The FDA's guidance Process Validation: General Principles and Practices (2011) reorganised validation around the product lifecycle in three stages:
- Process design — building the process from development knowledge.
- Process qualification — demonstrating it performs reproducibly.
- Continued process verification — the standing obligation to keep assuring, during routine commercial production, that the process remains in a state of control.
Stage 3 is SPC. The guidance does not use the phrase "control chart", but it describes ongoing collection and statistical evaluation of process and product data, with the explicit aim of detecting undesired process variability, and it expects a statistician or someone with adequate statistical training to be involved in designing the data collection plan and the evaluation.
In Europe the same requirement lives in EU GMP Annex 15 (qualification and validation) as ongoing process verification, reinforced by ICH Q10 on the pharmaceutical quality system, which asks for the monitoring of process performance and product quality as a routine, continuing activity.
What Stage 3 actually asks for
Reading the guidance and the European texts together, a defensible CPV programme has to establish:
- What is monitored. A defined set of process parameters and quality attributes, chosen with a rationale rather than because they were already in the batch record.
- How it is evaluated statistically. Not "we look at it" — a stated method, with limits derived from data, and a documented basis for those limits (usually the qualification batches).
- What counts as a signal. Predetermined criteria for when a trend requires investigation. This is exactly a rule set, written down in advance.
- What happens then. A route from signal to investigation to action, with evidence that it was followed.
- Periodic review. That the monitoring plan itself, and the limits, get re-examined — typically at annual product review.
The recurring finding in inspections is not the absence of charts. It is charts without a documented basis for their limits, or trends that were visible for a year with no record that anyone looked.
The distinction that catches people out
Specification limits are not control limits. A batch inside specification can be a batch from a process that has changed. Stage 3 is a question about the process, not about release. If your CPV report only shows results against specification, you have not verified anything about control — and that is the single most common weakness in a CPV package.
The corollary is uncomfortable and worth stating: a Stage 3 signal can occur on a batch that releases perfectly. That is the system working. A programme that only investigates OOS results is a release system wearing a CPV label.
What a charting tool can honestly contribute
- Limits computed from the qualification batches and then frozen, stored with the window they came from, who set them and when. That is the "documented basis" requirement, satisfied by construction rather than by a memo.
- A named, reusable rule set per parameter — your predetermined criteria, in a place that cannot drift from what the SOP says.
- Continuous evaluation as each batch lands, with an alert, rather than a quarterly review that finds a nine-month-old shift.
- A change log covering every limit change, tolerance edit and deletion, exportable when somebody asks why a decision was made in March.
- Read-only views for people who need to see the data and must not be able to alter it.
What it cannot contribute, and you should assume nobody else's can either
- No product is "validated" when you buy it. Validation is performed by you, for your intended use, in your environment. A vendor can supply an IQ/OQ template pack and evidence that the calculation engine computes what it claims — we do — and that is the input to your qualification, not a substitute for it.
- No 21 CFR Part 11 signature workflow in this platform: actions are attributed and timestamped, but there is no signature meaning or manifestation and no closed-system controls package.
- No non-normal capability handling, no CUSUM/EWMA, no p/np/u charts. Content uniformity, impurity profiles and environmental monitoring counts frequently need one of those.
- No LIMS, MES or batch record integration. Data arrives as CSV or over an API.
Sources
- FDA, Process Validation: General Principles and Practices — find it in the FDA guidance document database.
- EudraLex Volume 4, Annex 15 — qualification and validation.
- ICH Q10, pharmaceutical quality system.
More on how this looks on a real parameter, with a worked chart across a validation baseline: SPC for pharmaceutical manufacturing.