1What a validation master plan is.
EU GMP Annex 15, in operation since 1 October 2015, says all qualification and validation activities should be planned, and that the key elements of the site’s qualification and validation programme should be “clearly defined and documented in a validation master plan (VMP) or equivalent document”.¹ The PIC/S GMP Guide carries the same text in its Annex 15.² WHO’s validation guideline defines the VMP as “a high-level document that summarizes the manufacturer’s overall philosophy and approach”, with the qualification and validation work programme, its timelines and the responsibilities of those carrying it out.³
PIC/S revised its recommendations on qualification and validation as PI 006-4, in force from 1 October 2026. It describes the VMP as “risk-based, scientifically sound” and as the template from which all qualification and validation activities are developed. It should be a summary document, “brief, concise, and clear”, that refers to policies, SOPs, protocols and reports instead of repeating them, and it helps both the validation team and GMP inspectors see how the work is planned and managed.⁴
2What a VMP contains.
Annex 15 lists what the VMP should include or reference as a minimum.¹ PI 006-4 and WHO add further topics.⁴³
| Content | Where it is asked for |
|---|---|
| Qualification and validation policy | Annex 15 1.5(i); WHO 7.1 |
| Organisation, roles and responsibilities | Annex 15 1.5(ii); PI 006-4 3.4.3(b) |
| Summary of facilities, equipment, systems and processes, with their qualification and validation status | Annex 15 1.5(iii); PI 006-4 3.2.1 and 3.4.3(f) |
| Change control and deviation management | Annex 15 1.5(iv); PI 006-4 3.4.3(k) and (l) |
| Guidance on developing acceptance criteria | Annex 15 1.5(v); PI 006-4 3.4.3(i) |
| References to existing documents and the SOPs required | Annex 15 1.5(vi); PI 006-4 3.4.3(h) |
| Strategy, including requalification | Annex 15 1.5(vii); PI 006-4 3.4.3(f) |
| Schedule, including review of systems already qualified or validated | PI 006-4 3.2.1 |
| Rationale for any worst-case approach and product grouping | PI 006-4 3.4.3(c) |
| Validation type used, prospective or concurrent, and the system for ongoing process verification | PI 006-4 3.4.3(f) |
| How data integrity in reports is confirmed, independently of the people doing the work | PI 006-4 3.4.3(m) |
| Outsourced services, computerised system validation, analytical method validation and personnel qualification | WHO 7.1 |
For active substances, ICH Q7 asks for the company’s overall policy, intentions and approach to validation, including who designs, reviews and approves each phase, to be documented.⁵
3How a VMP differs from a validation plan.
The VMP covers the programme; a validation plan covers a piece of it. Annex 15 notes that for large and complex projects “separate validation plans may enhance clarity”.¹ PI 006-4 says a VMP establishes the organisation’s overall strategy, and that a master plan used for a large project, such as building a new facility, ensures every activity is completed “rather than changing the qualification and validation strategy already established in the VMP”.⁴
The US drug CGMP regulations in 21 CFR Part 211 do not use the term validation master plan.⁶ FDA’s process validation guidance of January 2011 says qualification of utilities and equipment “can be covered under individual plans or as part of an overall project plan”. The plan identifies the studies or tests, the criteria for assessing outcomes, the timing, the responsibilities of departments and the quality unit, and how the qualification is documented and approved, plus the firm’s requirements for evaluating changes. The quality control unit must review and approve the plan and the report.⁷
| Document | Scope | What it settles | Source |
|---|---|---|---|
| Validation master plan | The site’s or organisation’s programme | Policy, organisation, inventory and status, strategy, change and deviation handling | Annex 15 1.4 and 1.5; PI 006-4 section 3 |
| Validation or project plan | One project, system or facility | What will be qualified or validated, how, when and by whom | Annex 15 1.6; FDA process validation guidance |
| Protocol | One qualification or validation study | Critical systems, attributes and parameters, and the acceptance criteria | Annex 15 2.4; ICH Q7 12.20 and 12.21; WHO 8 |
| Report | One study | Results against the acceptance criteria, deviations and a conclusion | Annex 15 2.9; ICH Q7 12.22; WHO 9 |
Protocols supplied by a third party providing validation services should be confirmed as suitable by the site before approval, and may be supplemented with the site’s own tests.¹ Results that fail predefined acceptance criteria are recorded as deviations and investigated.¹
4Keeping the VMP current.
A VMP is maintained for as long as the programme runs. PI 006-4 says it should be approved by management, regularly reviewed and updated after changes to facilities, utilities, equipment, systems and processes, and that it should define how often it is updated.⁴ WHO asks for review at regular intervals.³ PI 006-4 also asks for the commitment to change control to be restated in high-level documents such as the quality manual and the VMP.⁴ Annex 15 expects equipment, facilities, utilities and systems to be evaluated at an appropriate frequency to confirm they remain in a state of control, with any fixed requalification period justified.¹
5How it runs in Seal.
In Seal’s commissioning and qualification blueprint, the validation plan defines scope, regulatory basis, lifecycle strategy, systems and boundaries, the direct-impact rationale, roles and release stages, and validation master planning keeps sites, systems, classifications, deliverables and dependencies connected. Each requirement links to its risks, tests, exceptions and release, so coverage is calculated from the links, and the released baseline becomes the reference for change control and periodic review.
The validation management blueprint records evidence with the work it concerns, so it can be grouped by stage where a site’s validation plan uses them. For configured processes in Seal itself, the validation guide asks you to agree the scope and assurance rationale in your validation plan.
References
- 1EudraLex Volume 4, Annex 15: Qualification and Validation, European Commission, in operation from 1 October 2015, sections 1, 2 and 4. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ 2015- 10_ annex15_ 0. pdf (read 6 November 2026) - 2PIC/S Guide to Good Manufacturing Practice for Medicinal Products, Annexes, PE 009-18, Annex 15, PIC/S, 24 September 2026. https:/
/ picscheme. org/ docview/ 11333 (read 6 November 2026) - 3WHO Technical Report Series No. 1019, Annex 3, Good manufacturing practices: guidelines on validation, glossary and sections 7 to 9, World Health Organization, 2019. https:/
/ www. who. int/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ production/ trs1019- annex3- gmp- validation. pdf (read 6 November 2026) - 4PI 006-4, Recommendations on Qualification and Validation, PIC/S, 1 October 2026, sections 2.6 and 3. https:/
/ picscheme. org/ docview/ 11277 (read 6 November 2026) - 5ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, ICH, 10 November 2000, sections 12.1 and 12.2. https:/
/ database. ich. org/ sites/ default/ files/ Q7%20Guideline. pdf (read 6 November 2026) - 621 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211 (read 6 November 2026) - 7Process Validation: General Principles and Practices, Guidance for Industry, FDA, January 2011, section IV.C.1. https:/
/ www. fda. gov/ media/ 71021/ download (read 6 November 2026)
AQuestions and answers
Is a validation master plan a regulatory requirement?
In the EU and PIC/S countries, Annex 15 expects a VMP or an equivalent document, and WHO says a manufacturer should have one. The US CGMP regulations don’t use the term, but FDA expects qualification and validation to be planned, with the quality unit approving the plans and reports.
How often should a VMP be reviewed?
Regularly, and whenever facilities, equipment, systems or processes change. PIC/S asks for the VMP to state how often it is updated and for management to approve it.
How long should a VMP be?
As short as it can be while still covering the required topics. PIC/S calls it a summary document that should be brief, concise and clear, and that refers to policies, SOPs, protocols and reports rather than repeating them.
Do we need one VMP for each site?
Annex 15 speaks of the site’s qualification and validation programme. PIC/S describes the VMP as setting the strategy within an organisation, with separate master plans for large projects such as a new facility that follow that strategy rather than change it.
Does the VMP cover computerised systems?
WHO lists computerised system validation among a VMP’s contents. In the EU, Annex 15 says computerised systems are validated under Annex 11, which asks for its own inventory of systems and their GMP functionality.
What is the difference between a validation plan and a protocol?
A plan says what will be qualified or validated across a project, how, when and by whom. A protocol covers one study and defines the critical systems, attributes and parameters and the acceptance criteria the results are judged against.