Facility Operational Qualification for GMP Facilities

Purpose and Scope

Facility Operational Qualification provides documented evidence that integrated facility functions operate as intended throughout approved operating ranges and respond correctly to defined challenge, alarm, failure, emergency, and recovery conditions.

Facility OQ evaluates the facility as a coordinated operational environment. It focuses on interactions among rooms, architectural features, doors, access controls, pressure relationships, environmental controls, monitoring systems, utilities, alarms, interlocks, emergency functions, operating procedures, and personnel activities.

Facility OQ may include verification of:

Room operating states
Environmental setpoints and ranges
Room-to-room pressure relationships
Door operation and interlocks
Access-control functions
Airlock and pass-through sequences
Alarm generation, indication, notification, acknowledgement, and clearance
Facility automation interfaces
Utility availability and failure indications
Emergency functions
Power-loss responses
Operating-mode changes
Defined occupancy and activity conditions
Response to abnormal conditions
Recovery following failures or excursions
Readiness for environmental performance verification and intended operation

Facility OQ does not simply repeat individual HVAC, automation, utility, security, or electrical tests. It determines whether these systems work together to support the intended facility-control strategy.

Detailed installation verification belongs in Facility Installation Qualification. Sustained environmental performance under representative operating conditions requires subsequent performance verification and routine monitoring.

Facility Operational Qualification functional challenge matrix arranged around a GMP facility floor plan, showing normal operation, doors and access, pressure relationships, failure and emergency conditions, occupancy and activity, recovery, and integrated facility OQ evidence. — Facility OQ challenges integrated room and facility functions under normal, access, pressure, occupancy, failure, emergency, and recovery conditions to demonstrate that controls operate together as intended.

Regulatory and Lifecycle Basis

21 CFR Part 211, Subpart C establishes requirements for pharmaceutical buildings and facilities.

21 CFR 211.42 requires suitable construction, adequate space, orderly placement, and defined areas or other controls necessary to prevent contamination and mix-ups.

21 CFR 211.46 addresses ventilation, filtration, air pressure, microorganisms, dust, humidity, temperature, exhaust, and air recirculation.

When automated equipment is used, 21 CFR 211.68 requires appropriate controls to ensure proper operation and control of changes.

These regulations establish required outcomes but do not prescribe a universal facility OQ protocol. Facility OQ provides controlled evidence that the installed facility can achieve and maintain the operational conditions on which those outcomes depend.

FDA’s Process Validation: General Principles and Practices guidance places facility and utility qualification before process performance qualification. For sterile operations, FDA’s Aseptic Processing CGMP Guidance provides additional recommendations concerning clean-area control, airflow, pressure relationships, environmental conditions, alarms, and facility operation.

The OQ scope and testing depth should be based on intended use, approved requirements, contamination risks, process risks, system complexity, design controls, and the consequences of operational failure.

Position of OQ in the Facility Lifecycle

Facility OQ follows sufficient completion of construction, commissioning, and IQ.

The typical progression is:

Define intended use and facility requirements.
Complete facility design and risk assessment.
Perform Facility Design Qualification.
Construct and commission the facility.
Complete facility and system IQ activities.
Establish the controlled as-built configuration.
Confirm readiness for functional challenge testing.
Execute facility and system OQ.
Resolve deviations and confirm recovery capability.
Perform environmental and performance verification.
Complete operational-readiness activities.
Approve the facility for its intended GMP use.

Controlled overlap between IQ and OQ may be acceptable for phased projects when system boundaries are clear, applicable prerequisites are complete, configuration is controlled, and remaining work cannot invalidate OQ results.

Facility OQ should not proceed where unresolved installation defects, uncontrolled field changes, missing instruments, incomplete automation configuration, or construction activities could invalidate functional testing.

The complete facility qualification lifecycle should define the relationships among commissioning, IQ, facility OQ, system-specific OQ, environmental performance verification, and release.

Defining the Facility OQ Boundary

The OQ boundary should be established before protocol development.

The scope may be organized by:

Building
Floor
Operational area
Room group
Cleanroom suite
HVAC zone
Pressure-control zone
Personnel or material route
Utility boundary
Automation package
Qualification package
Phased-release area

The boundary should identify:

Rooms and spaces included
Facility functions included
Operating states included
HVAC and utility interfaces
Doors, airlocks, and pass-throughs
Access-control functions
Automation and monitoring functions
Alarm and interlock dependencies
Emergency and power interfaces
Tests performed in separate system protocols
Commissioning evidence intended for use
Exclusions and their justification
Adjacent areas that could affect the qualified boundary

A room cannot always be tested independently of its surrounding spaces. Door operation, pressure relationships, airflow direction, shared utilities, access controls, exhaust systems, and emergency modes may produce effects beyond the nominal room boundary.

The selected OQ boundary must therefore support meaningful integrated testing.

Facility OQ Versus HVAC OQ

Facility OQ and HVAC OQ are related but not interchangeable.

HVAC OQ

HVAC Operational Qualification focuses on the air-handling and environmental-control system itself.

Typical HVAC OQ scope includes:

Air-handling-unit operating modes
Supply, return, and exhaust fan operation
Fan rotation and status
Start and stop sequences
Damper modulation
Heating and cooling control
Humidification or dehumidification control
Filter differential-pressure monitoring
Airflow control loops
Variable-air-volume terminal operation
Sensor and transmitter functions
Local and remote status indication
HVAC alarm functions
Setpoint adjustment controls
Loss-of-signal responses
Equipment-failure responses
Lead-lag or standby-unit changeover
Building-automation interfaces
System recovery following shutdown
Verification of defined airflow, temperature, humidity, and pressure-control capability

HVAC OQ answers:

Does the HVAC system operate correctly throughout its defined functional and control ranges?

Facility OQ

Facility OQ focuses on integrated room and facility behavior.

Typical facility OQ scope includes:

Room operating-state changes
Room-to-room pressure relationships
Effects of door operation on pressure control
Airlock and pass-through sequences
Access-control and door-interlock functions
Effects of occupancy and movement
Coordination of supply and exhaust systems
Facility-wide alarm routing
Emergency modes
Power-loss response
Utility-failure effects
Adjacent-area interactions
Controlled shutdown and restart
Recovery of required room conditions
Implementation of alarm-response and operating procedures

Facility OQ answers:

Does the integrated facility operate as intended when rooms, doors, people, automation, HVAC, utilities, alarms, and emergency functions interact?

Shared Evidence

Some evidence may support both activities.

For example, HVAC testing may demonstrate that individual pressure-control loops reach their setpoints. Facility OQ may then challenge the complete pressure cascade while doors, airlocks, access controls, exhaust systems, and adjacent rooms operate in defined combinations.

The qualification plan should identify:

Which protocol generates the original evidence
Which requirements the evidence satisfies
Whether integrated confirmation is required
How the evidence is referenced
Which deviations could affect both protocols

Testing should not be duplicated merely because two protocols use the same measurement. However, successful component testing should not be treated as proof of integrated facility performance when critical interactions have not been challenged.

OQ Prerequisites

Before facility OQ execution, applicable prerequisites should be confirmed.

These may include:

Approved OQ protocol
Defined facility boundary
Approved requirements and acceptance criteria
Approved design and operating documents
Accepted facility IQ status
Accepted supporting-system IQ status
Completed commissioning necessary for OQ
Controlled as-built drawings
Approved automation configuration
Current control narratives
Current cause-and-effect matrices
Current alarm and interlock lists
Current room-data sheets
Current pressure-cascade diagrams
Required utilities available
Required systems placed into service
Instruments calibrated
Qualification test instruments calibrated
Data-acquisition systems available
Required operating procedures available
Required emergency procedures available
Personnel trained for test participation
Test areas clean and controlled
Construction activities adequately restricted
Open punch-list items assessed
Critical deviations resolved
Safety review completed
Test restoration plan available

A prerequisite should not be marked complete solely because a document exists. Its content and status must support the planned test.

If a required prerequisite is incomplete, the affected test should be deferred unless an approved assessment demonstrates that execution remains valid.

Facility OQ Planning

The OQ protocol or controlled test package should define:

Purpose and scope
System and facility boundaries
Responsibilities
Applicable requirements
Reference documents and revisions
Prerequisites
Operating states
Test conditions
Challenge methods
Expected system responses
Acceptance criteria
Test instruments
Data-recording requirements
Required hold or stabilization periods
Alarm and event-record review
Restoration steps
Safety controls
Deviation handling
Traceability
Approval requirements
Criteria for progression

Testing should be based on approved functional requirements and risk assessment. It should not consist of generic challenges copied from another facility without considering the actual control strategy.

Each challenge should define:

Initial condition
Function or failure introduced
Expected local response
Expected remote response
Alarm or interlock expected
Permitted response time
Effect on adjacent rooms or systems
Operator action required
Data to be recorded
Recovery method
Final acceptable condition

The protocol should identify which controls may be deliberately overridden, forced, disconnected, or simulated. Such actions require authorization, technical controls, restoration verification, and protection against unintended operation.

Functional Challenge Matrix

A functional challenge matrix connects facility requirements and risks to defined test conditions.

The matrix should identify:

Facility function	Normal condition	Challenge condition	Failure condition	Recovery evidence
Room pressure	Required cascade established	Door opened or adjacent condition changed	Fan, sensor, or control loss	Cascade restored within defined time
Door interlock	Approved sequence permits access	Simultaneous door request	Interlock or communication failure	Secure operating state restored
Environmental control	Conditions within approved ranges	Setpoint or load changed	HVAC or utility loss	Conditions return to approved range
Alarm management	Normal status displayed	Alarm threshold challenged	Notification or communication failure	Alarm clears and records remain complete
Access control	Authorized entry permitted	Invalid or restricted request	Power or network interruption	Defined access state restored
Emergency function	Normal operating mode	Emergency function initiated	Loss of supporting power or signal	Controlled reset and restart
Facility automation	Correct status and control	Mode or command changed	Signal, sensor, or controller failure	Configuration and control restored
Utility interface	Required utility available	Demand or operating mode changed	Utility interruption	Utility and affected facility functions restored

The matrix should include only meaningful challenges. Testing every theoretical combination is neither practical nor technically useful.

Combination testing should focus on credible interactions that could:

Compromise product protection
Reverse a pressure relationship
Defeat segregation
Permit simultaneous door opening
Prevent alarm annunciation
Create an uncontrolled room state
Affect multiple rooms
Prevent safe shutdown
Delay recovery
Produce misleading status information

Verification of Normal Operation

Facility OQ should first establish that the integrated facility operates correctly under defined normal conditions.

Normal-operation verification may include:

Correct room operating mode
Required pressure relationships
Temperature and humidity control
Correct door and access status
Functional airlock sequences
Correct automation displays
Correct room-status indication
Required utilities available
Alarm-free normal state
Correct system time
Appropriate trend generation
Appropriate status recording
Correct interaction with adjacent areas
Stable conditions during routine equipment operation

Normal conditions must be defined. Phrases such as “room operating normally” are inadequate without identifying:

Systems operating
Doors normally closed or in use
Required occupancy
Equipment operating
Utility demand
Environmental setpoints
Room-use status
Adjacent-room condition
Required stabilization period

Normal-operation testing establishes the baseline from which challenge and failure responses are evaluated.

Room Operating States and Mode Changes

Facilities may use different operating modes, such as:

Unoccupied
At rest
Operational
Production
Cleaning
Sanitation
Decontamination
Maintenance
Reduced setback
Night or unoccupied setback
Shutdown
Emergency
Recovery
Restricted access

Facility OQ should verify applicable mode transitions.

Testing may address:

Authorization to change mode
Correct initiation of the mode
HVAC response
Pressure-setpoint changes
Access restrictions
Alarm-limit changes
Monitoring status
Exhaust operation
Door or pass-through availability
Status indication
Event recording
Required delay or stabilization
Prevention of incompatible modes
Return to the approved operating state

A mode label alone does not establish a controlled state. The functions associated with each mode should be defined in an approved control narrative, operating matrix, or equivalent document.

Doors, Airlocks, and Pass-Throughs

Doors and controlled-transfer devices are important elements of facility segregation.

Facility OQ may verify:

Door opening and closing
Automatic closing
Door-position indication
Interlock sequence
Simultaneous opening prevention
Access authorization
Access denial
Emergency release
Local and remote alarm indication
Held-open alarm
Alarm delay
Door-status display
Pass-through interlocks
Automatic locking
Manual override
Reset function
Response following power loss
Response following communication loss
Restoration following an emergency release

Challenges may include:

Requesting both interlocked doors simultaneously
Holding one door open beyond the approved delay
Attempting unauthorized access
Interrupting door-position feedback
Simulating a failed latch or lock indication
Removing normal power
Initiating emergency release
Challenging the sequence from both sides
Operating adjacent airlocks concurrently
Evaluating pressure response during the permitted sequence

The facility-control strategy should define whether an interlock is required for product protection, containment, access security, procedural control, or a combination of purposes.

Door interlocks should not create an unacceptable life-safety hazard. Emergency-release requirements take precedence over contamination-control preferences, and the resulting facility response should be evaluated and documented.

Pressure Relationships and Airflow Direction

Facility OQ should confirm that required pressure relationships function as an integrated cascade.

Testing may address:

Room-to-room pressure differentials
Indication at local displays
Indication at remote systems
Normal pressure stability
Alarm thresholds
Alarm delays
Alarm notification
Alarm acknowledgement
Pressure response to door opening
Response to adjacent door opening
Response during airlock operation
Response to occupancy and movement
Effect of exhaust-system operation
Effect of equipment extraction
Response to supply or exhaust reduction
Pressure reversal prevention
Recovery after disturbance
Response after controlled shutdown and restart

The applicable pressure and airflow strategy is discussed in Airflow Patterns and Pressure Cascades.

A single point-in-time pressure reading does not demonstrate operational control. The test should evaluate the required relationship over a justified observation period and under defined challenge conditions.

Acceptance should consider:

Required direction
Approved differential-pressure range
Permitted transient
Alarm limit
Alarm delay
Duration of the challenge
Recovery time
Effects on adjacent spaces
Intended use of the affected rooms

Brief pressure loss during an authorized door opening may be acceptable when it is expected, limited, controlled, and followed by recovery. Persistent reversal or unrecognized loss of the intended cascade requires investigation.

Detailed airflow, HEPA-filter, air-change, and differential-pressure measurements may be generated through Airflow, Filtration, and Pressure Verification. Facility OQ should reference that evidence while retaining responsibility for integrated facility challenges.

Temperature, Humidity, and Environmental Ranges

Facility OQ should verify that environmental controls operate throughout approved ranges relevant to the facility’s intended use.

Testing may include:

Normal setpoint control
Permitted setpoint adjustment
Upper and lower alarm challenges
Sensor failure response
Loss of heating
Loss of cooling
Loss of humidification
Loss of dehumidification
Response to equipment heat load
Response to occupancy
Response to door activity
Response to outdoor-condition changes
Recovery after an excursion
Correct display, trending, and alarm recording

OQ generally demonstrates functional control and response. Spatial environmental mapping and demonstration of conditions throughout the usable room volume may belong to environmental performance qualification.

Acceptance criteria should distinguish among:

Control setpoint
Normal operating range
Alert level
Alarm level
Product or process limit
Permitted transient
Required recovery time

These values should not be treated as interchangeable.

Access Control and Facility Status

Facility access functions may affect segregation, controlled flow, data security, and prevention of unauthorized entry.

Facility OQ may verify:

Authorized access
Unauthorized-access denial
Role-based access
Time-based restrictions
Area-status restrictions
Anti-passback functions where used
Door-position status
Forced-door alarms
Held-open alarms
Local alarm indication
Remote alarm notification
Event recording
Emergency egress
Power-loss behavior
Communication-loss behavior
Restoration following interruption

Access-control testing should be coordinated with door-interlock and emergency testing. Successful security-system testing alone does not demonstrate that pressure control and contamination-control functions remain acceptable during access events.

Facility Automation and Monitoring Interfaces

Facility OQ should verify the integrated use of automation systems that monitor or control facility functions.

Testing may address:

Room-status displays
Graphical displays
System navigation
Control commands
Mode changes
Setpoint controls
Alarm generation
Alarm priorities
Alarm delays
Alarm routing
Alarm acknowledgement
Alarm clearance
Alarm history
Event history
Trend generation
Time synchronization
Data recording
Communication failure
Sensor failure
Input and output failure
Loss of controller
Loss of server
Loss of network
Backup or standby function
System restart
Restoration of configuration
Interfaces among building, environmental, security, and utility systems

Detailed automation verification should be performed under the Qualification and Verification of Facility Automation Systems strategy.

Facility OQ should focus on whether automation supports the intended facility response. For example, a pressure transmitter may be calibrated and the alarm logic may function correctly, but the facility-level test must still confirm that the alarm corresponds to an actual unacceptable room condition and reaches the personnel responsible for responding.

Alarm Verification

Facility OQ should verify alarms that support product quality, contamination control, containment, safety, or reliable facility operation.

Alarm testing should address applicable:

Initiating condition
Threshold
Delay
Priority
Local indication
Remote indication
Audible or visual annunciation
Notification
Acknowledgement
Recorded value
Timestamp
Event history
Required operator action
Escalation
Clearance
Return-to-normal indication
Latched or nonlatched behavior
Response after power or communication loss

Alarm testing should not be limited to forcing a digital input and observing a screen message when the actual process condition can be safely challenged.

Where simulation is necessary, the protocol should explain:

Why direct challenge is impractical or unsafe
What portion of the alarm chain is tested
What evidence verifies the excluded portion
How the simulation is controlled
How normal configuration is restored

An alarm should be challenged sufficiently to verify the complete intended path from initiating condition to documented response.

Interlocks and Protective Functions

Interlocks prevent or restrict actions that could create an unacceptable facility condition.

Examples include:

Simultaneous opening of airlock doors
Operation in an incompatible room mode
Starting equipment without required exhaust
Opening a transfer device under prohibited conditions
Entering an area during decontamination
Changing a controlled setpoint without authorization
Operating with a failed safety or containment condition
Starting a system before required utilities are available

Interlock testing should verify:

Initiating condition
Prevented action
Permitted action
Local indication
Remote indication
Alarm generation
Manual override controls
Override recording
Restoration
Fail-safe or defined failure position
Interaction with emergency functions

Interlocks should be challenged in combinations where the design depends on coordinated logic. Testing each input independently may not reveal sequencing conflicts.

Utility Interfaces and Loss of Utility

Facility functions may depend on:

Normal electrical power
Emergency power
Uninterruptible power
Compressed air
Chilled water
Heating water
Steam
Process gases
Vacuum
Potable water
Clean utilities
Data networks
Communications
Exhaust systems

Facility OQ should assess credible utility interruptions.

Testing may verify:

Alarm generation
Automatic transfer
Standby-system operation
Controlled shutdown
Equipment fail position
Access status
Door status
Environmental effect
Pressure effect
Data continuity
Notification
Required operator action
Restoration sequence
Controlled restart
Recovery of required conditions

Not every facility requires physical interruption of every utility. Simulation may be appropriate where direct interruption would create unacceptable safety, equipment, or business risk.

The selected method must still verify the intended functional response.

Power-Failure and Emergency Conditions

Facility OQ should evaluate the facility response to applicable power and emergency conditions.

These may include:

Loss of normal power
Transfer to emergency power
Loss of emergency power
Uninterruptible-power operation
Fire-alarm initiation
Emergency ventilation mode
Emergency exhaust
Emergency shutdown
Emergency door release
Security lockdown or release
Utility isolation
Hazardous-material response
Evacuation mode
Loss of automation communication

Testing should confirm:

Which systems continue operating
Which systems stop
Equipment fail positions
Door and access status
Pressure relationships
Alarm generation
Emergency notification
Data continuity
Manual actions required
Conditions for restart
Restoration sequence
Need for environmental recovery or additional monitoring

Facility emergency functions must be coordinated with applicable building, fire, electrical, environmental, health, and safety requirements. Qualification personnel should not defeat or disrupt life-safety functions without an approved test plan and authorized safety controls.

A facility may not maintain every GMP condition during a genuine emergency. The control strategy should instead define:

Safe system response
Protection or disposition of exposed materials
Access restrictions
Required assessment
Recovery criteria
Conditions for resuming GMP operations

Occupancy-Related Conditions

Occupancy affects room pressure, temperature, humidity, particulate generation, airflow disturbance, door use, and equipment heat load.

Facility OQ should evaluate occupancy-related functions where they affect facility control.

Possible conditions include:

Defined minimum occupancy
Defined maximum or challenge occupancy
Personnel movement through doors
Concurrent use of airlocks
Material transfers
Equipment operation
Equipment heat load
Cleaning activities
Mobile equipment movement
Use of local exhaust
Use of pass-throughs
Adjacent-room activity

OQ does not need to reproduce full commercial manufacturing unless that is required to evaluate a facility function. Controlled simulations may be used to challenge:

Door frequency
Heat load
Airlock traffic
Equipment operation
Exhaust demand
Personnel movement
Simultaneous facility activities

The test should define the number of people, equipment state, movement pattern, duration, and adjacent-room conditions.

Environmental performance qualification should subsequently determine whether required environmental conditions are maintained during representative operations. Facility OQ verifies that the controls and responses needed to support those operations function correctly.

Seasonal Conditions

Outdoor temperature and humidity may affect HVAC capacity, room recovery, condensation risk, pressurization, humidification, dehumidification, and utility demand.

Seasonal OQ considerations may include:

Summer cooling load
Winter heating load
High outdoor humidity
Low outdoor humidity
Seasonal pressure variation
Seasonal utility capacity
Freeze-protection functions
Condensation prevention
Economizer or outdoor-air modes
Seasonal alarm limits
Seasonal mode changes
Recovery during adverse outdoor conditions

Seasonal requirements should be identified during design and qualification planning.

Evidence may be obtained through:

Direct testing during representative seasonal conditions
Approved design calculations
Commissioning load tests
Controlled load simulation
Manipulation within approved operating ranges
Trend review during initial operation
Deferred seasonal verification under an approved protocol

Facility release does not always need to wait for both seasonal extremes when design evidence and available challenge testing adequately support initial operation. Any deferred seasonal verification should have:

Defined scope
Scientific justification
Interim operating restrictions if required
Responsible owner
Target period
Acceptance criteria
Deviation requirements
Final approval

Seasonal testing should verify real operational capability, not merely record outdoor weather conditions.

Failure-Condition Testing

Facility OQ should challenge credible failures identified through design review, risk assessment, commissioning, operating experience, or control-system analysis.

Potential failures include:

Supply-fan failure
Return-fan failure
Exhaust-fan failure
Standby-fan failure
Damper failure
Valve failure
Sensor failure
Transmitter signal loss
Controller failure
Network interruption
Server interruption
Power failure
Emergency-power failure
Door-position failure
Interlock failure
Access-control failure
Utility loss
Communication failure
High or low environmental condition
Simultaneous demand on shared systems

Failure testing should determine:

Whether the failure is detected
Whether the indicated status is accurate
Whether the correct alarm is generated
Whether affected systems move to defined positions or modes
Whether the effect propagates to adjacent rooms
Whether personnel receive adequate notification
Whether procedures provide appropriate response
Whether unsafe automatic restart is prevented
Whether recovery can be completed in a controlled manner

Testing should prioritize credible failures with significant consequences. It should not create uncontrolled damage merely to demonstrate an already well-supported low-risk function.

Recovery Testing

Recovery is part of OQ. Demonstrating an alarm without demonstrating restoration leaves the operating sequence incomplete.

Recovery testing may address:

Removal of the initiating failure
Alarm acknowledgement
Alarm clearance
Restoration of utilities
Restoration of communication
Restart sequence
Return of fans and controls
Re-establishment of pressure relationships
Return of temperature and humidity
Restoration of access functions
Restoration of door interlocks
Confirmation of correct operating mode
Verification of trend and event continuity
Inspection for retained overrides or forced values
Required operator actions
Required environmental assessment
Authorization to resume operation

Recovery acceptance criteria may include:

Correct sequence
No uncontrolled restart
No inappropriate alarm clearance
Required conditions restored
Recovery within an approved time
Correct status displayed
Required events recorded
No unresolved forced values
No unacceptable effect on adjacent areas
Required procedural actions completed

Recovery time should be defined where delayed restoration could affect exposed product, environmental control, containment, workflow, or facility availability.

Use of Commissioning and System-Specific Evidence

Commissioning and system-specific OQ evidence may support facility OQ when it is suitable for the intended qualification purpose.

Existing evidence should be evaluated for:

Applicable scope
Test method
Acceptance criteria
Initial conditions
Challenge conditions
Instrument calibration
Raw-data availability
Traceability
Configuration
Deviations
Review and approval
Correspondence with the final installed system
Coverage of integrated facility requirements

Evidence may be referenced when it directly satisfies the requirement.

Additional facility-level testing is needed when:

The original test addressed only a component.
Interactions among systems were not evaluated.
Room or adjacent-area effects were excluded.
Door, access, or occupancy effects were not included.
Alarm routing was not challenged through the complete path.
Recovery was not demonstrated.
The configuration changed after testing.
Acceptance criteria were inadequate.
Supporting records are incomplete or uncontrolled.

Leveraging appropriate engineering evidence prevents unnecessary repetition. It does not eliminate the need to demonstrate integrated operation.

Data Collection and Test Instruments

Facility OQ data may be generated using:

Installed room instruments
Building-automation trends
Environmental-monitoring systems
Portable differential-pressure meters
Temperature and humidity data loggers
Airflow instruments
Electrical test instruments
Event and alarm histories
Video recording
Door-event records
Access-control logs
Network or communication logs

The protocol should identify:

Instrument identifier
Calibration status
Measurement range
Accuracy
Resolution
Sampling interval
Sensor location
Time synchronization
Data source
Raw-data retention
Calculation method
Acceptance method

Sampling intervals should be sufficient to capture brief pressure reversals, alarm delays, system transitions, and recovery behavior.

Data from multiple systems should use synchronized time where event sequence matters. Unsynchronized clocks can make it impossible to determine whether alarms, door events, system responses, and recovery occurred in the correct order.

OQ Acceptance Criteria

Facility OQ acceptance criteria should be approved before execution.

Typical criteria include:

Defined functions operate as approved.
Applicable operating modes function correctly.
Required room pressure relationships are established.
Permitted disturbances remain within approved limits.
Door and airlock sequences function correctly.
Access restrictions operate as intended.
Environmental controls operate within defined ranges.
Alarm thresholds and delays are correct.
Alarms are indicated, transmitted, recorded, acknowledged, and cleared correctly.
Interlocks prevent prohibited actions.
Facility automation displays correct status.
Utility losses produce the defined response.
Power failure produces the defined safe or controlled condition.
Emergency functions operate correctly.
Credible failures are detected and appropriately controlled.
Adjacent-room and shared-system effects are acceptable.
Defined occupancy and activity challenges produce acceptable responses.
Seasonal capability is demonstrated or controlled through an approved deferred plan.
Recovery sequences operate correctly.
Required conditions are restored within approved times.
Data and event records remain complete.
Forced values, overrides, and temporary configurations are removed.
Deviations have approved dispositions.
Traceability is complete.
The facility is ready for required performance verification.

Acceptance criteria should be quantitative where meaningful.

Examples include:

Pressure differential
Temperature or humidity range
Alarm threshold
Alarm delay
Door-held-open time
Standby-system transfer time
Recovery time
Required notification time
Permitted transient duration
Data-sampling interval

“Operates as expected” is not an adequate criterion unless the expected response is defined in the protocol or a specific approved reference.

Deviations and Unexpected Results

Unexpected conditions may include:

Incorrect response
Missing alarm
Incorrect alarm delay
Wrong alarm priority
Incorrect interlock
Pressure reversal
Excessive recovery time
Incorrect display
Missing data
Unrecorded override
Incorrect fail position
Failure to transfer to standby service
Unacceptable adjacent-room effect
Incomplete restoration
Difference between the control narrative and actual logic

The deviation record should address:

Expected condition
Actual condition
Test step and challenge
Affected room or system
Immediate correction or containment
Product-quality and contamination-control impact
Effect on adjacent systems
Root cause where required
Corrective action
Retesting
Effect on previously completed tests
Document or configuration changes
Final disposition
Approval

A failed test should not be accepted by rewriting the expected result after execution unless the original requirement or criterion is demonstrably incorrect and the change is technically justified, assessed, and approved.

Retesting should demonstrate correction. It should not erase the original failure.

Traceability

Facility OQ should maintain traceability among:

User requirements
Functional requirements
Design criteria
Risk controls
Control narratives
Cause-and-effect matrices
Alarm and interlock lists
Commissioning tests
System-specific OQ tests
Facility functional challenges
Deviations
Recovery evidence
Performance-verification requirements
Final acceptance status

Each requirement should have a clear disposition, such as:

Verified directly in facility OQ
Verified through accepted HVAC OQ evidence
Verified through accepted automation evidence
Verified through accepted commissioning evidence
Assigned to performance verification
Deferred under an approved seasonal plan
Not applicable with justification
Open and preventing progression

Traceability should identify the actual test and result. A reference to an entire commissioning report or automation package does not show how a specific facility requirement was satisfied.

Readiness for Environmental and Performance Verification

Facility OQ completion should support a documented decision that the qualified area is ready for subsequent performance testing.

Readiness may require confirmation that:

Applicable facility functions passed OQ.
Required HVAC functions passed OQ.
Pressure relationships are acceptable.
Environmental-control functions are stable.
Doors, airlocks, and access controls operate correctly.
Critical alarms and interlocks are functional.
Automation and monitoring systems are available.
Required utilities are reliable.
Critical deviations are resolved.
Remaining open items have acceptable impact assessments.
Required procedures are approved.
Required personnel are trained.
Environmental-monitoring systems are ready.
Required cleaning and sanitation have been completed.
The test configuration is controlled.
Deferred seasonal work is formally managed.
Traceability supports progression.

Environmental performance testing may then evaluate whether the facility maintains required conditions throughout the controlled space under defined at-rest and operational conditions.

Routine environmental monitoring cannot substitute for incomplete facility OQ.

OQ Report

The facility OQ report should summarize:

Scope and boundaries
Protocols executed
Supporting evidence leveraged
Operating states tested
Normal conditions verified
Challenges performed
Failure conditions tested
Emergency conditions tested
Occupancy-related conditions tested
Seasonal evidence or deferrals
Recovery tests
Deviations
Retesting
Acceptance-criteria status
Traceability status
Open actions
Restrictions
Readiness for performance verification
Final conclusion
Approval

The report should identify:

Tested configuration
Applicable document revisions
Automation version or configuration where relevant
Alarm and interlock baseline
Outstanding limitations
Deferred activities
Conditions for continued progression

OQ approval demonstrates that the defined facility functions operated acceptably during approved testing. It does not demonstrate indefinite control or remove the need for monitoring, maintenance, calibration, change control, periodic review, and requalification.

Relationship Between Facility OQ and Performance Verification

Activity	Principal question
Commissioning	Have systems been started, adjusted, balanced, and made functional according to the design?
Facility IQ	Does the as-built facility conform to approved requirements, drawings, specifications, and installation criteria?
HVAC OQ	Does the air-handling system operate correctly throughout its defined functional and control ranges?
Facility OQ	Do integrated rooms and facility functions respond correctly during normal, challenge, failure, emergency, and recovery conditions?
Environmental performance verification	Does the controlled environment achieve and maintain required conditions throughout the defined space under applicable operating conditions?
Routine monitoring	Does continuing evidence indicate that the qualified facility remains in control?

Facility OQ cannot compensate for an unsuitable design, incomplete installation, or inadequately commissioned systems.

Successful HVAC OQ does not by itself demonstrate that facility flows, doors, access functions, room interactions, emergency modes, or operational procedures work together acceptably.

Common Facility OQ Weaknesses

Common weaknesses include:

Treating facility OQ as a duplicate of HVAC OQ
Testing individual components without integrated challenges
Undefined facility boundaries
Beginning OQ before critical IQ prerequisites are complete
Using superseded control narratives
Undefined normal operating conditions
Testing only normal operation
Omitting upper and lower operating ranges
No defined room operating modes
No testing of mode transitions
Testing alarms only by forcing software inputs
Verifying alarm display without notification and response
Testing interlocks independently without sequence challenges
Omitting simultaneous door requests
Ignoring held-open-door conditions
Measuring pressure only with all doors closed
Ignoring adjacent-room effects
Failing to evaluate exhaust and supply-system interactions
Omitting occupancy and equipment heat-load effects
Treating full operational simulation as unnecessary in every case
Failing to distinguish OQ simulation from performance verification
Ignoring seasonal operating conditions
Deferring seasonal testing without a controlled plan
Omitting power-loss and utility-loss testing
Testing shutdown without testing restart
Demonstrating alarms without demonstrating recovery
Failing to remove forced values and temporary overrides
Unsynchronized automation, door, access, and monitoring records
Insufficient data-sampling frequency
Leveraging commissioning evidence without assessing suitability
Repeating system tests without examining facility integration
Inadequate emergency-function coordination
Expecting GMP conditions to remain unchanged during every emergency
No defined material or operational response after environmental loss
Failed tests accepted through revised expectations
Retesting without documenting the original failure
Incomplete traceability
Declaring readiness without resolving critical deviations
Treating OQ approval as final facility release

These weaknesses leave uncertainty about how the facility will behave when real systems, rooms, people, failures, and recovery actions interact.

Summary

Facility Operational Qualification verifies the integrated operation of a GMP facility.

It determines whether rooms, doors, airlocks, access controls, environmental controls, pressure relationships, utilities, automation, alarms, interlocks, emergency functions, and operating procedures work together as intended.

Facility OQ is distinct from HVAC OQ. HVAC OQ evaluates the air-handling system’s components, sequences, control loops, alarms, and operating capability. Facility OQ evaluates the resulting room and facility behavior, including interactions with doors, adjacent areas, access controls, occupancy, utilities, emergency conditions, and recovery.

Effective OQ addresses:

Normal operating conditions
Operating ranges and mode changes
Functional challenges
Alarm and interlock operation
Door and airlock sequences
Pressure relationships
Environmental-control functions
Occupancy-related conditions
Seasonal conditions
Utility and power failures
Emergency functions
Adjacent-area effects
Controlled shutdown
Recovery and restart

OQ establishes that the installed facility can operate correctly. Subsequent performance verification demonstrates that the integrated environment supports its intended use under representative conditions. Routine monitoring then provides continuing evidence that the qualified state is maintained.