Utility System Lifecycle, Monitoring, and Risk-Based Control

GMP utility systems require coordinated control from initial requirements through retirement. Qualification establishes that a utility is properly designed, installed, and capable of supporting its intended uses, but qualification alone does not maintain control. Continued assurance depends on monitoring, maintenance, calibration, data review, deviation management, change control, periodic review, and documented lifecycle decisions.

The lifecycle strategy should be proportionate to the utility’s intended use, GMP impact, complexity, failure consequences, and ability to detect deterioration before product quality is affected.

Purpose and Lifecycle Position

This article establishes a common lifecycle-control framework for pharmaceutical water, clean steam, compressed air, process gases, and utility-supported CIP and SIP systems.

It addresses:

• User, quality, and functional requirements
• System boundaries and impact assessment
• Risk assessment and control strategy
• Design and supplier controls
• Commissioning and qualification
• Release for GMP use
• Routine monitoring and trending
• Maintenance and calibration
• Automation and data governance
• Deviations, excursions, and adverse trends
• Periodic review
• Continued-use and requalification decisions
• Decommissioning and retirement

Utility classification and intended-use principles are addressed in Utility Systems in GMP Manufacturing. Change-specific assessment, requalification, and deficiency management are addressed in Utility System Change Control, Requalification, and Deficiencies.

Lifecycle Governance and Responsibilities

Utility-system control normally involves engineering, operations, maintenance, metrology, automation, laboratories, system owners, user departments, validation, and the quality unit. Responsibilities should be established before qualification begins and remain defined during routine operation.

Governance should identify responsibility for:

• Approving requirements and system boundaries
• Completing impact and risk assessments
• Reviewing and approving designs
• Managing suppliers and construction
• Approving commissioning evidence for qualification use
• Preparing and executing qualification
• Resolving deviations and punch-list items
• Releasing the utility for GMP operation
• Maintaining operating procedures
• Reviewing alarms and monitoring data
• Performing maintenance and calibration
• Managing electronic records and system access
• Investigating excursions and adverse trends
• Assessing changes
• Performing periodic review
• Approving continued use, requalification, or retirement

A system owner should have sufficient technical understanding and organizational authority to coordinate these activities. Ownership should not be limited to maintaining equipment records; it includes knowing whether the system remains suitable for its approved uses.

Quality-unit involvement should reflect GMP impact and the significance of the decision. The quality unit does not need to execute every engineering activity, but GMP requirements, qualification decisions, deviations, release, and material lifecycle conclusions require appropriate quality oversight.

Requirements Development

Requirements convert intended uses into verifiable design, performance, quality, monitoring, data, and lifecycle expectations.

Utility requirements should be derived from:

• Intended user processes and equipment
• Product and process requirements
• Applicable compendial requirements
• Regulatory requirements
• Contamination-control needs
• Cleaning or sterilization requirements
• User-point demand
• Equipment operating ranges
• Environmental and personnel-safety requirements
• Business-continuity needs
• Data and record requirements
• Maintenance and calibration needs
• Available engineering knowledge
• Applicable consensus standards and guidance

Requirement Categories

A utility user requirements specification may include:

Requirements should be specific enough to verify. Statements such as “system must comply with GMP” or “water must be high quality” do not provide usable acceptance criteria.

Not every requirement must contain a numerical value at the earliest design stage. Where values remain under development, the document should identify the basis, responsible owner, required resolution point, and relationship to later testing or release.

System Boundaries and Interface Control

A controlled boundary identifies the equipment, functions, data, and interfaces included in the utility system.

The boundary may include:

• Incoming source or feed
• Generation and treatment equipment
• Storage
• Supply and return distribution
• Branches and subloops
• Point-of-use assemblies
• Final filters, regulators, traps, and exchangers
• Sampling devices
• Instrumentation
• Control panels and automation
• Alarm and data systems
• Drains, vents, condensate, and exhaust connections
• Interfaces with supported equipment or processes

The physical, automation, maintenance, and qualification boundaries should be coordinated. They do not always terminate at the same location.

For example, a utility qualification boundary may end at a defined point-of-use connection, while a sampling valve, final filter, flexible hose, or user-equipment connection remains part of the process-specific control strategy. The interface must identify which group controls:

• Component selection
• Installation and replacement
• Cleaning or sanitization
• Sampling
• Integrity testing
• Preventive maintenance
• Calibration
• Change assessment
• Release after intervention

Unclear boundaries commonly produce qualification gaps, duplicated testing, unmanaged components, and unresolved ownership.

GMP Impact and Risk Assessment

Impact classification establishes the level of GMP governance. Risk assessment determines what could fail, how that failure could affect the approved use, and which controls require verification.

The assessment should consider:

• Utility exposure to product, components, or critical surfaces
• Intended process function
• Utility quality attributes
• Critical operating parameters
• Failure severity
• Failure likelihood
• Detectability before use or product release
• Duration of exposure
• Number and criticality of affected users
• Common supply to multiple processes
• Accumulation or contamination potential
• Recovery after interruption
• Existing preventive and detective controls
• Availability of downstream barriers
• Reliability of monitoring data

Potential failure modes may include:

• Incorrect utility identity or quality
• Microbial proliferation or biofilm formation
• Chemical, oil, moisture, or particle contamination
• Endotoxin contamination
• Cross-connections or backflow
• Stagnation or inadequate circulation
• Poor drainage or condensate accumulation
• Loss of pressure, flow, temperature, or capacity
• Point-of-use filter failure
• Inadequate sanitization
• Utility interruption
• Instrument drift
• Alarm or control failure
• Incorrect automation configuration
• Loss, alteration, or exclusion of data
• Maintenance-induced contamination
• Unsupported or obsolete components

Risk assessment should produce specific control decisions. Useful outputs include:

• Design controls
• Material and fabrication requirements
• Required instruments and alarms
• Qualification test scope
• Challenge conditions
• Monitoring locations and frequencies
• Maintenance and calibration activities
• Spare-part controls
• Backup and recovery provisions
• Deviation escalation requirements
• Requalification triggers

A risk score is not the control strategy. High-consequence failures require explicit evaluation even where their estimated occurrence is low.

Design Development and Review

The design should convert approved requirements and risk controls into a system capable of reliable operation, monitoring, maintenance, and recovery.

Design review should address, as applicable:

• Generation or supply technology
• Materials of construction
• Surface condition
• Capacity and peak demand
• Storage and distribution
• Flow and pressure management
• Drainability
• Dead legs and stagnation risks
• Temperature control
• Filtration and treatment stages
• Sanitization or sterilization provisions
• Sampling locations
• Point-of-use configuration
• Backflow and cross-connection prevention
• Redundancy
• Failure modes
• Maintenance access
• Calibration access
• Automation architecture
• Alarm philosophy
• Electronic records
• Backup and recovery
• Expansion capability
• Preservation during extended shutdown
• Safe decommissioning

Design review should include relevant user, engineering, maintenance, automation, validation, laboratory, contamination-control, and quality perspectives. Review records should document unresolved items, owners, due dates, and the stage at which resolution is required.

Design qualification may be used when formal evidence is needed that the proposed design satisfies approved requirements. The terminology is less important than having a controlled and traceable design-review process.

Supplier, Fabrication, and Construction Controls

Supplier oversight should be proportionate to system complexity, fabrication risk, proprietary technology, and reliance on supplier documentation.

Supplier controls may include:

• Technical and quality evaluation
• Defined documentation requirements
• Approved drawings and specifications
• Material-certification requirements
• Welding and fabrication controls
• Surface-treatment records
• Software and configuration documentation
• Instrument certificates
• Factory testing
• Deviation and nonconformance management
• Preservation and shipping controls
• Spare-parts recommendations
• Training
• Support and obsolescence commitments

Vendor documentation should be reviewed before being accepted as GMP evidence. A document’s existence does not demonstrate that it is complete, accurate, traceable to the installed system, or suitable for qualification use.

Changes made during fabrication or construction should be evaluated against approved requirements and design decisions. Field modifications should not remain undocumented until final turnover.

Commissioning and Turnover

Commissioning establishes that the system has been installed, started, adjusted, and functionally demonstrated as an engineering system.

Activities may include:

• Installation walkdowns
• Component verification
• Line and equipment identification
• Flushing and cleaning
• Loop checks
• Rotation and alignment checks
• Pressure or leak testing
• Control-loop tuning
• Alarm and interlock checks
• Instrument startup
• Pump or compressor testing
• Capacity testing
• Distribution balancing
• Sanitization-cycle development
• Initial sampling
• Operator and maintenance training
• Punch-list management

Turnover should provide an organized evidence package, including applicable:

• Approved drawings
• As-built drawings
• Equipment and instrument lists
• Material certificates
• Fabrication and weld records
• Pressure and leak-test records
• Calibration certificates
• Software and configuration records
• Supplier manuals
• Commissioning tests
• Deviations and punch lists
• Spare-parts information
• Preventive-maintenance recommendations
• Training records

Commissioning evidence may support qualification when it was generated under suitable controls and meets the required objective. Acceptance should consider:

• Approved scope
• Approved procedure or test instruction
• Traceability to requirements
• Defined acceptance criteria
• Qualified or trained personnel
• Controlled instruments
• Recorded results
• Deviation handling
• Review and approval
• Identification of the tested configuration

Uncontrolled engineering records should not be accepted solely to avoid repeating a test.

Qualification Strategy

FDA’s Process Validation: General Principles and Practices places qualification of facilities, utilities, and equipment within the lifecycle framework supporting process qualification. The guidance does not prescribe one universal utility protocol structure.

A utility qualification strategy should define:

• System boundaries
• Approved intended uses
• GMP-impact classification
• Risk-assessment outputs
• Qualification stages
• Commissioning leverage
• Required protocols and reports
• Testing responsibilities
• Acceptance criteria
• Deviation management
• Traceability
• Release requirements
• Transition to routine operation

Design Verification

Design evidence should demonstrate that requirements and identified risk controls were incorporated into the approved design.

Installation Qualification

Installation verification may include:

• Equipment and component identity
• Materials of construction
• Distribution configuration
• Slope and drainage
• Utility connections
• Instruments and calibration status
• Filters, traps, regulators, and valves
• Sampling points
• Control panels
• Software and hardware identification
• Approved drawings
• Supplier documentation
• Maintenance access
• Spare parts
• As-built status

Operational Qualification

Functional testing may challenge:

• Startup and shutdown
• Normal operating ranges
• Control sequences
• Alarms and interlocks
• Failure responses
• Capacity and demand
• Redundancy and changeover
• Loss and restoration of utilities
• Sanitization functions
• Data capture
• User access
• Backup and recovery
• Communication interfaces
• Controlled restart

Performance Verification

Performance verification demonstrates that the complete system can consistently supply acceptable utility quality and performance under representative conditions.

Testing may address:

• Normal demand
• Peak or concurrent demand
• Low-use conditions
• Worst-case user locations
• Representative user points
• Seasonal variation
• Startup and recovery
• Shutdown and restart
• Chemical and microbial quality
• Pressure, flow, or temperature
• Distribution consistency
• Sanitization effectiveness
• Process or equipment interfaces

The selected test duration, operating conditions, locations, and repetitions should be justified. A historical qualification convention should not be presented as a regulatory mandate when the actual scope must be based on system design, variability, intended use, and risk.

Requirements Traceability and Evidence Integration

Requirements traceability connects approved needs to design features, risk controls, commissioning, qualification, procedures, monitoring, and release.

A traceability record should identify:

• Requirement identifier
• Requirement source
• GMP or risk significance
• Design response
• Verification method
• Test or record reference
• Result
• Deviation reference
• Final status

Traceability should not become a clerical exercise in which every requirement is linked to an arbitrary protocol step. The verification method should match the requirement:

• Design requirements may be verified by drawing or calculation review.
• Installation requirements may be verified by inspection.
• Functional requirements may require challenge testing.
• Quality requirements may require laboratory or online data.
• Availability requirements may require failure and recovery testing.
• Data requirements may require record, audit-trail, access, and backup testing.
• Lifecycle requirements may be verified through approved procedures and system-management records.

Open traceability items must be resolved or formally assessed before release.

Release for GMP Operation

Release should be a documented decision that the utility is suitable for its approved intended uses.

Release prerequisites may include:

• Approved requirements and boundaries
• Completed impact and risk assessments
• Accepted turnover package
• Approved qualification records
• Resolved critical deviations
• Assessed residual punch-list items
• Approved operating procedures
• Approved monitoring and sampling plans
• Established alert and action levels
• Approved maintenance and calibration activities
• Trained personnel
• Defined alarm-response responsibilities
• Approved backup and recovery procedures
• Controlled system access
• Approved drawings and configuration baseline
• Defined system ownership
• Established change control status

Conditional release may be justified when remaining items do not compromise product quality, patient safety, data integrity, or required system performance. The decision should define:

• Remaining work
• Risk justification
• Interim controls
• Responsible owner
• Due date
• Escalation requirements
• Final closure approval

Commercial or scheduling pressure is not an adequate basis for accepting unresolved risk.

Routine Operation and Monitoring Strategy

Routine monitoring demonstrates whether the utility remains within its approved state and provides early detection of deterioration.

The program should define:

• Attributes and parameters monitored
• Online and offline measurements
• Sampling locations
• Test methods
• Monitoring frequencies
• Operating limits
• Alert and action levels
• Alarm priorities
• Data-review frequency
• Trending methods
• Responsibilities
• Escalation requirements
• Record retention

Monitoring should be based on the purpose of the measurement.

A measured parameter should not automatically be treated as a product-quality acceptance criterion. Operating limits, alert levels, action levels, engineering alarms, and compendial or process specifications serve different purposes and should be clearly distinguished.

Online Monitoring

Online instruments can provide continuous or frequent data and rapid detection of operating changes. Their use requires control of:

• Measurement range and accuracy
• Sensor location
• Calibration
• Data acquisition
• Time synchronization
• Alarm configuration
• Missing or invalid data
• Maintenance
• Data retention
• Review responsibilities

Offline Sampling

Offline testing may be necessary where an attribute cannot be measured reliably online or where laboratory confirmation is required.

Sampling procedures should address:

• Representative locations
• Point-of-use conditions
• Sample-valve preparation
• Flushing or nonflushing requirements
• Container suitability
• Sample handling
• Hold time
• Test-method suitability
• Contamination prevention
• Documentation
• Atypical sampling conditions

Monitoring should represent the system as it is actually operated. Sampling performed only after extraordinary flushing or under artificially favorable conditions may not represent the delivered utility.

Alert Levels, Action Levels, and Operating Limits

The monitoring program should distinguish among different control thresholds.

Operating Range

The approved range within which the system is expected to operate routinely.

Alert Level

A level indicating possible drift, deterioration, or increased variability. An alert normally requires assessment and heightened attention but does not automatically establish that the utility is unsuitable.

Action Level

A level requiring documented investigation and assessment of utility status, affected uses, and required corrective action.

Specification or Acceptance Limit

A formal requirement applicable to the utility, process, product, or test result. Its source may be compendial, regulatory, procedural, process-specific, or scientifically justified.

Alarm Setpoint

A configured value intended to notify personnel or initiate an automated response. Alarm setpoints may be related to operating limits but should not automatically be treated as equivalent to product-quality specifications.

Limits should be based on applicable requirements, qualification data, process needs, system capability, historical performance, and risk. Statistical calculations may support limit development but should not replace scientific and process judgment.

Data Review and Trending

Individual results determine whether a specific result or operating period requires action. Trending determines whether the overall system is deteriorating or changing.

Trending may evaluate:

• Results by sampling location
• Results by utility branch or loop
• Seasonal variation
• Recurring alerts
• Sanitization frequency
• Post-maintenance changes
• Increasing filter differential pressure
• Instrument drift
• Capacity or recovery changes
• Alarm frequency
• Repeated short-duration excursions
• Laboratory-versus-online differences
• Organism recovery patterns
• Data gaps
• Utility interruptions
• Repeated procedural interventions

Trend review should consider the system state at the time of the result, including:

• Normal operation
• Peak demand
• Low demand
• Shutdown
• Restart
• Sanitization
• Maintenance
• Construction
• Sampling changes
• Source-quality changes
• Seasonal conditions

A result can comply with an established limit while still contributing to an adverse trend. Conversely, one alert does not automatically prove loss of control. Decisions should consider the result, location, history, system condition, and credible effect on approved uses.

Excursions, Alarms, and Adverse Trends

Procedures should define how utility events are triaged, documented, investigated, and escalated.

Initial assessment should determine:

• What occurred
• When it began
• How it was detected
• Duration
• Affected system section
• Affected points of use
• Utility uses during the period
• Relevant products, batches, equipment, or processes
• Whether the event is continuing
• Immediate containment required
• Available confirmatory data
• Potential data-integrity concerns

Investigations should evaluate causes such as:

• Equipment failure
• Instrument malfunction
• Sampling or laboratory error
• Control-system failure
• Utility-source change
• Maintenance activity
• Sanitization failure
• Stagnation
• Excessive demand
• Distribution imbalance
• Operator action
• Unauthorized configuration change
• Inadequate procedure
• Progressive component deterioration

Retesting or resampling should not be used to disregard an unfavorable result without a scientifically justified investigation.

Product-impact and continued-use decisions should consider the intended use, exposure pathway, timing, affected locations, available downstream controls, product testing, process state, and uncertainty. A utility excursion does not automatically mean product rejection, but an acceptable subsequent result does not automatically eliminate potential impact.

Maintenance and Calibration

Maintenance and calibration preserve system capability and the reliability of control decisions.

The maintenance strategy should address:

• Preventive maintenance
• Predictive or condition-based maintenance
• Corrective maintenance
• Lubrication controls
• Filter and membrane replacement
• Resin or media management
• UV-lamp management
• Steam-trap inspection
• Compressor and dryer maintenance
• Pump and valve maintenance
• Sanitization equipment
• Sample valves
• Vent filters
• Spare parts
• Contractor controls
• Post-maintenance cleaning
• Return-to-service verification

Under 21 CFR 211.67, equipment must be cleaned, maintained, and, when appropriate, sanitized or sterilized at appropriate intervals to prevent malfunction or contamination that could alter drug quality.

Calibration controls should address instruments used to:

• Control critical functions
• Demonstrate utility quality
• Generate alarms
• Establish compliance
• Support sanitization or sterilization
• Make release or impact decisions

21 CFR 211.68 requires automatic, mechanical, and electronic equipment to be routinely calibrated, inspected, or checked under a written program designed to assure proper performance, with records maintained.

Post-maintenance and post-calibration activities should be based on intervention risk. They may include:

• Visual inspection
• Leak testing
• Cleaning or flushing
• Sanitization
• Calibration verification
• Functional testing
• Alarm testing
• Utility-quality sampling
• Point-of-use verification
• Targeted requalification

The system should not be returned to GMP service solely because a work order was closed.

See Calibration Program and Metrology Control and Preventive Maintenance and System Reliability Strategy for the broader control frameworks.

Automation and Data Governance

Utility systems may use programmable logic controllers, supervisory systems, building-management systems, data historians, laboratory systems, or other electronic platforms to control operations and maintain records.

The system assessment should identify whether electronic functions:

• Control critical operations
• Manage sanitization or operating recipes
• Generate or process GMP records
• Maintain alarm history
• Transfer data to another system
• Calculate reported values
• Support trend evaluation
• Support release or continued-use decisions
• Maintain electronic signatures
• Preserve audit trails

Applicable controls may include:

• Authorized user access
• Role-based permissions
• Configuration management
• Audit trails
• Time synchronization
• Data retention
• Backup and restoration
• Disaster recovery
• Interface verification
• Record review
• Cybersecurity
• Periodic access review
• Supplier support
• Software and hardware obsolescence management

FDA’s Data Integrity and Compliance With Drug CGMP: Questions and Answers explains FDA’s expectation that CGMP data be complete, consistent, accurate, attributable, legible, contemporaneously recorded, original or a true copy, and accurate.

Utility data governance should address more than whether values are stored. It should establish:

• Which data constitute GMP records
• Which record is authoritative
• Whether metadata are retained
• How invalid or missing data are handled
• How changes are recorded
• How records are reviewed
• How data are protected
• How long records are retained
• How records remain retrievable
• How backup and recovery are verified

Qualification of automation and qualification of the physical utility should be coordinated. The sensor, logic, alarm, historian, interface, and reviewed record form one evidence chain.

See Qualification and Verification of Facility Automation Systems where BMS or EMS functions support utility monitoring or control.

Periodic Review

Periodic review determines whether the accumulated lifecycle evidence continues to support the approved state.

The review frequency and depth should reflect:

• GMP impact
• System complexity
• Utility variability
• Contamination risk
• Number and criticality of users
• Performance history
• Change history
• Failure history
• Obsolescence
• Regulatory or compendial changes

Review inputs may include:

• Approved intended uses
• Current system boundaries
• Requirements and risk assessments
• Monitoring and laboratory trends
• Alert and action-level events
• Alarms and interruptions
• Deviations and investigations
• CAPA
• Maintenance history
• Calibration and out-of-tolerance events
• Sanitization performance
• Filter, membrane, resin, or media history
• Change controls
• Post-change verification
• Qualification and requalification records
• Automation configuration
• User-access review
• Audit-trail review
• Backup and recovery testing
• Supplier notices
• Component obsolescence
• Open actions
• Previous periodic-review commitments

Periodic review should conclude whether:

• The system remains suitable for approved uses.
• Requirements and boundaries remain current.
• Risks remain adequately controlled.
• Monitoring remains capable of detecting deterioration.
• Maintenance and calibration remain effective.
• Electronic records remain reliable.
• Procedures and training remain adequate.
• Existing qualification remains representative.
• Additional actions or requalification are required.

Outputs may include:

• No additional action
• Monitoring adjustment
• Maintenance or calibration change
• Procedure revision
• Risk-assessment update
• Engineering improvement
• Investigation or CAPA
• Change control
• Targeted verification
• Targeted requalification
• Comprehensive requalification
• Use restriction
• Replacement or retirement planning

Each action should have a responsible owner, due date, priority, and documented closure.

Periodic review is not a substitute for immediate response to failures or adverse trends. It consolidates evidence and identifies cumulative conditions that may not be apparent from individual records.

Change Control and Requalification Interface

Changes should be assessed before implementation whenever practical. The assessment should consider:

• Intended use
• Utility quality
• Capacity and demand
• Distribution
• Materials
• Contamination control
• Sanitization
• Instrumentation
• Automation
• Alarms
• Data integrity
• Maintenance
• Approved drawings
• Qualification status
• Affected user equipment
• Product or process impact
• Required post-change verification

Requalification scope should be based on affected requirements, functions, risks, and evidence. It should not be automatically comprehensive or limited solely because the change has been labeled minor.

The detailed decision framework is provided in Utility System Change Control, Requalification, and Deficiencies.

Shutdown, Preservation, and Restart

Planned or extended shutdowns can create utility-specific risks, including:

• Stagnation
• Microbial proliferation
• Corrosion
• Loss of temperature control
• Loss of positive pressure
• Condensate accumulation
• Desiccant or filter deterioration
• Loss of gas identity
• Drained or partially filled distribution
• Invalid calibration status
• Lost automation or historian data
• Unauthorized modification during construction

A shutdown plan should define:

• Approved system condition
• Isolation
• Draining or circulation
• Preservation
• Periodic inspection
• Environmental controls
• Instrument status
• Automation and data retention
• Maintenance activities
• Restart sequence
• Flushing, purging, sanitization, or sterilization
• Sampling and testing
• Qualification or verification requirements
• Release responsibility

Restart requirements should be based on shutdown duration, preservation method, system history, utility type, intervention extent, and intended use.

Continued-Use Decisions

A utility may require a documented continued-use assessment following:

• Adverse trend
• Action-level result
• System failure
• Utility interruption
• Maintenance error
• Missed calibration
• Data loss
• Alarm failure
• Unapproved change
• Incomplete qualification
• Obsolescence or loss of supplier support

The assessment should determine:

• Current system capability
• Affected uses
• Available controls
• Uncertainty
• Product or process exposure
• Required restrictions
• Additional monitoring
• Corrective action
• Duration of continued use
• Approval authority
• Reassessment date

Continued use may be appropriate when risk is understood and adequately controlled. It should not become an indefinite substitute for correcting a known deficiency.

Retirement and Decommissioning

Retirement should be controlled because inactive or abandoned utility systems can create contamination, cross-connection, data-retention, and safety risks.

The retirement plan should address:

• Confirmation that the utility is no longer required
• Identification of affected user systems
• Regulatory or filing impact
• Product and process impact
• Isolation from active systems
• Removal of cross-connections
• Draining, venting, purging, or decontamination
• Removal of chemicals or hazardous materials
• Automation and alarm changes
• Data archival and retention
• Drawing updates
• Procedure withdrawal
• Spare-parts disposition
• Instrument status
• Physical labeling
• Final inspection
• Quality approval
• Closure documentation

A system should not be treated as retired merely because it is no longer operated. Its physical and electronic interfaces must be safely controlled.

Regulatory and Technical Framework

US drug CGMP requirements do not prescribe one consolidated utility lifecycle model. Applicable controls arise from requirements for suitable equipment, maintenance, automated systems, procedures, laboratory controls, investigations, and records under 21 CFR Part 211.

Relevant provisions include:

• 21 CFR 211.63 — equipment design, size, and location
• 21 CFR 211.67 — equipment cleaning and maintenance
• 21 CFR 211.68 — automatic, mechanical, and electronic equipment
• 21 CFR 211.100 — written procedures and deviations
• 21 CFR 211.160 — scientifically sound laboratory controls

Utility-specific compendial requirements, consensus standards, and industry guidance should be applied according to their actual scope and authority. They should not be presented as interchangeable sources.

Summary

Utility control is an evidence-based lifecycle, not a one-time qualification event.

The governing sequence is:

Requirements → risk-based design → commissioning → qualification → release → monitoring and maintenance → periodic review → retirement

The controlled state depends on four continuing foundations:

• Requirements traceability
• Approved and complete records
• Reliable data
• Effective change control

Monitoring should detect both isolated failures and progressive deterioration. Maintenance and calibration should preserve system capability. Periodic review should consolidate lifecycle evidence and determine whether the system remains suitable for its approved uses.