FDA Process Validation Stages 1–3: A Practical GMP Guide for 2026

The number that tends to surprise manufacturers when they audit their own process validation documentation isn’t how many gaps exist — it’s how old those gaps are. FDA warning letters from 2024 and 2025 consistently show facilities still operating under the pre-2011 mental model: run three consecutive batches, collect release data, declare victory. That’s not what the agency expects anymore, and more than 15 years after publishing its current guidance, FDA is showing diminishing patience for that misunderstanding.

FDA’s January 2011 “Process Validation: General Principles and Practices” guidance fundamentally restructured how the industry thinks about validation. Where the 1987 guidance treated validation as a discrete event, the 2011 document introduced a lifecycle framework divided into three stages: Process Design (Stage 1), Process Performance Qualification (Stage 2), and Continued Process Verification (Stage 3). These aren’t simply renamed versions of the old approach. They represent a different philosophy entirely — and getting each one right is what separates companies that sail through pre-approval inspections from those that collect 483 observations.

The 2011 Shift That Redefined “Validated”

Before 2011, the implicit logic was: validate once, maintain the validation. That worked — until it didn’t. The 2011 guidance replaced that logic with a continuous learning model aligned with ICH Q8(R2), Q9, and Q10, the pharmaceutical quality system trilogies emphasizing science- and risk-based decision-making throughout a product’s entire commercial lifecycle.

The guidance defines its goal plainly: “The goal of the lifecycle approach… is to design and develop a robust manufacturing process that will consistently deliver a quality product.” What makes that significant is the word design. FDA expects you to understand why your process works, not just demonstrate that it works under controlled conditions.

This has regulatory teeth. Under 21 CFR § 211.100(a), manufacturers must have written procedures for production and process controls designed to assure products conform to specifications. But “written procedures” alone isn’t enough — FDA expects those procedures to be grounded in actual, documented process knowledge, and that knowledge-building starts in Stage 1.

Stage 1 — Process Design: Where Validation Actually Begins

Stage 1 encompasses all activities from initial development through technology transfer to the commercial manufacturing site. This is where you establish what your Critical Quality Attributes (CQAs) are — the physical, chemical, biological, or microbiological properties that must remain within defined limits to ensure product quality — and identify the Critical Process Parameters (CPPs) that drive them.

The practical work here typically includes Design of Experiments (DoE) studies, risk assessments using FMEA or fault tree analysis as outlined in ICH Q9, and small-scale or pilot-scale process characterization runs. The number of experiments varies with product complexity. A straightforward oral solid dosage form might require 15–20 DoE runs to adequately bracket the design space; a sterile injectable can easily exceed 40 characterization runs before commercial-scale PPQ is justified.

One mistake we see repeatedly in regulatory compliance consulting engagements: companies treat Stage 1 as purely an R&D activity and then fail to transfer the knowledge adequately to manufacturing. FDA’s technology transfer expectations — reinforced in both SUPAC guidance and more recent CDER inspection trend presentations — require that the commercial manufacturing site receive the full process knowledge package, not just a batch record and a set of in-process limits.

The deliverable from Stage 1 isn’t a validation protocol. It’s a validated design space, documented operational ranges, and a clear mechanistic understanding of variability sources. Build Stage 2 on anything less and you’re likely generating data that confirms a process you don’t fully understand — which is precisely what FDA inspectors are trained to probe.

Stage 2 — Process Performance Qualification: More Than Three Batches

Stage 2 is where most manufacturers concentrate their validation resources — and where the most persistent misconceptions live.

The “three batch rule” tops the list. FDA’s 2011 guidance never mandates three PPQ batches. What it requires is “a sufficient number of PPQ runs to demonstrate reproducibility and provide adequate statistical data to establish confidence.” Three is a floor rooted in historical practice and regulatory muscle memory, not a statutory requirement. For high-complexity processes or novel drug products, 5–8 PPQ batches at commercial scale aren’t unusual, and FDA reviewers during pre-approval inspections (PAIs) will ask for scientific justification of whatever number you chose. “We always do three” is not that justification.

The PPQ protocol itself must be approved before execution — non-negotiable under 21 CFR §§ 211.68 and 211.100. It needs to include acceptance criteria that are tighter than routine release specifications (expanded sampling plans are expected at PPQ scale), the statistical method for evaluating results, roles and responsibilities, and the procedure for handling deviations. A PPQ batch that produces a deviation mid-run doesn’t automatically fail, but the investigation must be contemporaneous and documented rigorously. Retrospective deviation investigations surfaced during PAIs are among the most reliable warning signs that a facility’s validation program is reactive rather than prospective.

Data integrity during Stage 2 is increasingly scrutinized. FDA’s 2018 Data Integrity and Compliance with Drug CGMP guidance applies fully to validation records. Audit trails, original raw data, and ALCOA+ principles — Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available — govern every PPQ record. FDA’s FY2024 domestic drug inspection data indicates that data integrity findings appeared in approximately 35–40% of pharmaceutical manufacturing warning letters that year. PPQ records appear in those observations more often than most validation managers would expect.

Stage 3 — Continued Process Verification: The Stage Most Companies Shortchange

Stage 3 is the part of the lifecycle framework that facilities most often implement nominally.

The concept is straightforward: after commercial production begins, collect data systematically to provide ongoing statistical assurance that the process remains in a state of control. In practice, this means defining which process attributes and quality parameters you’ll monitor, at what frequency, and using what statistical methods — then actually executing that program.

Statistical process control (SPC) tools — control charts, process capability indices (Cpk and Ppk), run-rule analysis — are FDA’s expected analytical toolkit here. A Cpk of at least 1.33 is the conventional industry benchmark for a capable process, though the appropriate threshold varies by attribute criticality and product type. The goal isn’t to chase perfect indices; it’s to detect process drift before it produces an out-of-specification result or triggers a recall.

Where Stage 3 breaks down most predictably: it exists only on paper. Companies write a Continued Process Verification (CPV) plan as part of their validation package, define monitoring frequencies and SPC thresholds, and then don’t execute it with any consistency. Annual Product Reviews required under 21 CFR § 211.180(e) often contain the raw data needed for CPV analysis but aren’t structured to actually perform it. Those two documents — the CPV plan and the APR — should be tightly integrated, not siloed into separate quality functions.

Change control is the other pressure point. Every manufacturing change — raw material supplier switch, equipment replacement, process parameter adjustment — must be evaluated against the validated state. If the change falls within the approved design space defined in Stage 1, that evaluation is straightforward. If it doesn’t, a Stage 2 re-qualification may be required. Missing that linkage is precisely how facilities drift out of a validated state without recognizing it until an investigator points it out.

The Validation Failures FDA Is Still Finding in 2026

Pull warning letters from the past 18 months and the pattern is remarkably consistent. The most common process validation deficiencies include:

• Nominal Stage 3 programs — CPV plans written but never executed, or executed without statistical rigor
• Retrospective PPQ justifications rather than prospectively approved protocols
• Under-characterized Stage 1 design spaces, leaving CPPs undefined or bracketed too broadly
• Change control gaps that don’t trigger re-validation evaluation when parameters shift
• Annual Product Reviews disconnected from the CPV program they’re supposed to feed

A warning letter issued in Q3 2024 to a large contract manufacturer captured this failure mode precisely. The facility had completed PPQ for 12 product lines, but CPV plans for 9 of them had never been executed after commercial launch. The FDA investigator cited 21 CFR §§ 211.180(e) and 211.110(a), noting that “the firm has not established a program to ensure the processes for drug products remain in a state of control.” For a contract manufacturer, that observation isn’t just a compliance problem — it’s an immediate commercial one. Customers begin auditing, contracts go on hold, and remediation typically takes 12–18 months to satisfy both the FDA response requirements and customer quality agreements.

The fix isn’t technically complicated, but it requires organizational commitment. Stage 3 has to be treated as a standing operational program, not a one-time validation deliverable. Assign process owners. Build CPV reviews into the APR cycle. When an SPC chart signals a trend, investigate it before it becomes an OOS event or a field complaint.

If your current validation program predates 2011 — or if it was updated in name only — a structured gap assessment against FDA’s current lifecycle guidance is the right starting point. It’s also where most regulatory compliance consulting engagements begin: aligning what’s documented against what an investigator will actually expect to see during a PAI or surveillance inspection.

Companies that can demonstrate robust Stage 1 process characterization and an active, data-driven Stage 3 CPV program are in fundamentally stronger positions with FDA reviewers than those that can show three clean PPQ batches and nothing more. The former tells a scientific story. The latter raises questions about what happens on batch four.

Start with the gaps you can document today. Stage 3 implementation almost always delivers the highest return on validation investment — and it’s among the first things an investigator will request.

Written by Sam Sammane, Founder & CEO, Aurora TIC. Learn more about our team

Talk to our compliance consultants — Contact us

Related from our network

• Analytical Testing to Support PPQ Batch Release and CQA Monitoring — Qalitex Laboratories provides ISO 17025-accredited pharmaceutical analytical testing, including method validation and in-process attribute testing for Stage 2 PPQ programs.
• Pharmaceutical Raw Material Qualification Testing for GMP Supply Chains — Androxa offers GMP-aligned raw material and supplier qualification testing for Canadian pharmaceutical manufacturers building compliant validation programs.