An audit or a 483 is demanding our full equipment qualification package — what has to be in it?

Read this first, because it decides everything below. The vocabulary in the request travels further than the rules that use it. Part 211 carries the minimum current good manufacturing practice for preparation of drug products, excluding positron emission tomography drugs and medical gases, for administration to humans or animals (21 CFR 211.1(a)). If you make a dietary supplement, part 111 is what reaches you instead, and it reaches you if you manufacture, package, label, or hold one, with the holding requirements lifted only where you hold at a retail establishment for the sole purpose of direct retail sale to individual consumers (21 CFR 111.1(a), 111.1(b)). If you make human food, the equipment clauses sit in part 117 subpart B. If you make a cosmetic, no good manufacturing practice part is codified for you at all. And there is a live carve-out inside part 211 itself: pending consideration of a proposed exemption published in 1978, the requirements of that part are not enforced for over-the-counter drug products if the products and all their ingredients are ordinarily marketed and consumed as human foods, and until further notice parts 110 and 117, and where applicable parts 113 through 129, are applied instead (21 CFR 211.1(c)). If that is you, the part everyone quotes at you about equipment is the wrong part.

The letters themselves are not federal law for any of those products. Among the sources read here, the terms installation qualification, operational qualification and performance qualification appear in exactly one authority: a harmonized guideline whose own scope clause says it applies to the manufacture of active pharmaceutical ingredients for use in human drug products, and does not apply to bulk-packaged drug products, medical gases, or the control aspects specific to radiopharmaceuticals (ICH Q7 § 1.3). That guideline is where the four letters are defined (ICH Q7 § 12.30). So if you make a supplement, a food or a cosmetic, the words in the request come from a document that, by its own terms, was not written for you. That does not make the request unreasonable. It makes it contractual rather than statutory, and that changes who you have to satisfy and what counts as satisfying them.

Whether the equipment stays proven after the first pass, and how often you re-prove it, is a separate question with its own answer. It is worked through in how often you have to requalify and how equipment is kept in a qualified state, and this page does not repeat it.

On this page: What the phrase is actually asking for · The rule that gets cited when the package is thin · What has to be in it · The five parts, and what makes each one evidence · Four things that get a package sent back · When the contract sets the contents · Answering a 483 with it · Three things to check before you send it

What the phrase is actually asking for

Start with the only definition on the table. Qualification is the action of proving and documenting that equipment or ancillary systems are properly installed, work correctly, and actually lead to the expected results; and the same definition says qualification is part of validation, while the individual qualification steps alone do not constitute process validation (ICH Q7, glossary). Read the second half of that sentence, because it is the half people drop. A complete set of qualification documents is not a validated process, and an auditor who asked for the qualification package and got only the qualification package will ask the next question immediately.

The same guideline names the four activities, carried out individually or combined: design qualification, documented verification that the proposed design of the facilities, equipment or systems is suitable for the intended purpose; installation qualification, documented verification that the equipment or systems as installed or modified comply with the approved design, the manufacturer’s recommendations and/or user requirements; operational qualification, documented verification that they perform as intended throughout the anticipated operating ranges; and performance qualification, documented verification that the equipment and ancillary systems, connected together, can perform effectively and reproducibly based on the approved process method and specifications (ICH Q7 § 12.30). Notice what every one of those four has in common. The operative words are documented verification against something written down first. That is what the request is really for: not a folder, but a chain running from what the equipment had to do, through how you proved it, to who checked the proof.

The rule that gets cited when the package is thin

Here is the agency doing it, in a letter you can read yourself. FDA inspected a drug manufacturing facility from January 30 to February 3, 2023, and issued a warning letter on October 2, 2023. The letter cites the written-procedures clause, which requires written procedures for production and process control designed to assure that drug products have the identity, strength, quality and purity they purport to possess, drafted, reviewed and approved by the appropriate organizational units and reviewed and approved by the quality control unit (21 CFR 211.100(a)). Under that citation the letter says: “you did not adequately qualify the equipment used in the manufacturing of your drug products to assure that the equipment is of appropriate design, adequate size, and suitably located to facilitate operations for its intended use and for its cleaning and maintenance. Qualification of equipment demonstrates suitability for use and is an integral part of your process validation program.” (FDA Warning Letter 320-24-01, Seoul Cosmetics Co., Ltd., October 2, 2023)

Two things in that are worth more than the citation. The words the agency used to describe the failure are lifted from the equipment design clause, which says equipment used in the manufacture, processing, packing or holding of a drug product shall be of appropriate design, adequate size, and suitably located to facilitate operations for its intended use and for its cleaning and maintenance (21 CFR 211.63). But the violation was written under the written-procedures clause and placed inside the validation program. The agency is not reading equipment qualification as a standalone document set. It is reading it as the part of your validation program that proves the machine was fit before the process was proven on it.

The second thing is what the letter asked for at the close of that item. It is a list of five, and only one of the five is protocols. FDA asked for a detailed summary of the validation program for ensuring a state of control across the product lifecycle with its associated procedures; a timeline for performing process performance qualification on each marketed drug product; the process performance protocols; a detailed program for designing, validating, maintaining, controlling and monitoring each manufacturing process; and, in its own words, “your program and written procedures for qualification of your equipment and facility.” The same letter also records that the firm’s response to the Form FDA 483 was reviewed and found inadequate because it did not provide sufficient detail or evidence of corrective actions. Protocols were asked for. So was the program that put them there, and three other things besides. A package that is a stack of protocols answers one of the five.

What has to be in it

Every part of a defensible package earns its place by proving one link in that chain. The table below is the chain, what makes each link evidence rather than assertion, and the thing people put in the folder instead.

The five parts, and what makes each one evidence

What the equipment has to do. This is the part most packages are missing and the part an experienced auditor opens first, because everything downstream is measured against it. The rules do not hand you the number. For a drug, equipment must be of appropriate design, adequate size and suitably located for its intended use and its cleaning and maintenance (211.63), and contact surfaces must not be reactive, additive or absorptive so as to alter the safety, identity, strength, quality or purity of the product beyond established requirements (211.65(a)). For a supplement, you must use equipment and utensils of appropriate design, construction and workmanship to enable them to be suitable for their intended use and to be adequately cleaned and properly maintained (111.27(a)), and for automated, mechanical or electronic equipment you must determine the suitability of the equipment by ensuring it is capable of operating satisfactorily within the operating limits required by the process (111.30(b)). For food, plant equipment must be so designed and of such material and workmanship as to be adequately cleanable and adequately maintained to protect against allergen cross-contact and contamination (117.40(a)(1)). Each of those turns on your intended use and your process limits. If nothing in the package states them, nothing in the package can be judged.

The plan. Start where the binding duty is, because the guideline that gave the world the four letters does not carry one here. Its qualification paragraph defines the four activities and stops; it names no protocol, no approval and no report for a qualification (ICH Q7 § 12.30). Under the drug rules the written procedures for production and process control are themselves required to be drafted, reviewed and approved by the appropriate organizational units and then reviewed and approved by the quality control unit (211.100(a)), and the responsibilities and procedures applicable to that unit must be in writing and followed (211.22(d)). Under the supplement rules the equivalent duty is that you establish and use appropriate controls to ensure the equipment functions in accordance with its intended use, and that those controls are approved by quality control personnel (111.30(e)). What the guideline does carry sits in its validation-documentation section, in the recommending voice that section uses throughout: a written validation protocol should be established specifying how validation of a particular process will be conducted, and should be reviewed and approved by the quality unit and other designated units (ICH Q7 § 12.20), its glossary defining a validation protocol as a written plan stating how validation will be conducted and defining acceptance criteria (ICH Q7, glossary). Auditors carry that discipline across to qualification because the same glossary makes qualification part of validation. It is an expectation borrowed rather than a rule, and knowing which it is changes how you argue it when someone tells you your protocol is non-compliant. Approval before the run is still the point. A protocol approved after the results are in is a record of what happened, not a plan that was tested.

The executed results. The recorded measurements, run by run, against each criterion. This is the part a review actually reads, and it is where a package that looks complete comes apart. A conclusion is not data. Where a result fell outside a criterion, the package has to carry that too, with what was concluded and what changed. The same guideline’s validation-documentation section, again in the recommending voice, says a validation report should cross-reference the validation protocol, summarize the results obtained, comment on any deviations observed, and draw the appropriate conclusions, including recommending changes to correct deficiencies (ICH Q7 § 12.22), and that any variations from the validation protocol should be documented with appropriate justification (ICH Q7 § 12.23). That is the shape an auditor expects a qualification report to have, for the same borrowed reason. A package with no failed result anywhere in it is not a clean package. It is a package that was written after the fact or that never challenged anything.

Who reviewed it. The signature matters because of what it separates. Under the drug rules, all production and control records must be reviewed and approved by the quality control unit before a batch is released, and any unexplained discrepancy or failure to meet specification must be thoroughly investigated with a written record of the investigation, its conclusions and its followup (211.192). Under the supplement rules, quality control operations for equipment, instruments and controls include reviewing and approving all processes for calibrating instruments and controls, periodically reviewing the calibration records, periodically reviewing all records for calibrations, inspections and checks of automated, mechanical or electronic equipment, and reviewing and approving controls to ensure that automated, mechanical or electronic equipment functions in accordance with its intended use (111.117(a), 111.117(b), 111.117(c), 111.117(d)). In both, the reviewer is a function, not a job title, and the test is whether that function could have said no.

How the state is held. The proof rests on instruments, so the instruments have to be traceable. For a drug, laboratory controls must include calibration of instruments, apparatus, gauges and recording devices at suitable intervals in accordance with an established written program containing specific directions, schedules, limits for accuracy and precision, and provisions for remedial action where those limits are not met, and instruments not meeting established specifications shall not be used (211.160(b)(4)). Automated, mechanical or electronic equipment must be routinely calibrated, inspected or checked according to a written program designed to assure proper performance, with written records maintained (211.68(a)). For a supplement, you must calibrate instruments and controls before first use, and at the frequency the instrument maker specifies in writing or at routine intervals as otherwise necessary to ensure accuracy and precision, and repair or replace anything that cannot be adjusted to agree with the reference standard (111.27(b), 111.27(b)(1), 111.27(b)(2), 111.27(b)(3), 111.27(c)), and keep documentation of each calibration (111.35(b)(3)) and of the date of use, maintenance, cleaning and sanitizing in individual equipment logs unless that is kept with the batch record (111.35(b)(2)). The drug equivalent is the individual equipment log, and it is worth reading to the end. A written record of major equipment cleaning, maintenance other than routine maintenance such as lubrication and adjustments, and use goes in individual equipment logs showing the date, time, product and lot number of each batch processed, dated and signed or initialed by the persons performing and double-checking the work, or by just the person verifying work an automated system did, with entries in chronological order. Then the carve-out: individual logs are not required where equipment is dedicated to the manufacture of one product, provided its lots follow in numerical order and are manufactured in numerical sequence, and in that case the cleaning, maintenance and use records are part of the batch record instead (211.182). One more piece binds the package to production: major equipment must be identified by a distinctive identification number or code recorded in the batch production record, so the specific equipment used for each batch can be shown (211.105(b)). That number is the thread an investigator pulls to get from a batch to your qualification, and a package that does not carry it cannot be tied to anything you made.

Four things that get a package sent back

The vendor’s certificate standing in for your qualification. A factory acceptance test, a site acceptance test and an original equipment manufacturer certificate are all real work, and none of them is your qualification. They were arranged and paid for by the party being checked, they were run against the maker’s design rather than your process, and their scope is narrower than the people relying on them assume. The rule underneath is that a check only counts if it finds what it exists to find. Installation qualification is documented verification that the equipment or systems, as installed or modified, comply with the approved design, the manufacturer’s recommendations and/or user requirements (ICH Q7 § 12.30). Read that as it is written. The guideline lets the verification be made against the maker’s recommendations rather than against a separate user requirement, and it names nobody to perform it. Who performs it comes from your own part, not from the guideline. It is you who must determine the suitability of the equipment by ensuring it can operate satisfactorily within the operating limits your process requires (111.30(b)), and you whose written procedures the quality control unit has to have approved (211.100(a)). A vendor record is what the vendor checked, against its own design, before your process existed.

A signed protocol with no executed data behind it. This is the most common shape of a package that reads complete and is not. Every page is signed, every criterion has a tick, and the raw measurements are somewhere else or nowhere. The failure is the record no longer describing what happened, and the specific version of it here is treating approval as the moment the risk was handled. It was not. The signature records a judgment about evidence; if the evidence is not in the package, the signature is the only thing you handed over.

Acceptance criteria set to what the machine already does. A pass only means something if the bar came from somewhere. Where the operational ranges and the performance worst case were read off the equipment’s own observed performance, the package proves the equipment does what it does, which was never in doubt. The criteria have to trace back to what the process requires, which is why the first link in the chain is what the equipment has to do rather than what it turned out to be capable of. This is the failure mode where a limit is taken from what the process already achieves, and it survives review precisely because everything passes.

Calibration current, qualification absent. Calibration and qualification answer different questions, and current calibration certificates are the single most common substitute offered for a missing package. The two rule sets say it differently and the difference is the consequence. Under the supplement rules, an instrument or control that cannot be adjusted to agree with the reference standard must be repaired or replaced (111.27(c)). Under the drug rules, the laboratory controls set the calibration program and its limits for accuracy and precision, and an instrument not meeting established specifications shall not be used (211.160(b)(4)). Neither clause defines calibration, and neither says anything about qualification. Qualification establishes that the equipment, with those instruments on it, does your job. You need the first to have the second, and having the first is not having the second.

When the contract sets the contents

For a large number of readers this is the real answer, and it is worth getting to before you go looking for a federal rule that is not there. Where nothing in your product’s own part names a qualification package, what binds you is your customer’s quality agreement or the certification scheme you hold. A certifiable scheme for dietary supplement manufacture, for instance, holds that changes from a validated or qualified state should be managed through a change control process (NSF/ANSI 455-2 § 4.3.9.5), which presumes a qualified state exists and has a boundary, without telling you what proved it. Your sponsor’s agreement is usually the document that does.

That is where packages fall into the gap. At the edge between two organizations, each party writes its own version of a shared step, so the allocation is agreed by neither. The sponsor’s auditor arrives expecting a lifecycle package because that is what their internal standard says a qualification is. You hand over what your part requires, because that is what a qualification is where you sit. Both documents are internally consistent and they do not describe the same deliverable. The fix is not a better folder. It is settling, in the agreement and before the audit, which party holds equipment qualification, what the deliverable is called, and what it contains. If you are working out where those lines belong, the difference between a quality agreement and a supply contract is the place to start.

One practical consequence. If the contents are set by an agreement rather than a regulation, the agreement is part of the package. Hand the auditor the clause that defines what you owe, alongside the documents that answer it. An auditor who has to guess what you were required to produce will grade you against what they would have required.

Answering a 483 with it

We read a 483 observation about equipment qualification as a statement that an investigator could not follow the chain, rather than as a request for documents. That is a reading and not a rule, and it is the reading the letter above supports: the firm’s response was rejected for not providing sufficient detail or evidence of corrective actions, which is a complaint about the chain and not about the size of the pile. On that reading the response has to close the chain rather than restock the folder. Order matters, because the person reading it is looking for the same five links in the same sequence: what the equipment had to do, the approved plan, the executed results, the review, and how the state is held. Lead with the program and the procedure that governs it, then the specific equipment named in the observation, then the evidence.

Say plainly what is missing and what you are doing about it. The letter quoted above records that a 483 response was found inadequate because it did not provide sufficient detail or evidence of corrective actions, and that is the sequence the letter records: an inspection, a 483, a response, a response found inadequate, a warning letter. A response that supplies the documents that existed all along, without addressing why an investigator could not find or follow them, has answered a question nobody asked. Where the qualification genuinely was not done, saying so with a dated plan reads better than a package assembled last week and presented as contemporaneous, which is a different and worse finding.

Three things to check before you send it

1. Pick up the batch record and work backwards. Find the equipment identifier in it, then find that identifier in the qualification package (211.105(b)). If the thread breaks, the package does not describe the equipment you actually made the product on, and that is the first thing a competent investigator tests.
2. Open the acceptance criteria and ask where each number came from. If the answer is the vendor’s specification or the equipment’s observed performance, the bar was not set by your process and a pass against it proves less than it appears to.
3. Check who approved the results, and whether that person could have refused. Under the drug rules the quality control unit’s responsibilities and procedures must be in writing and followed (211.22(d)); under the supplement rules the controls that ensure automated, mechanical or electronic equipment functions in accordance with its intended use must be approved by quality control personnel (111.30(e), 111.117(d)). One person running and signing is the finding, not the fix.