What does CQV stand for, and what does each part mean?

CQV stands for commissioning, qualification, and validation. Together, they form a three-step process aimed at ensuring that pharmaceutical products are manufactured and stored correctly through testing that the equipment, procedures, and facilities involved live up to the required standards:

• Commissioning is the Good Engineering Practice (GEP) activity that verifies a facility, system, or piece of equipment is installed correctly and operates according to design intent. It combines static checks - such as wiring, labels, and tag numbers - with early functional tests (fans at full speed, alarms, loop checks) to prove the system works as designed, not merely as described in a vendor manual.
• Qualification (IQ/OQ/PQ) demonstrates that the commissioned system performs as intended, meeting all user and regulatory requirements. IQ proves proper installation, OQ proves the system works across its full operating range, and PQ proves it can maintain those conditions with real-world loads.
• Validation confirms, through data and documented evidence, that the qualified system consistently performs as intended over time.

Why is CQV required for pharmaceutical facilities?

FDA cGMP regulations (21 CFR § 210/211) and EU GMP Annex 15 require manufacturers to prove that any environment that products are in contact with operates within predefined limits. CQV provides this proof, preventing temperature excursions, contamination, and data-integrity gaps that could trigger costly product holds or recalls. CQV combines Good Engineering Practice (GEP), risk-based qualification, and ongoing validation into a single, documented life cycle. The expectations sit in:

• 21 CFR § 210/211 for CGMP facilities
• FDA Process Validation Guidance (2011)—Stage 1 (process design) maps directly to qualification of equipment and utilities.
• ISPE Baseline Guide Vol. 5 (CandQ), the industry playbook for integrating commissioning with qualification.

Failing CQV shows up in 483s as “inadequate qualification” or “poor environmental monitoring,” two of the most common citations in warehousing and distribution.

How long does the CQV process in pharma take?

The specific timeline for a CQV process to be conducted depends both on the facility type, scope, and much more.

However, typical CQV calendar times are around*:

• Warehouse: 5 – 7 months
• Cold room/freezer: 2 – 3 months
• Non-sterile manufacturing: 6 – 9 months
• Sterile suite: 9 – 12 months *Timelines assume medium complexity.

Also read: Accelerate commissioning time with VIRTUAL temperature mapping for GxP

Start with a CQV master plan

Always include:

• Validation master plan (VMP) or CQV plan: Defines scope, roles, risk methodology, document hierarchy, and acceptance criteria.
• Quality risk management (ICH Q9): Use a high-level risk assessment to decide which utilities, rooms, and IT systems are critical to product quality; focus testing there and streamline the rest.

Define what “good” looks like

Turning URS + DQ into a clear target

Before contractors pour a footing or installers hang the first air sock, you need a documented picture of success – a user requirements specification (URS) and the accompanying design qualification (DQ). Together, they answer two questions: Exactly what conditions must the storage space achieve? (URS) Does the chosen design have the engineering muscle to deliver those conditions? (DQ)

1. Build a URS that speaks the language of product quality

Some of the key elements of a URS for a pharmaceutical storage area are:

• Environmental set-points: The temperature and, if relevant, humidity band the room must hold. For an ambient warehouse that is often 15 – 25 °C with ≤ 65 % RH; a 2 – 8 °C cold room is usually specified at ± 0.5 °C; a freezer may sit at −20 °C or colder.
• Capacity and layout: Pallet count, racking height, aisle width and any segregation zones.
• Data-integrity and security needs – 21 CFR Part 11 audit trails, time synchronisation, role-based access, camera coverage, badge control.
• Resilience points: Redundancy for critical fans or compressors, generator run-time, disaster-recovery targets for the monitoring system.
• Other product-protection clauses: Fire suppression class, pest-exclusion features, and physical intrusion resistance.

Each storage flavour brings specific add-ons; for instance, cold rooms/freezers must reference defrost-cycle control, door-heater performance, and UPS run-time for the controller.

2. Translate URS into reality with the DQ

The design qualification reviews every drawing: HVAC schematics, building envelope U-values, sensor locations, BMS data paths, fire and security layouts, and asks the question: “Will this configuration achieve the URS on the worst day of the year?”

Where the answer is “no”, you document the gap and revise the design before building or purchasing. That one step is cheaper than fighting a temperature deviation for the next decade.

3. Close the loop with a risk-and-impact assessment

For every URS line, build a short “impact statement”: Does this requirement protect product quality, operator safety, or only convenience? High-impact items go on to full IQ/OQ/PQ testing; low-impact items can often be verified by commissioning records alone. The traceability matrix you create here is the roadmap auditors will follow.

4. Sign-off timing — the point of no (expensive) return

URS and DQ must receive Quality sign-off before construction starts or major equipment is ordered. EU GMP Annex 15 repeats this warning for good reason: re-routing refrigerant lines or swapping under-sized AHUs after walls are sealed is far more expensive than adding capacity on paper. Treat the URS/DQ approval as your “freeze” date; any late change triggers formal change-control and revision of the risk assessment.

Commissioning —“make it work safely”

Commissioning is an engineering activity carried out before formal qualification. Typical tasks include:

• Verify installation vs. drawings check equipment tags, sensor locations, electrical panels, pipe routes, and racking positions against the final P&IDs or layout drawings.
• Loop-check and calibrate critical probes inject known signals (or use reference baths/chambers) and confirm the controller, BMS, or EMS displays the correct value.
• Start-up and functional checks of HVAC, refrigeration, and safety systems prove fans, compressors, dampers, generators, sprinklers, and alarm panels operate as intended.
• Log and close punch-list items in real time record every defect, assign an owner, and retest after the fix so the issue is closed before you move to IQ.

Qualification – IQ → OQ → PQ

The qualification part of CQV is about showing that your pharma facility performs as expected and within requirements continuously.

Installation Qualification (IQ)

The point of IQ is to show that every critical piece of equipment, instrument, or utility was installed exactly as specified and is ready for service. You gather tag numbers, wiring diagrams, calibration certificates, vendor manuals, and any “clean-build”/passivation records to create a rock-solid baseline.

How the focus shifts by facility:

• Ambient warehouse: Verify all HVAC units, temperature and RH probes, data logger IDs, and monitoring points. Make sure every sensor sits in the location called out in the design drawings and that the calibration matches the certificates.
• Cold room or freezer: Do everything you would for a warehouse, then add compressor serial numbers, refrigerant type, and charge volume, door-heater installation checks, and factory acceptance records for the refrigeration skid.
• API or potent-compound plant: Include material-of-construction certificates for reactors and pipework, verify dust-extraction hoods and flexible connections, and check that pressure gauges on inert-gas blanketing lines read correctly after calibration.

Download the 8-step CQV in pharma checklist here ✅

Operational Qualification (OQ)

OQ demonstrates that every system functions across the full range of intended operating conditions and that alarms, interlocks, and software behave the way the design says they should.

Facility-specific spin:

• Warehouse: Run HVAC step tests from worst-case low to worst-case high outdoor temperatures, open the dock doors for the longest expected dwell time, and force high/low temperature alarms. Confirm the system recovers after a simulated power failure.
• Cold room or freezer: Cycle compressors on and off, run at least one full defrost, challenge the ± 0.5 °C alarm thresholds, and time how quickly the room returns to set-point after a one-minute door opening.
• API plant: Execute CIP/SIP cycles, hold solvent and inert-gas lines under pressure for the defined period, and check interlocks that prevent simultaneous opening of cross-contamination-risk valves.

Also see: IQ, OQ, and PQ services for GMP and GDP

Performance Qualification (PQ)

PQ is the evidence that the actual facility, populated with real product loads and under real operational conditions, maintains conditions that protect quality even under worst-case scenarios.

Tailoring PQ to each environment:

• Warehouse: Map temperature and humidity continuously – often PQ is needed in both summer and winter. Fill racks to maximum capacity, run forklift traffic, and document recovery after mock door-open events. WHO TRS 961 calls for this level of systematic mapping; durations can shorten only if you have a defensible thermal-inertia rationale.
• Cold room or freezer: Record a 24- to 72-hour mapping run that captures at least one defrost cycle and a simulated power-outage period with product simulants or a full pallet load.
• API plant: Manufacture three full-scale validation batches back-to-back under routine parameters, collect all in-process control data, and prove that cleaning between campaigns removes residues to below the validated limits.

Also read: Temperature mapping: Tips, frameworks, and pitfalls

Validation – monitoring system, data flows, and critical utilities

Your warehouse or other facility can ace every HVAC test, yet still fail an audit if the software that logs temperatures or the utilities that touch product are unreliable. That is why the next CQV step moves beyond the facility to anything that handles data or contacts product surfaces.

Digital systems

Treat every monitoring platform – EMS, BMS, and, if it triggers release, WMS – as a GAMP 5 regulated system.

Work through the full life-cycle (specification → configuration/build → verification → release), then run a data-integrity check covering audit trail, time-sync, role-based access, e-signatures, backup/restore and disaster-recovery drills.

Also read: How to master temperature monitoring in critical environments

Critical utilities

Apply the same rigour to physical utilities. Prove UPS run-time for loggers, pull-down and door-open recovery in cold rooms, purity of compressed gases or WFI, etc. Test depth follows your ICH Q9 risk assessment, and all evidence – test scripts, results, deviations, and change-control records – go into a single[FDA 21 CFR Part 11]/Annex 11 compliance report.

Lock the validated state in place

Qualification proves the facility works today; SOPs and preventive maintenance keep it that way tomorrow.

• Publish SOPs that cover procedural steps such as daily checks (alarm lights, door seals), weekly walk-arounds (leak signs, probe integrity), and scheduled tasks such as HVAC-filter swaps, compressor-oil changes, and battery tests. Also include, excursion handling, calibration, change control, and periodic review.
• Slot every activity into your CMMS with ISO 17025-calibration recall dates.
• Add a change-control SOP. Any layout shift, set-point tweak, or major repair must be risk-assessed before work starts and re-qualified afterwards if it can affect temperature or airflow.

Ongoing verification and periodic review

EU GMP Annex 15 expects “an ongoing programme to verify the validated state.” Commit in writing when to conduct re-mappings. Pull EMS data monthly, trend the hottest and coldest probes, and investigate drift before it breaches limits. Define trigger points – new racking, HVAC overhaul, sustained excursions – that launch partial or full re-qualification.

Also read: Continuous temperature mapping: A framework to eliminate re-mapping

Examples of verification of validated state for warehouses and cold rooms

The following procedures are examples of how to keep each facility type in a validated state, aligned with its specific risk profile:

Pharmaceutical warehouse

• Operations: Standardise receipt, put-away, and pick-and-ship workflows so every pallet follows a traceable, GDP-compliant path from dock to dispatch.
• Maintenance: Schedule preventive HVAC filter changes at manufacturer-recommended intervals to protect airflow and temperature stability.
• Ongoing verification: Run a full temperature re-mapping once a year or after any layout or HVAC modification.

Cold room or freezer

• Operations: Define an excursion-handling SOP that brings any out-of-spec event back under control in less than 30 minutes, with clear quarantine and release steps.
• Maintenance: Include compressor oil checks, gasket inspections, and door-heater tests in the routine PM calendar.
• Ongoing verification: Re-map temperature every six to twelve months, or immediately after a major service or set-point change.

Training & competence

Even the best SOP is useless if nobody follows it. List every role that touches the storage area – operators, maintenance techs, QA reviewers, IT admins – and map them to the tasks they perform. Provide initial training on the new SOP set, plus refresher sessions whenever procedures change.

Tip! Keep signed attendance sheets or e-learning records; inspectors will ask to see proof that the person who acknowledged an alarm actually knows the alarm SOP.

Final report and QA release

When all CQV steps are complete, compile the evidence into a single Validation Summary Report. This would usually include:

• A traceability matrix linking every URS clause to its test result
• A deviation log with root cause and closure signatures
• A risk-based explanation for any test that was legitimately skipped
• Copies of all change-control forms raised during the project

Quality Assurance then issues a certificate declaring the storage facility “fit for intended use,” formally handing it over to routine GMP/GDP operations and closing the CQV life-cycle.