Process validation: FDA's three stages, the batch question, and what 483s cite

Process validation is the collection and evaluation of data, from process design through commercial production, that gives scientific evidence a manufacturing process can deliver quality product every time it runs. FDA set out the current approach in its January 2011 guidance, "Process Validation: General Principles and Practices," which splits the work into three stages.

This guide pairs that guidance with what FDA investigators wrote down: citations of 21 CFR 211.100 and 211.110, the two sections the guidance names as the legal footing for process validation, at 774 drug inspections that cited Part 211 and closed between January 7, 2025 and September 3, 2026, from the Atlas Form 483 citation dataset (pulled October 2026).

Key facts:

• FDA's 2011 guidance (Revision 1) replaced the 1987 "Guideline on General Principles of Process Validation" and defines three stages: process design, process qualification and continued process verification.
• Process validation for drugs is legally enforceable under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act; the guidance names 21 CFR 211.100(a) as the foundation and 211.110(a) as the section that requires control procedures to "validate the performance" of manufacturing processes.
• FDA's guidance sets no fixed number of process performance qualification (PPQ) batches; EU GMP Annex 15 (2015) calls a minimum of three consecutive batches "generally considered acceptable" for traditional validation.
• In the Atlas dataset, 275 of 774 Part 211 drug inspections (35.5%) cited 211.100 or 211.110, and 120 of those 275 (43.6%) ended Official Action Indicated (OAI), against 18.4% of the other 499.
• 21 CFR 211.100(a) alone appeared at 189 inspections (24.4%), the third most-cited Part 211 section in the dataset after 211.192 (296) and 211.22(d) (292).

What is process validation?

Process validation is documented proof, built over the life of a product, that the commercial manufacturing process consistently produces drug product meeting its identity, strength, quality and purity attributes. FDA's 2011 guidance frames process validation as a lifecycle activity: it starts in development and continues for as long as the product is made.

The guidance rests on two ideas from quality assurance. Quality has to be built into the product, and testing finished units cannot by itself assure quality. A manufacturer is expected to understand the sources of variation in its process, detect them, understand their effect on the product and control them in proportion to the risk.

The regulatory text sits in Part 211. 21 CFR 211.100(a) requires written procedures for production and process control "designed to assure that the drug products have the identity, strength, quality, and purity they purport or are represented to possess" (eCFR, 21 CFR 211.100). 21 CFR 211.110(a) requires control procedures "to monitor the output and to validate the performance of those manufacturing processes that may be responsible for causing variability" in in-process material and the drug product (eCFR, 21 CFR 211.110). Section 211.110(b) adds that in-process specifications must derive from previous acceptable process averages and variability estimates where possible, using suitable statistical procedures. Our 21 CFR Part 211 guide places these sections inside the full CGMP rule.

What are the three stages of process validation?

The three stages of process validation in FDA's 2011 guidance are Stage 1, process design; Stage 2, process qualification; and Stage 3, continued process verification. Stage 1 defines the commercial process, Stage 2 shows it can reproduce commercial manufacture, and Stage 3 shows it stays in a state of control during routine production.

1. Stage 1, process design. The team defines the commercial process that the master production and control records will reflect, using knowledge from development and scale-up. Design of experiments and risk analysis help set ranges for component quality, equipment parameters and in-process attributes. FDA does not expect firms to run a process until it fails. Early design experiments need not follow CGMP, but they must follow sound science and good documentation practice, because Stage 2 builds on them.
2. Stage 2, process qualification. This stage has two elements. The first is the design of the facility and the qualification of utilities and equipment, with a plan and a report the quality control unit reviews and approves (211.22). The second is process performance qualification (PPQ): commercial batches made with qualified equipment, trained personnel, the commercial process and real components, under a written protocol the quality unit approves before execution starts. A manufacturer must complete PPQ before commercial distribution.
3. Stage 3, continued process verification. The firm collects and trends process and product data, reviews them under 211.180(e), and acts on signals before they become failures. The guidance recommends keeping the heavier PPQ sampling level until the data support variability estimates, then setting routine sampling from those estimates. Our continued process verification guide covers Stage 3 metrics, review frequency and escalation rules.

For legacy products, the guidance expects work to begin with Stage 3, using the manufacturing data the firm already holds.

How many batches does process validation need?

Process validation needs as many PPQ batches as the manufacturer can justify from its process knowledge, because FDA's 2011 guidance does not set a number. The guidance asks for enough samples to give statistical confidence of quality within a batch and between batches. EU GMP Annex 15 treats a minimum of three consecutive routine batches as generally acceptable.

FDA's guidance lists what a PPQ protocol should hold: manufacturing conditions and limits, the data to collect and how to evaluate it, tests and acceptance criteria for each significant step, a sampling plan with the number of samples and their frequency, the statistical methods for intra-batch and inter-batch variability, and rules for deviations and nonconforming data. Data may not be excluded from the PPQ without a documented, science-based justification. The report that follows must state whether the process met the protocol and is in a state of control.

A firm that sells into both markets meets the Annex 15 expectation, so three consecutive batches is its floor unless the protocol justifies another number. Whatever the count, an investigator will look for the statistical reasoning behind it.

Process validation vs IQ, OQ and PQ: what is the difference?

Process validation covers the whole manufacturing process across its lifecycle, while IQ, OQ and PQ qualify the equipment and utilities that process runs on. Installation, operational and performance qualification sit inside Stage 2 of FDA's 2011 guidance, as the first element, and must be complete before PPQ batches start.

Equipment qualification answers whether a granulator, autoclave or water system is installed to specification and works across its operating ranges, including under load, interventions, stoppage and start-up. Process validation answers whether the full process, with that equipment, the materials and the people, makes acceptable product batch after batch. A qualified tablet press does not prove a validated compression process. Cleaning procedures need their own validation as well, and our guide to cleaning validation requirements covers acceptance limits and what FDA cites there.

What are prospective, concurrent and retrospective validation?

Prospective validation completes all validation work before any batch is released; concurrent validation releases a batch before the full PPQ protocol is executed; retrospective validation relies on historical batch data for a product already on the market. FDA's 2011 guidance expects prospective work in most cases and concurrent release only rarely.

The guidance lists the situations where concurrent release might fit: processes used infrequently, such as orphan drugs or minor use veterinary drugs, products with short half-lives such as positron emission tomography drugs, and medically necessary drugs made in coordination with FDA to ease a shortage. A concurrently released lot still has to meet every CGMP requirement and the PPQ protocol's lot release criteria, and the firm needs a system for fast complaint review. If later PPQ results turn negative, the firm must assess the released lots and take corrective action under 211.100(a), 211.180(e) and 211.192.

Retrospective validation has no place in the 2011 guidance, and Annex 15 paragraph 5.3 rules it out. A legacy product with years of batch records starts at Stage 3, trending those records, rather than claiming validation from them.

What does FDA cite under 21 CFR 211.100 and 211.110?

FDA cites missing or inadequate production and process control procedures under 21 CFR 211.100(a), procedures not followed or deviations not justified under 211.100(b), and missing in-process controls or unvalidated process performance under 211.110(a). In the Atlas dataset, 275 of 774 Part 211 drug inspections (35.5%) cited at least one of these sections.

The 211.100(a) citations follow FDA's standard text: "Your firm failed to establish adequate written procedures for production and process controls designed to assure that the drug products have the identity, strength, purity, and quality that they are purported or represented to possess." That wording, with or without "adequate," appeared at 180 of the 189 inspections citing 211.100(a). The closest match to an unvalidated process is the 211.110(a) wording "Control procedures are not established which monitor the output and validate the performance of those manufacturing processes," which appeared at 40 inspections. Half of those 40 ended OAI, and 6 were at foreign facilities.

Recent forms in the FDA Form 483 database show the pattern:

The Par Health and Hospira forms share an investigator: Jacob G Lutz, who has 60 inspections across 56 sites and 187 Form 483 observations on record in Atlas. The Par Health site page lists 30 FDA inspections, 22 of them with a Form 483, and records a warning letter outcome for the October 2025 inspection. Two forms not yet indexed in Atlas follow the same pattern: DPT Laboratories in San Antonio (February 10, 2026, 211.100(a) and 211.110(a), VAI) and OraLabs in Parker, Colorado (October 2, 2025, 211.100(a) and 211.110(a) with four other sections, OAI).

Inspections with process control citations ended worse. The 275 inspections citing 211.100 or 211.110 averaged 5.8 Part 211 citations, against 3.1 at the other 499, and 120 of them also cited 211.192, the investigations section covered in our 21 CFR 211.192 guide. The share held steady: 35.9% of Part 211 drug inspections in 2025 (202 of 562) and 34.4% from January to September 2026 (73 of 212). Foreign facilities drew these citations at 56 of 142 inspections (39.4%), against 219 of 632 in the US (34.7%). The NAI, VAI and OAI classifications explain what an OAI outcome means for a facility.

Investigators who write up process controls have records in the same database, so a manufacturing site can check which Part 211 sections its likely investigator cited at peer facilities before the opening meeting.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

How do you keep a process in a validated state?

A process stays validated when the firm runs an ongoing program to collect, trend and review process and product data, as 21 CFR 211.180(e) requires, and routes every planned change through evaluation before it reaches production. FDA's 2011 guidance treats this monitoring as Stage 3 and sends the firm back to Stage 1 or 2 activities when the data show a problem.

The guidance recommends that a statistician or someone trained in statistical process control design the data collection plan and the methods used to judge process stability and capability. Procedures should describe how trending is done and should guard against both overreacting to single events and missing real variability. The quality unit reviews the results. Changes to the process need quality unit approval before implementation (211.100), and departures from a PPQ protocol need approval from every relevant department and the quality unit before anyone acts on them.

Process control citations keep arriving each month, and the digest below sends the new ones as FDA publishes them.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe