A clinical-stage biotech moving toward its first pivotal program will, at some point, get asked for its Validation Master Plan. Sometimes the question comes from an investor’s technical diligence team. Sometimes it comes from a CDMO quality agreement. Sometimes, and this is the version that actually matters, it comes from an inspector who opens with a request to see the VMP before asking about a single protocol. A surprising number of growing biotechs discover in that moment that they either have no VMP, or have one written years earlier for a different program, a different phase, a different facility, that nobody has looked at since.
This is not a rare gap. It is a predictable one, because a VMP is easy to postpone, and it is one of the reasons a single validation mindset that holds across modalities is worth building before the first VMP is even drafted. Individual validation protocols, an equipment IQ/OQ, a method validation, a cleaning validation, feel urgent because a specific piece of work is waiting on them. A VMP feels like overhead until the moment it is the first document requested and the company has nothing current to hand over. This article covers what a VMP is actually for, how to scope it by risk rather than habit, how to size its rigor to the phase the company is actually in, how it connects to the individual protocols underneath it, and how to keep it a document that describes reality rather than a document an inspector can catch lying.
What a VMP is, and what it is not
A VMP does not validate anything by itself. No inspector accepts a VMP in place of an IQ, a PPQ report, or a method validation. What it does is set the rules those individual activities follow, once, so a validation lead, a new hire, and a CDMO partner are all working from the same definition of scope, the same risk logic, and the same expectation for how deep validation needs to go for a given system. Without it, every project team improvises its own answer to how much validation is enough, and improvised answers from different teams rarely agree with each other, which is exactly the inconsistency an inspector is trained to notice.
A useful way to hold the relationship in mind: the VMP is the policy document that governs the program, and each individual validation plan or protocol is where that policy gets applied to one system, one process, or one piece of equipment. The VMP should almost never need to change when a single system is added or retired. If it does need to change every time, it was written at the wrong level of detail, too specific to survive normal program growth.
Scoping by risk, not habit
The most common scoping mistake in a growing biotech is not scoping too narrow. It is scoping by habit, validating whatever the last program validated, in the same depth, regardless of whether this program’s risk profile is actually the same. The defensible scoping test is GxP impact: does this system or process create, modify, store, or affect data or decisions that bear on product quality, patient safety, or data integrity. A system that clears that test is in scope. One that does not is out of scope, and the VMP should say so explicitly, with the reasoning recorded, rather than simply omitting it, because an unrecorded omission and an oversight look identical to anyone reviewing the plan later.
The scoping decisions that get missed are rarely the obvious ones. Manufacturing equipment and the process itself almost always make the list. What gets forgotten is the layer underneath: the utilities feeding the process, purified water, clean steam, compressed gases; the facility systems whose failure would affect product, an HVAC system maintaining a classified space, a cold storage unit holding drug substance; and the computerized systems that record or control any of it. A VMP that covers process validation thoroughly but never states how utility qualification, facility qualification, and computerized system validation fit into the same program is missing exactly the connective tissue an inspector will look for. EU GMP Annex 15, Qualification and Validation, is the international reference point for this concept and expects the same summary of validation philosophy and approach, so a VMP built to satisfy a US inspection generally holds up to an EU one if the scoping logic is genuinely complete.
Phase-appropriate validation
Validation rigor is not a constant. A Phase 1 program manufacturing a handful of batches for a first-in-human study does not need, and should not attempt, the same depth of process characterization, the same batch-count rationale, or the same periodic review cadence as a company approaching a Biologics License Application. ICH Q8(R2), Q9, and Q10 collectively establish the principle underneath this: validation and quality effort should scale with risk and with process understanding, not sit at one fixed setting regardless of where the product is in development.
This cuts in both directions, and the direction that gets missed most often is the second one. Under-building for an early phase is the obvious risk, and most organizations know to avoid it: releasing material for a first-in-human trial without basic equipment qualification and method verification is not defensible. The less obvious risk is over-building, spending Phase 1 budget and time producing PPQ-caliber documentation for a process that will very likely change before Phase 3, let alone before commercial launch. A validation package written with Phase 3 rigor for a process design that is still expected to evolve is not a sign of diligence. It is wasted effort that will need to be redone once the process actually settles, and it is worth saying plainly to a team eager to do it right the first time: doing it right, at this phase, means matching effort to what the current stage of development calls for, not maximizing rigor everywhere.
The VMP is where this scaling gets written down as policy rather than negotiated project by project: what a Phase 1 program must have in place, what a pivotal-trial program adds, and what full commercial process validation, PPQ included, requires before launch. A clinical-stage VMP that is silent on phase-appropriate scaling forces every project team to relitigate the same argument about how much validation is enough.
Keeping a system and process inventory register
A VMP’s scoping logic states the test; the inventory register is where that test gets applied to an actual list, once, and kept current. Without a register, the VMP’s scope statement is policy with nothing to check it against, and the gap between what the VMP claims to govern and what the company actually operates grows invisibly until an inspector asks for the current system list and the two do not match.
A useful register tracks, at minimum: the system or process name and a short description; the GxP-impact category the scoping test assigns it; the risk tier from the Validation Risk Classification Matrix, cross-referenced rather than re-derived; the current qualification or validation status; the date of the last qualification or validation activity; and the date the next periodic review is due. A register with these fields answers, without anyone reconstructing it from memory, the question an inspector asks most often about a VMP: does the stated scope match what the company actually has.
The register is a living artifact by nature, updated when a system is added, retired, or materially changed, not reassembled from scratch at every VMP periodic review. Assigning ownership of keeping it current, not just approving it once, is what keeps it from becoming exactly the kind of document that was accurate the day it was written and stale ever since, the failure mode this article names again below for the VMP itself. A working register built around these fields, with a filled sample showing a Tier 1 and a Tier 3 entry side by side, is at GxP system and process inventory register.
VMP structure when the company owns no manufacturing facility
Everything above assumes a company operating its own GMP facility, with utilities, HVAC, and equipment it qualifies directly. That assumption does not hold for a large share of this article’s actual audience. Most clinical-stage cell and gene therapy companies, and a meaningful share of oligonucleotide and biologics programs too, manufacture entirely through one or more CDMOs and never operate a GMP facility of their own. The question that assumption leaves unanswered is a real one, and it surfaces at exactly the moment the opening scenario describes: an inspector, or a diligence team, asks a virtual sponsor for its VMP, and the honest first reaction on the sponsor side is sometimes “we don’t manufacture anything ourselves, so what would our VMP even cover?”
The answer is that a sponsor’s VMP does not disappear when manufacturing is outsourced; it scopes differently, and getting that scope wrong in either direction creates a real gap. Two documents exist, not one, and they are not interchangeable. The CDMO’s own site VMP governs the facility, utilities, and equipment the CDMO operates, and a sponsor should confirm that document exists and is current as part of ordinary CDMO oversight, the same diligence the CDMO technical assessment already covers for other quality-system elements. The sponsor’s own VMP governs what the sponsor itself remains accountable for regardless of where manufacturing physically happens: the boundary statement naming which systems and activities are the CDMO’s to validate under its own quality system and which remain the sponsor’s; the sponsor’s oversight program itself, its quality agreement, its person-in-plant program, and the escalation and disposition authority those activities carry; any analytical methods the sponsor validates or holds at a separate lab rather than at the CDMO; and computerized systems the sponsor itself owns and operates, a chain-of-identity and chain-of-custody tracking system for an autologous product being the clearest example, since that system typically lives with the sponsor or a logistics partner rather than inside the CDMO’s own validated environment.
ICH Q10 Section 2.7’s principle, that outsourcing the work does not outsource the responsibility, already anchors this same point for oversight programs in this piece’s companion articles. It anchors the VMP question just as directly: a sponsor’s quality unit retains accountability for product quality regardless of who runs the equipment, and a VMP that exists only on the CDMO’s side, with nothing on the sponsor’s side describing how the sponsor exercises that retained accountability, describes the CDMO’s program, not the sponsor’s own governance of it. The GxP-impact scoping test described earlier still applies, but it has to run against a second question alongside it: does this system or activity create, modify, store, or affect data or decisions bearing on product quality, patient safety, or data integrity, and which party, sponsor or CDMO, is accountable for it under the quality agreement. A system can clear the first question and still belong entirely to the CDMO’s VMP rather than the sponsor’s; what the sponsor’s VMP needs is not a shadow copy of the CDMO’s scope, but an accurate boundary statement showing where the sponsor’s own accountability picks up.
The failure mode that actually shows up in practice is not usually a sponsor claiming false ownership of CDMO-side systems. It is a sponsor with no VMP of its own at all, on the assumption that the CDMO’s VMP already covers everything because that is where manufacturing happens. That assumption survives right up until an inspection or a diligence review asks the sponsor, specifically, for its own governance of the outsourced program, not the CDMO’s, and finds nothing written down. A working boundary matrix, listing each GxP-relevant system or activity, which party’s VMP governs it, and the quality agreement clause that assigns it, closes exactly this gap; a ready-to-use version, with a filled specimen for a virtual cell therapy sponsor working with a single drug substance CDMO and a separate fill-finish CDMO, is at Sponsor-CDMO VMP scope boundary matrix.
Two frameworks describing the same lifecycle
A VMP for a company selling into both the US and the EU has to speak two regulatory dialects that describe much of the same territory differently enough to trip up a plan written for only one. The FDA’s 2011 process validation guidance names three explicit stages, Process Design, Process Qualification, and Continued Process Verification, and expects a VMP to show where each system and process sits in that lifecycle. EU Annex 15 does not use that three-stage vocabulary. It organizes the same territory around qualification, design qualification through performance qualification, and process validation, and it names validation approaches directly: traditional process validation, the classic batch-based approach culminating in a defined number of qualification batches; continuous process verification, built on continuous or near-continuous monitoring for a process developed with enough Quality by Design maturity to support it; and a hybrid approach blending the two, which Annex 15 allows for a process with substantial manufacturing history and data behind it, including a process originally validated the traditional way. Annex 15 then carries the same after-qualification expectation forward as ongoing process verification, functionally the same commitment as Stage 3 continued process verification, described without needing the FDA’s numbered-stage frame to justify it.
A clinical-stage VMP does not need to pick one vocabulary and translate the other into it as an afterthought. It needs to state, once, that both frameworks describe the same underlying activity: process design and characterization, a demonstration that the commercial process performs reproducibly, and ongoing monitoring that the demonstrated state holds. A VMP that maps its own program to both sets of terms, explicitly, in one place, reads as fluent to either regulator. A VMP that only ever uses “Stage 1/2/3” language, with no acknowledgment that an EU inspector may ask the same questions in Annex 15’s terms, is not wrong, but it is making the inspector do translation work the VMP should already have done.
A third document is worth naming alongside FDA’s 2011 guidance and EU Annex 15, since it does not compete with either one but bridges them at the operational level: PDA Technical Report No. 60, Process Validation: A Lifecycle Approach, revised in 2026 for the first time since its original 2013 edition. The revision is substantially larger than the document it replaces and moves the report from describing the lifecycle concept to describing how to run it: it treats multivariate statistical monitoring, the kind of correlated-parameter signal detection covered in Stage 3 continued process verification, as an expected element of a mature CPV program rather than an advanced option; it adds a structured approach for bringing an existing, pre-lifecycle-framework product’s validation documentation into current lifecycle terms without re-running the original qualification work; and it extends validation thinking to process analytical technology and real-time release testing, covering how a chemometric model or an automated release algorithm itself gets validated. None of this replaces the FDA or EU Annex 15 language a VMP already has to speak; it is a citable, PDA-recognized reference for the “how” underneath both, and a VMP’s reference list due for its next periodic update should add it alongside the existing FDA and Annex 15 citations rather than leaving the lifecycle concept sourced only to the two regulatory documents.
A companion reference worth adding alongside it, since it covers the stage of a program’s life a VMP’s phase-appropriate section already has to speak to, is PDA Technical Report No. 56, Application of Phase-Appropriate Quality Systems and Good Manufacturing Practice to the Development of Biological Product Drug Substance, published in a substantial 2026 revision in March 2026, the report’s first update since its 2012 original. Where TR-60 describes how to run a mature, already-locked commercial process’s ongoing lifecycle, TR-56 sits earlier: it describes how much quality system rigor a biological drug substance program actually needs at each point from preclinical development through Phase 3 and into process validation, written specifically against the recurring problem the report calls out directly, organizations applying full commercial-scale quality standards to an early-phase clinical product because scaling rigor down feels riskier than leaving it turned up everywhere. A VMP’s phase-appropriate rigor section, the one governing what a Phase 1 program must have in place versus what a pivotal-trial program adds, is the exact question TR-56 answers in more operational depth than either FDA’s 2011 guidance or EU Annex 15 attempt to. Citing it alongside TR-60 gives a VMP’s phase-appropriate framework a PDA-recognized reference for the ramp up to commercial rigor, and TR-60 the reference for what happens to that same process once it is there.
Choosing traditional, continuous, or hybrid without re-arguing it each time
The interview Q&A below answers, in the abstract, how the three approaches differ. The harder problem in a real program is applying that distinction consistently across every process the VMP governs, so a validation lead is not re-litigating the same argument for a new unit operation that a different team already decided for a comparable one last quarter. That takes a stated set of criteria, checked in the same order every time: how much manufacturing history and batch data the process already has behind it; whether the process was developed with Quality by Design characterization deep enough to support continuous or near-continuous monitoring in place of a fixed batch count; and whether the process is entering validation for the first time or is a previously, traditionally validated process now adding ongoing monitoring on top of qualification work that does not need to be redone.
A process with little history and no QbD-depth characterization defaults to traditional, a defined batch count culminating in a PPQ campaign. A process built from the start with real-time or near-real-time monitoring and a mature design space defaults to continuous process verification. A process with substantial manufacturing history, including one already qualified the traditional way, that is now adding continuous monitoring going forward is the hybrid case Annex 15 names explicitly, and the VMP should say so rather than leaving the case implicit. Running this decision the same way for every process, and recording which criterion drove the answer, is what keeps the choice from becoming inconsistent across programs run by different validation leads over time. A worked worksheet applying these criteria to three example processes, one of each outcome, is at Process validation approach selection worksheet.
PIC/S PI 006-4: a 2026 update every VMP owner should know about
A VMP does not only have to speak FDA’s and the EU’s dialects. Most stringent regulatory authorities outside the US, and, since 2011, the FDA itself, participate in the Pharmaceutical Inspection Co-operation Scheme, and PIC/S publishes its own recommendation on this exact subject: PI 006, Recommendation on Qualification and Validation. For nearly two decades that recommendation was PI 006-3, dated September 2007. In 2026, PIC/S issued a full revision, PI 006-4, entering into force on 1 October 2026, and the change is substantial enough that a VMP referencing the old document by name or by its old structure is citing something that no longer describes current PIC/S expectations.
The revision is not a light edit. PI 006-3 was, in practice, four separate recommendations bundled under one number: a validation master plan recommendation, an installation and operational qualification recommendation, a non-sterile process validation recommendation, and a cleaning validation recommendation, each written at a different time with its own scope boundaries. PI 006-4 consolidates all of that into one document treating qualification and validation as a single discipline, brought current with the 2015 revision of Annex 15 and with ICH Q9 quality risk management woven through every section rather than referenced once in an introduction and then left to the reader to apply consistently.
The scope expansion matters more than the consolidation itself. PI 006-4 explicitly defines prequalification stages leading into design qualification, treats performance qualification as its own distinct activity rather than folding it into installation and operational qualification, and adds coverage the 2007 version touched unevenly or not at all: ongoing process verification, PIC/S’s counterpart to FDA’s Stage 3 Continued Process Verification; transport verification; packaging validation; utility qualification; and test method validation.
| PI 006-3 (2007, superseded 1 October 2026) | PI 006-4 (in force 1 October 2026) |
|---|---|
| Four separate recommendations: VMP, IQ/OQ, non-sterile process validation, cleaning validation | One consolidated recommendation covering qualification and validation as a single discipline |
| Performance qualification not treated as a distinct stage | Performance qualification defined as its own stage, prequalification through PQ |
| Silent on transport verification and utility qualification | Adds transport verification, utility qualification, and test method validation to scope |
| Quality risk management referenced, not integrated | ICH Q9 quality risk management runs through every section |
| Predates the 2015 revision of Annex 15 | Aligned to the current Annex 15 |
What this means for a working VMP, in practice: check the reference list for any citation of “PIC/S PI 006-3” or a generic paraphrase of the old four-document structure, and replace it with “PIC/S PI 006-4, Recommendation on Qualification and Validation (in force 1 October 2026).” Then check the VMP’s own scope statement against the items PI 006-4 calls out by name. A VMP that lists facility and utility systems under one generic heading should confirm utility qualification and, if the product ships anywhere, transport verification are each addressed somewhere specific enough that a PIC/S-trained inspector would recognize the coverage, not assumed to be implicitly covered because “facility systems” appears in the scope table. Treat the 1 October 2026 effective date itself as one of the periodic-review triggers described below: a VMP due for its normal cyclical review around that date is a natural point to fold the reference update in, rather than waiting for the next full rewrite. Running that reference check and the scope comparison against PI 006-4’s added items, transport verification, utility qualification, test method validation, and performance qualification as its own stage, is mechanical enough to warrant a fixed checklist rather than a one-off review the week of the transition; a ready-to-use version, with a filled specimen showing a VMP’s reference list and scope table before and after the correction, is at PIC/S PI 006-4 transition checklist.
A second reference is also worth watching, one step earlier in the pipeline than PI 006-4. EMA and PIC/S jointly issued a concept paper proposing a further revision of EU GMP Annex 15 itself, the document PI 006-4 was just brought current against; public consultation on that concept paper closed 9 April 2026, with a corrigendum published 15 July 2026, and the stated direction is to make Annex 15’s coverage of active substance manufacturers mandatory rather than optional, extending the qualification stages already familiar from finished-dosage validation, design qualification through performance qualification, to active substance sites, and aligning the document more closely with ICH Q9(R1) quality risk management. A first draft of the revised Annex 15 text is expected by the end of 2026; nothing published so far is a final or even draft rule, so nothing in a current VMP needs to change because of it yet. It belongs on the same periodic-review watch list as the PI 006-4 transition: a VMP due for review is a reasonable point to note the concept paper’s existence and direction, so the next Annex 15 revision, whenever it lands, is an expected update rather than a surprise one.
The 2026 FDA CMC flexibility guidance: what it changes for a clinical-stage VMP
FDA finalized “Chemistry, Manufacturing, and Controls Flexibilities for Developing Human Cellular and Gene Therapy Products for a Biologics License Application” in May 2026 (docket FDA-2026-D-4692), a guidance that speaks directly to two phase-appropriate rigor questions a cell or gene therapy VMP has to answer: how many PPQ batches are enough, and how many lots does a release method need for its own validation. Neither answer is a fixed number under the new guidance, and that is the point: both are risk-based judgments the VMP’s own framework has to be equipped to make and document, not defer to a copied industry convention.
On PPQ batch count, the guidance describes conditions under which FDA may accept concurrent release of PPQ batches for commercial use after BLA approval, when those batches meet the commercial release specification and fall within the commercial shelf life, rather than requiring every PPQ batch to sit in quarantine pending a full campaign readout before any of it can reach a patient. This matters most for exactly the products a VMP built for advanced therapies has to plan around: a small manufacturing history, a short shelf life, or a supply chain where every batch corresponds to a specific patient’s own material, where holding an already-qualified batch off the market for administrative reasons carries a real cost. A VMP’s phase-appropriate rigor section should state whether concurrent release is a strategy the program intends to use and, if so, cross-reference the batch-count risk assessment that justifies it.
On method validation, the same guidance states that CBER does not require a minimum number of lots for validating analytical methods used for release testing, and may accept validation using a single representative lot if the sponsor’s strategy is scientifically supported and the data demonstrate the method performs robustly for its intended purpose. A clinical-stage VMP that still assumes a fixed minimum lot count for every release method’s validation, a convention carried over from more conventional biologics programs with abundant manufacturing history, is not wrong to be cautious, but it is not using the flexibility the current guidance actually offers a program that can support a single-lot justification with real data.
Neither flexibility is a default; both require the VMP’s own risk framework to produce a documented, scientifically supported justification rather than citing the guidance’s existence as sufficient basis on its own. The paired PPQ batch-count risk-based justification template shows what that justification looks like filled in for a batch-count decision citing this guidance.
How the VMP talks to individual protocols
Every protocol, an equipment IQ/OQ/PQ, a cleaning validation, a method validation, a PPQ protocol, a computerized system validation plan, should be traceable back to the VMP in a specific way: the VMP’s scoping logic explains why the system is in scope at all, the VMP’s risk framework explains why this system gets this level of rigor, and the VMP’s roles section explains who is authorized to approve the protocol and release the system or process for use. A reviewer should be able to open any protocol in the program, ask why it exists and why it looks the way it does, and find the answer traces back to a decision the VMP already made, not a decision improvised for this one document.
A worked trace makes this concrete. Say the VMP’s risk framework scores GxP impact on three tiers, and a new chromatography data system used to generate release results scores Tier 1, direct impact on a quality decision. The VMP’s policy for Tier 1 computerized systems calls for full computerized system validation, a data integrity risk assessment, and periodic review every twelve months, and the CSV plan for that system does not re-argue any of it; it opens by citing the VMP’s Tier 1 classification and applies the twelve-month cycle the VMP already set. Contrast a Tier 3 system, an uncontrolled spreadsheet used only to schedule internal meetings, which the VMP’s own scoping logic excludes from GxP impact entirely, with that reasoning recorded once at the VMP level so nobody re-decides it the next time a similar tool shows up. The same risk framework produces two very different validation footprints, and a reviewer can see why for both without asking anyone to explain it live.
This is also where the VMP earns its keep operationally. A validation lead writing a new protocol should not need to re-derive the organization’s risk-scoring approach or re-argue how many batches a process performance qualification needs from first principles every time. The VMP commits the organization to one methodology; the protocol applies it. When a protocol departs from what the VMP would predict, more batches than the risk tier suggests, a shorter periodic review interval than the default, that departure should be visible and justified in the protocol itself, not silently absorbed.
Computerized systems: GAMP 5 categories inside the VMP’s risk tiers
The worked trace above uses a chromatography data system to show how the VMP’s own risk tiers decide validation depth, and it is worth naming the vocabulary a computerized-system specialist actually reaches for once that trace gets applied for real. ISPE’s GAMP 5 guide, in its second edition published in 2022, is the reference most CSV-experienced validation leads and inspectors already use to describe a computerized system’s construction, and a VMP that states its own Tier 1/2/3 GxP-impact framework without connecting it to GAMP 5’s category vocabulary is creating the same translation burden the article already names above for FDA-versus-Annex-15 language: technically not wrong, but making a specialist reader do work the VMP should already have done.
GAMP 5’s categories describe how a system was built and how much of it is vendor-supplied versus configured versus custom, not how much a failure in that system would matter. Infrastructure software, operating systems, database engines, the standard platforms everything else runs on, sits at the low-customization end and typically needs installation verification and configuration documentation rather than deep functional testing. Off-the-shelf software used without modification sits one step up: a spreadsheet or a PDF reader applied to a GxP task still needs its actual intended use verified, even though the underlying product itself needs no functional testing. Configured products, a vendor platform such as a LIMS or an MES set up with the site’s own methods, workflows, and calibration, shift the effort toward proving the site-specific setup works as intended, since the underlying platform carries vendor-supplied evidence a validation plan can reasonably build on rather than duplicate from zero. Custom applications, code written in-house or heavily customized beyond a vendor’s supported configuration options, sit at the opposite end from infrastructure software and need the deepest effort of all: nothing vendor-supplied exists to build on, so the validation plan has to reconstruct that missing evidence itself, a life-cycle record covering how the code was specified, written, reviewed, and tested piece by piece before the assembled system is tested as a whole. The second edition also folded firmware, previously its own category, into the surrounding categories rather than keeping it separate, part of a broader shift in that edition toward proportioning validation effort to patient-safety risk and accepting vendor evidence as a legitimate input rather than insisting on independent re-testing of everything.
Category and risk tier answer different questions, and a defensible CSV plan states both rather than letting one stand in for the other. Return to the Tier 1 chromatography data system from the worked trace above: it is also, typically, a GAMP Category 4 configured product, a vendor CDS platform configured with the site’s own methods and calibration. The risk tier, Tier 1, sets the validation depth, full computerized system validation, a data integrity risk assessment, periodic review on a defined cycle. The category tells the validation lead something the tier alone does not: the vendor’s own testing evidence for the base platform is a legitimate input the CSV plan can reference, while the site-specific method configuration still needs independent verification, because that configuration is exactly what the vendor’s own testing did not cover. Contrast a Tier 3 system that happens to be a GAMP Category 5 custom build, an internally coded scheduling tool with no GxP data role at all. GAMP 5 would normally treat custom code as the category warranting the most validation effort; the VMP’s own Tier 3 exclusion still controls here, because GAMP 5’s category describes what kind of system this is, not what a failure in it would cost. Citing category alongside tier, not instead of it, is what keeps both frameworks honest.
EU GMP Annex 11, Computerised Systems, is the regulatory anchor GAMP 5 sits under on the EU side, the same relationship Annex 15 has to the process-validation lifecycle language covered above, and a VMP’s computerized-systems section should name both, by current edition, for the same reason argued above for citing PI 006-4 by its current version rather than a superseded one. A working worksheet crosswalking a system’s GAMP 5 category against the VMP’s own risk tier, and the resulting validation deliverables each combination actually calls for, with a filled specimen covering the two contrasting examples above, is at Computerized system GAMP 5 category and risk-tier crosswalk worksheet.
Data integrity and ALCOA+ as a cross-cutting VMP theme
The GxP-impact test described earlier already names data integrity as one of three things a system can affect, alongside product quality and patient safety. A VMP that lets that single mention stand as its entire data integrity coverage is leaving the theme underdeveloped in exactly the area regulators have spent the most enforcement attention on over the past decade. FDA’s guidance “Data Integrity and Compliance With Drug CGMP: Questions and Answers,” finalized in December 2018, and MHRA’s “GxP Data Integrity Guidance and Definitions,” revision 1, published in March 2018, describe the same underlying expectation using the same shorthand: a record has to be attributable, legible, contemporaneous, original, and accurate, the ALCOA elements, and MHRA’s guidance adds complete, consistent, enduring, and available as the “plus.” Neither document is a validation guidance, and neither replaces the VMP’s own risk framework, but a VMP that never states how its own GxP-impact tiers connect to the ALCOA+ elements is asking a validation lead to apply two frameworks separately rather than together, the same translation burden this article already names for FDA-versus-Annex-15 vocabulary and for GAMP 5 category versus risk tier.
Data integrity is not its own risk tier in a VMP, and it does not earn its own line in the system inventory. It is a lens applied to every tier, with the depth of scrutiny scaling the same way validation rigor does. A Tier 1 computerized system’s validation plan already calls for a data integrity risk assessment under this article’s own risk-tier table above; what a VMP adds, done well, is a standard set of ALCOA+ questions that assessment asks every time, rather than a validation lead inventing the question list fresh for each new system.
| ALCOA+ element | What it asks of a GxP record | Where a validated system commonly falls short |
|---|---|---|
| Attributable | Can the record be traced to the specific person or system that generated it | Shared login credentials on an instrument workstation, so an action cannot be traced past the workstation to an individual |
| Legible | Can the record be read and understood for as long as it needs to be retained | A thermal printer output that fades before the retention period ends |
| Contemporaneous | Was the record created at the time the activity happened, not reconstructed afterward | A manual logbook entry backfilled at the end of a shift rather than at the time of the reading |
| Original | Is this the first recording of the data, or a true copy of it, rather than a transcription | An operator transcribing an instrument display reading onto a paper form instead of the instrument generating its own record |
| Accurate | Does the record reflect what actually happened, with any correction visible rather than obscured | A result overwritten in a spreadsheet cell with no tracked change and no explanation |
| Complete | Does the record include every result, including a failing or an out-of-specification one, not only the ones that supported the intended conclusion | A repeat run that produced an unfavorable result, excluded from the dataset with no documented justification |
| Consistent | Do the record’s timestamps and sequence of events hold together internally | A record showing a review signed before the test it reviews was actually run, caught only when the dates are checked against each other |
| Enduring | Will the record survive for its full retention period, including through a system migration or a media format change | Data captured only on a legacy instrument’s internal memory, with no plan for what happens when that instrument is retired |
| Available | Can the record actually be retrieved and reviewed on demand, including by an inspector, within the retention period | An audit trail that exists technically but that nobody on site knows how to export or read |
A data integrity risk assessment attached to a Tier 1 or Tier 2 system’s computerized system validation plan should be treated as complete only when it states, for each ALCOA+ element, whether the system supports that element natively or depends on a manual or compensating control, and names the control. A VMP that defers this element-by-element check to “whatever the vendor’s own validation package says” has not actually run the assessment itself; a vendor’s testing evidence, the same evidence the GAMP 5 crosswalk above treats as a legitimate input for a configured product, speaks to whether the platform functions as designed, not to whether this site’s specific configuration and use pattern actually produces attributable, contemporaneous, complete records in practice.
A worked contrast makes the lens concrete. An electronic batch record system that time-stamps every entry, restricts entry to the operator logged in under their own credentials, and locks a completed step against silent edits satisfies most ALCOA+ elements by design, and the assessment’s real work is confirming the audit trail is actually reviewed, not just generated. A paper logbook recording the same manufacturing step satisfies none of those elements automatically; attributability depends on legible, individually initialed entries, contemporaneousness depends on the entry being made at the bench rather than reconstructed later from memory, and completeness depends on a documented reconciliation that no page went missing. Neither medium is inherently acceptable or unacceptable under ALCOA+; the assessment has to be run against the actual record-keeping practice, not against the medium’s reputation.
The VMP owner and the computerized systems owner from the roles table below are the natural accountable parties for keeping the ALCOA+ question set current and applied consistently; a validation lead scoping a new system’s data integrity risk assessment should be pulling from that standard set, not starting from a blank page for every new system. A ready-to-use worksheet scoring a system against each ALCOA+ element, with a filled specimen contrasting an electronic batch record system against a paper logbook, is at ALCOA+ data integrity risk assessment worksheet.
Roles and responsibilities
A VMP that assigns responsibility only in prose, scattered across paragraphs, is harder to audit than one that states it once in a table an inspector or a new hire can read in thirty seconds.
| Role | Responsibility |
|---|---|
| VMP owner (typically Head of Validation or Quality) | Maintains the current approved version, tracks the periodic review cycle, and decides whether a trigger event requires an off-cycle update rather than waiting for the next scheduled review |
| Validation lead per system or program | Applies the VMP’s risk framework and phase-appropriate rules to scope, write, and execute individual protocols; documents and justifies any departure from what the VMP would predict |
| Quality Assurance | Approves the VMP itself and every protocol executed under it; is the final decision-maker when a new system’s GxP-impact classification is disputed |
| Site or facilities engineering | Maintains the utility and facility qualification status that the VMP’s scope statement depends on, including the systems easiest to leave out by omission |
| Computerized systems owner | Maintains validation and periodic review status for systems the VMP’s risk tiers assign to the highest-impact category |
| Executive sponsor | Approves the resourcing the VMP commits the organization to, and is the escalation point when phase-appropriate rigor comes under schedule pressure |
| Business development / corporate development | Flags a pending or closed product acquisition or in-license to the VMP owner early enough for the legacy validation package adequacy assessment described below to run before the deal closes, not after |
Naming a function rather than a person in this table is what keeps the VMP valid when the organization reorganizes; see the common mistakes below for what happens when roles are assigned by name instead.
Keeping it a living document
A VMP that was accurate the day it was approved and has not been touched since is not a living document, it is an artifact, and the gap between what it says and what the program actually does only grows with time. The VMP itself needs periodic review, on a defined cycle, and specific triggers that pull a review forward regardless of the calendar: a new modality entering the pipeline that the existing scope logic does not clearly cover, a new facility or a change in manufacturing site, a shift in development phase, particularly the move from clinical to commercial, or a reorganization that changes who holds the roles the VMP assigns.
The practical failure mode is not dramatic. It is a VMP that describes a single-product, single-site, Phase 1 company, still in force two platforms and one commercial launch later, because nobody owned the trigger to update it. Ownership matters here as much as content: the VMP needs a named owner and an approval and review history, the same governance any other controlled document gets under 21 CFR 211, so that “current version” is never ambiguous.
VMP governance under change: an acquired product, an in-licensed asset, or a modality pivot
The periodic review triggers named above, a new modality entering the pipeline, a reorganization, a facility change, cover the calendar logic of when a VMP gets re-opened. They do not, on their own, say what actually has to happen inside the VMP once one of the two hardest trigger types fires: the company has just acquired or in-licensed a product with a validation history that did not originate inside its own VMP, or the company has just added a second modality or manufacturing platform that the existing scope and risk logic never contemplated. Both situations share the same underlying failure mode if handled casually: inheriting or extending validation coverage by assumption, rather than by re-running the VMP’s own methodology against the new reality.
Acquired and in-licensed products: assessing an inherited validation package
A company acquiring or in-licensing a clinical-stage or approved product inherits whatever validation work the originating company already did, and the inherited package is rarely a clean match for the acquiring company’s own VMP. The question the VMP has to answer is not whether the inherited package exists, but whether it meets this company’s own risk tier requirements, under this company’s own methodology, not the prior owner’s.
ICH Q7, the GMP guidance for active pharmaceutical ingredients, is instructive here even though it predates the current product classes this article covers, because it states directly how narrow a legitimate retrospective validation claim actually is. Section 12.44 of ICH Q7 permits retrospective validation only as an exception for a well-established process with no significant change to raw materials, equipment, systems, facilities, or the process itself, where critical quality attributes and critical process parameters are already identified, in-process controls are already established, no significant unexplained failures have occurred, and the impurity profile is already characterized; section 12.45 expects the batches reviewed to be representative of the full population, including any that failed; and section 12.50 sets an expectation of ten to thirty consecutive batches examined for a retrospective claim, far more than the batch counts a prospective PPQ campaign typically uses. FDA’s own 2011 process validation guidance, the same guidance this article’s lifecycle section already maps to EU Annex 15, does not use the term “retrospective validation” at all, a sharper position than ICH Q7’s own bounded exception and a clear signal that the current expectation leans toward prospective or concurrent validation even for an existing process, not toward backfilling a validation conclusion from historical production data after the fact.
What this means in practice: a VMP cannot treat “the process has been running for years” as validation by itself, inherited or otherwise. The adequacy assessment has to run this company’s own GxP-impact test and risk tier assignment on every system and process the acquired product touches, independently of whatever tier, or lack of one, the originating company used, and has to treat any process with a significant change since the inherited data was generated, a site move, an equipment change, a new raw material source, as a process needing prospective or concurrent validation now, not a candidate for retrospective justification.
| Inherited item | Condition found at due diligence | Disposition | Rationale |
|---|---|---|---|
| Drug substance process performance qualification, originating CDMO, same site and equipment post-close | No significant process, site, or equipment change since PPQ | Accept as the basis for continued commercial use, cross-referenced into this company’s own inventory register at its own risk tier | Clears the GxP-impact test and the site and equipment continuity ICH Q7’s own retrospective exception would require even if that exception were being invoked |
| Cleaning validation, same process moving to a newly contracted second CDMO site | Equipment and facility differ from where the original cleaning validation was executed | Revalidate at the new site | Cleaning validation is site- and equipment-specific; a validation conclusion reached on different equipment does not transfer |
| Originating company’s LIMS, used to generate and store the inherited release data | System will not transfer with the deal; acquiring company will run the same assay on its own LIMS instance | New computerized system validation required for the receiving instance | The inherited validation speaks to a system that will no longer exist in production; it has no bearing on the new instance’s own configuration |
| Potency release method, validated at the originating company’s analytical lab | Method itself is unchanged; execution moves to the acquiring company’s own lab or a contracted lab | Accept the original validation data as supporting evidence, supplement with a method transfer or bridging study at the new testing site | The method’s scientific validity carries over; the new site’s ability to execute it reproducibly does not, and needs its own evidence |
The disposition in each row traces back to the same question asked four different ways: did anything material change between where the inherited evidence was generated and where this company now operates, and does the inherited evidence meet this company’s own risk tier requirement, not merely exist. A VMP update or an acquisition due diligence plan that skips straight to “the acquired product is already validated” without running this comparison is the single most common way an inherited validation package creates an unpleasant surprise well after the deal has closed. A working assessment built around exactly this comparison, with a filled specimen covering an acquired AAV gene therapy asset across process validation, cleaning validation, a computerized system, and an analytical method, is at Legacy and acquired product validation package adequacy assessment.
Modality pivot: when the VMP’s own scope logic no longer fits
A company adding a second modality or manufacturing platform, an AAV gene therapy company building an internal lipid nanoparticle or GalNAc-conjugate oligonucleotide program being a common version of this in the current advanced-therapy market, is not simply growing the existing VMP’s scope table. The new platform typically brings its own critical quality attributes, an AAV company’s potency and capsid-related assays have little in common with an oligonucleotide program’s encapsulation efficiency and particle-size CQAs, its own raw material risk categories, an ionizable lipid supply chain looks nothing like a plasmid supply chain, and often its own computerized systems and unit operations that no existing risk tier assignment in the VMP was ever scored against.
The failure mode that actually shows up is scoring the new platform’s systems by analogy to the nearest-looking existing entry, rather than running the GxP-impact test on them fresh. A lipid nanoparticle formulation skid gets waved through at whatever tier the viral vector purification skid already carries, on the reasoning that both are “manufacturing equipment,” without anyone actually asking whether the new skid’s failure modes, computerized controls, or data integrity exposure resemble the old one at all. The VMP’s phase-appropriate rigor section is exposed to the same error: the new platform may be earlier in development than the company’s lead program, and a phase-appropriate rigor table written only with the lead program in mind will misapply the wrong row to the new platform’s own actual stage.
A VMP update prompted by a modality pivot is complete only when every new system and process the new platform introduces has its own risk tier score recorded in the inventory register, scored independently rather than inherited by resemblance, and when the phase-appropriate rigor table states which row applies to the new platform specifically rather than assuming the organization’s overall phase governs every program inside it. The pivot is also, in practice, when a VMP’s roles section most often goes stale: a new platform frequently brings a new technical function, a lipid formulation scientist, an oligonucleotide analytical lead, into the organization, and the VMP update is the natural point to name that function in the roles table rather than leaving it implicit until the next full review.
What an inspector actually does with your VMP
Inspectors rarely read a VMP cover to cover looking for prose quality. They sample, and they sample at the places where a plan and its execution tend to drift apart. A common pattern: pull the VMP’s scope statement, then ask for the current system or process inventory it claims to govern, and check whether the two agree. Pull a protocol and ask the team to explain, without looking it up, why this system was scoped the way it was and why the validation approach matches the VMP’s stated risk logic. Ask when the VMP itself was last reviewed, and compare that date to how much the organization has changed since.
None of these questions are unfair, and none require anything beyond what a functioning program should already have on hand. They are uncomfortable only when the VMP is aspirational, describing a program more mature or more current than the one actually running.
A real inspection record makes the pattern concrete rather than theoretical. FDA’s warning letter to Lonza Walkersville, dated April 21, 2017, followed an inspection running from January 18 through February 6, 2017 and found the site’s own validation master plan procedure inadequately established for cleanroom and HEPA filter qualification: no stated requirement tying the plan to the ISO 14644 classification the facility relied on, no specification for the HEPA filter air velocities the plan was supposed to control, no smoke-study evidence that airflow through the space was actually unidirectional, particulate monitoring that covered the room only at rest rather than during actual operation, and no viable-particulate monitoring recorded at all. Every one of those gaps is specific and checkable; none required an inspector’s judgment call to identify, only a comparison between what the facility’s own validation master plan said it required and what the qualification work on file actually showed. That is the same comparison described above, run by someone with the authority to issue a warning letter instead of a validation lead running a periodic review, and it is the reason the comparison is worth running on your own schedule rather than an inspector’s.
Common mistakes in a clinical-stage VMP
- A generic template adopted from a consultant or a prior employer, never adapted to this company’s actual systems, phase, or facility, so the scope and risk logic do not match anything the organization really does.
- A VMP written at commercial-launch rigor for a Phase 1 program, creating documentation debt the team cannot sustain and will not actually follow under real schedule pressure.
- Utilities, facility systems, and computerized systems left out of scope by omission rather than by a documented decision, so the inventory looks complete until someone asks about the water system.
- No periodic review of the VMP itself, so it silently drifts out of date as the company changes phase, adds a modality, or moves facilities.
- A VMP that was never formally approved, or was approved once and then superseded by informal practice that nobody wrote down.
- Roles defined by name instead of by function, so the VMP goes stale the moment someone changes teams, rather than staying valid because the function, not the person, was what was assigned.
- A reference list that still cites PIC/S PI 006-3 or describes it by its old four-document structure after 1 October 2026, when PI 006-4 takes over as the current recommendation.
- Traditional, continuous, and hybrid validation approaches chosen ad hoc per protocol with no consistent, recorded criteria, so two comparable processes end up validated under different philosophies for no defensible reason.
- No sponsor-side VMP at all for a virtual or CDMO-dependent program, on the mistaken assumption that the CDMO’s own VMP already covers the sponsor’s retained accountability.
- A computerized system’s GAMP 5 category cited with no crosswalk to the VMP’s own risk tier, so a Category 5 custom build with no GxP impact gets over-validated while a Category 4 configured product with real GxP impact gets under-scoped.
- A VMP that inherits an acquired or in-licensed product’s validation package on the assumption the prior owner’s risk framework is equivalent to this company’s own, rather than re-scoring every system against this company’s own GxP-impact test.
- Retrospective validation invoked as a general justification for any pre-existing process, when the actual exception, ICH Q7 section 12.44, is bounded to a well-established process with no significant change, and FDA’s current process validation guidance does not name retrospective validation as an approach at all.
- A second modality or platform’s systems scored by analogy to an existing platform’s risk tiers rather than against the GxP-impact test run fresh, so a materially different failure mode rides on someone else’s risk score.
- A data integrity risk assessment that asserts a system is “ALCOA+ compliant” with no element-by-element basis, so a later reviewer cannot tell which of the nine elements were actually checked and which were assumed.
Interview Q&A: validation master planning
How would you scope a VMP for a new clinical-stage program from scratch? Start with the GxP-impact test on every system, process, and computerized system the company operates: does it create, modify, store, or affect data or decisions that bear on product quality, patient safety, or data integrity. Everything that clears the test is in scope, and anything left out gets an explicit, recorded reason rather than a silent omission. Utilities, facility systems, and computerized systems are the layer most often forgotten under this test, not manufacturing equipment itself.
What’s the practical difference between FDA’s process validation stages and EU Annex 15’s approach, and does a VMP need to pick one? FDA’s 2011 guidance names three stages: Process Design, Process Qualification, Continued Process Verification. Annex 15 covers the same territory through qualification, design qualification through performance qualification, and validation approaches it names directly: traditional, continuous, and hybrid. A VMP should map its own program to both vocabularies explicitly in one place rather than writing to only one and leaving the other regulator to translate.
A VMP hasn’t been reviewed in over a year. Where do you start? Pull the current system and process inventory and compare it line by line against what the VMP claims to govern. Confirm the development phase the VMP assumes still matches the phase the company is actually in. Check the approval date against everything that has changed since, a new modality, a new facility, a reorganization. Whatever gap that comparison surfaces is the real state of the program, and closing that gap comes before any prose rewrite.
How do you decide between traditional, continuous, and hybrid process validation for a given process? Traditional process validation, a defined number of qualification batches, fits a process without extensive continuous monitoring infrastructure or deep Quality by Design characterization behind it. Continuous process verification fits a process developed with enough QbD maturity, and enough real-time or near-real-time monitoring, to demonstrate control without relying on a fixed batch count. Hybrid, mixing both, fits a process with substantial manufacturing history, including one originally validated the traditional way, that is adding continuous monitoring going forward without redoing the traditional validation that already happened. The VMP should state which approach applies to which process class and why, not leave the choice to be re-argued protocol by protocol.
A clinical-stage biotech outsources all of its manufacturing to a CDMO. Does it still need its own VMP? Yes, but scoped differently than a facility-owning company’s. The CDMO’s site VMP governs the facility, utilities, and equipment it operates. The sponsor’s own VMP governs what the sponsor remains accountable for regardless of where manufacturing happens: the boundary between the two programs, the sponsor’s own oversight and person-in-plant activities, and any systems the sponsor itself owns. ICH Q10’s principle that outsourcing the work does not outsource the responsibility is why a sponsor cannot rely on the CDMO’s VMP alone.
How does a computerized system’s GAMP 5 category relate to the VMP’s own GxP-impact risk tier? They answer different questions. GAMP 5’s category, infrastructure, non-configured, configured, or custom, describes how the system was built and how much vendor evidence a validation plan can build on. The VMP’s risk tier describes how much a failure in that system would matter to product quality, patient safety, or data integrity. A defensible CSV plan states both; category alone does not set validation depth, and tier alone does not tell a validation lead what evidence already exists to build on.
A company is about to in-license a clinical-stage asset that already has an approved process at another site. What does the VMP need to do before the deal closes? Run this company’s own GxP-impact test and risk tier assignment against every system and process the inherited validation package covers, independently of whatever tier the originating company used. Treat any process with a significant change since the inherited data was generated, a site move, an equipment change, a new raw material source, as needing prospective or concurrent validation now, not a retrospective justification. ICH Q7’s own retrospective validation exception is narrow, a well-established process with no significant change, and FDA’s current process validation guidance does not use the term at all, so “it already has years of production data” is not, by itself, a validation conclusion.
How does ALCOA+ fit into a VMP that already has its own GxP-impact risk tiers? As a lens applied across every tier, not as a tier of its own. A Tier 1 computerized system’s required data integrity risk assessment should check the system against each ALCOA+ element, attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available, and name whether the system supports that element natively or relies on a manual control. A generic assertion that a system is “ALCOA+ compliant” with no element-by-element basis is not a completed assessment.
What changes in a VMP when the company adds a second modality or manufacturing platform? The new platform’s systems and processes get scored against the GxP-impact test fresh, not inherited by resemblance to the first platform’s existing risk tiers. The phase-appropriate rigor table has to state which row applies to the new platform specifically, since it may be at an earlier development stage than the company’s lead program even though the organization overall is further along. And the roles section is the natural place to name whatever new technical function the platform brought in, rather than leaving it implicit.
Running a VMP gap assessment
The scenario in the opening of this article, an inspector asking for the VMP before asking about a single protocol, and the company having nothing current to hand over, is common enough to justify a defined method rather than an improvised scramble. A gap assessment answers one question with evidence: does the VMP that exists, or the absence of one, actually describe the program as it runs today.
The assessment runs in a fixed order because each step depends on the one before it. First, pull the current system and process inventory, from the register described above if one exists, or built fresh from a walk of manufacturing, facilities, and computerized systems if it does not, and compare it line by line against whatever the VMP claims to govern; every system present in one list and absent from the other is a finding. Second, confirm the development phase the VMP assumes against the phase the company is actually in today; a VMP still describing Phase 1 rigor for a program now running a pivotal trial is a finding regardless of how well the rest of the document is written. Third, check the reference list against the current version of every cited regulation, guidance, and recommendation, a superseded PIC/S PI 006-3 citation after 1 October 2026 being the clearest current example; a stale citation is a finding even when nothing else about the document is wrong. Fourth, check the approval and review history; a VMP with no periodic review on record, or one whose last review predates a phase change, a new facility, or a new modality, is itself a finding independent of what the document’s content actually says.
Each finding gets a severity call, not just a list entry: whether it is a documentation gap that closes by updating the VMP itself, or a program gap where the actual validation activity behind a system is missing or incomplete, the second kind being the more serious one because updating the VMP’s prose does not resolve it. A remediation plan follows the same structure as any other corrective action: owner, due date, and a clear line between what gets fixed before the VMP is next relied upon for an external request and what is longer-term work.
| Finding class | Example | What resolves it |
|---|---|---|
| Documentation gap | VMP scope statement omits a utility system that is, in practice, adequately qualified and maintained | Update the VMP scope statement and inventory register; no new validation work needed |
| Reference currency gap | Reference list cites a superseded standard | Update the citation; confirm nothing in the VMP’s substantive content depended on the superseded version’s specifics |
| Phase mismatch | VMP states Phase 1 rigor; program has moved into a pivotal trial | Update the phase-appropriate rigor section and confirm protocols already executed meet the correct rigor, not just relabel the document |
| Program gap | The inventory register shows a Tier 1 computerized system that has never been formally validated | The more serious class: schedule and execute the missing validation activity; a VMP update alone does not close this finding |
A gap assessment closes with a defensible answer to the original question, not a promise to fix things later: either the VMP is confirmed current and the register substantiates it, or a specific, owned remediation plan exists and is already in motion. A working report structured around this method, with a filled specimen showing a mixed documentation-gap and program-gap outcome, is at Validation Master Plan gap assessment report.
Monday-morning value
If there is no VMP yet, the fastest defensible starting point is not a lengthy document. It is three decisions written down and approved: what is in scope and why, using the GxP-impact test rather than a copied list; how rigor scales with the company’s current phase, stated plainly enough that a new hire could apply it without asking; and who owns the system inventory and the periodic review of the VMP itself. Everything else, the detailed risk-scoring matrix, the full roles assignment, can be built out from there.
If a VMP already exists but has not been looked at in a year or more, the fastest check is not a rewrite. Pull the current system inventory and compare it to what the VMP claims to govern, confirm the phase the VMP assumes still matches the phase the company is actually in, and check the approval date against everything that has changed since. Whatever gap that comparison turns up is the actual state of the program. Fixing that gap, not polishing the prose, is what makes the plan defensible the next time someone asks to see it.