The silence on validation is evidence about the wording of FDA’s own recorded observation text, which is largely standardized, and it is not evidence about what an investigator asks across a table during an inspection or what any warning letter says afterwards. No warning letter text is read here, and nothing on this page describes what one contains. Nobody should read this as an assurance that the question will not be put to them. Counted from FDA’s published inspection observation records, read August 18, 2026; fiscal year 2026 was still open at that date.

Where the hole is, in the order it gets found

Group those 6,940 rows by what the citation is actually about and the shape of the answer falls out. Every one of the five groups is something other than a validation study.

1. Whether the cleaning happened, and at what interval, 2,536 observations, 37 per cent of the set. The drug clause turns on appropriate intervals (211.67(a)), the food clauses on as frequently as necessary and on the manner of the cleaning (117.35(d), 117.35(a)), and the supplement clause on as necessary (111.27(d)). All of them put the interval on you and then judge it. A validation study run once establishes that the procedure can work. It says nothing about whether the interval you chose is appropriate.
2. Whether the equipment can be cleaned as it is built, 1,953 observations, 28 per cent. This is the group most people leave out of the file entirely. Three separate clauses ask it, one per regime (211.63, 117.40(a)(1), 111.27(a)), and a validation performed on equipment that cannot be cleaned by design does not answer any of them.
3. The written procedure, 1,425 observations, 21 per cent. Either it does not exist, or it exists and is not followed, or it exists and does not contain what the clause lists. For a drug product the clause names six things and says the procedure is not necessarily limited to them: responsibility, schedules, the methods and materials in sufficient detail together with disassembly and reassembly, removal of previous batch identification, protection of clean equipment before use, and inspection for cleanliness immediately before use (211.67(b)(1) through 211.67(b)(6)). Of those six, the one cited most is the detail one. This is the cheapest hole to close and the most commonly open.
4. The record, 619 observations, 9 per cent. The log that does not carry the lot number, the log nobody dated, the record kept for the cleaning but not the sanitizing. A cleaning that happened and cannot be shown to have happened is, to the person reading, the same as one that did not, and the rule requires those records to be readily available for inspection where the work was done (211.180(c)).
5. Sanitation as a preventive control, 407 observations, 6 per cent. Food only, and the one the rule expressly exempts from validation (117.160(c)(2)).

None of that says the study is wasted. Read the operative words of those clauses again and each one states an outcome the cleaning has to achieve, not just a schedule: cleaning at appropriate intervals to prevent contamination that would alter the safety, identity, strength, quality, or purity of the drug product beyond the official or other established requirements (211.67(a)); cleaning as frequently as necessary to protect against allergen cross-contact and against contamination of food (117.35(d)); a sanitizing process effective in destroying vegetative cells of microorganisms of public health significance and substantially reducing numbers of other microorganisms (21 CFR 111.3). Each of those states a result. None of them states how you evidence it and none of them names a study. That is the gap a validation fills, and it is a good reason to hold one. It is also why the study is not what closes the finding: the finding is written against the equipment, the interval, the procedure and the log.

There is a fifth reader, and it is the one who does grade the study. Your cleaning validation is read hardest by your certification body and your customer’s auditor, and both of them are reading it against a document that asks for it by name. If you are certified to the over-the-counter drug scheme, the study is a stated requirement and the clauses above are what it is graded against. If you are certified to the dietary supplement scheme, the requirement on that subject is a should, conditioned on being required somewhere else. Knowing which of those you are in tells you how much the study is worth to you.

The pattern underneath it

Three failures sit under this and none of them is specific to cleaning.

The first is a document that cannot prove what it claims. Records get written for the reader rather than for the work, and approval gets treated as the moment the risk was handled. A validation report is exactly the kind of document that attracts this, because it is written once, signed, filed, and then stands as evidence of a state it only ever measured on one day.

The second is a test that detects something other than what its users believe it detects. Visual inspection is the clearest case. It is a real check and the drug rule requires it (211.67(b)(6)), and the API guideline says visual inspection can allow detection of gross contamination concentrated in small areas that could otherwise go undetected by sampling and analysis (ICH Q7, 12.76). Note what the same guideline puts beside it rather than behind it: sampling methods capable of quantitatively measuring the levels of residue remaining on equipment surfaces after cleaning, and analytical methods whose detection limit is sufficiently sensitive to detect the established acceptable level of the residue (ICH Q7, 12.73), (ICH Q7, 12.74). Looking and measuring answer different questions, and a file that carries only the first is not lying. It is answering the narrower one.

The third is a verdict read off somebody else’s case. A finding drawn from one setting gets extended to settings it never covered and credited with claims its source does not make, and the stated scope of the source does not by itself stop this. That is what has happened to the pharmaceutical cleaning validation material. It was written for a class of manufacture, it is accurate for that class, and it is repeated as though it were the rule for every class. Read the applicability clause of whatever you are citing, to its end, before you build a file on it.

The same argument turns up wherever a number sits inside a validation package. Where a cleaning acceptance limit comes from is this argument about residue, and how many process validation runs are required is the same argument about a batch count, in the neighbouring subject.

Four things to check before your next inspection

Take dated copies before you change anything. A cleaning procedure and a validation protocol are controlled records, and revising one is your own quality unit’s decision.

1. Ask whether the equipment can be cleaned as it stands. This is the largest group of findings after the interval, and it is the one a validation cannot answer. Take the hardest item on the train, the one with the dead leg or the fitting nobody removes, and ask what evidence you hold that cleaning reaches it.
2. Read your cleaning procedure against the clause, not against your memory. If you make a drug product, six contents are named and the clause says the procedure is not limited to them, so the six are a floor and not a checklist. If you make a supplement, a food or a cosmetic, the clause names no contents at all, so the test is whether somebody who has never seen your line could clean it correctly from the document alone.
3. Find the sentence that sets the cleaning interval, and read what sits after it. The rule judges the interval and the outcome, not the study. If the reason the interval is what it is comes down to what the previous shift did, that is the sentence to rewrite.
4. Pull three equipment logs at random and check them against the clause. Date, time, product, lot number, the signature of whoever performed the work and of whoever double-checked it, or of the person verifying an automated system, and chronological order. Then check you could hand them over on the spot. Just under one finding in ten in this set is a record finding, and it is the part of the file nobody rehearses.