This is a ready-to-use Validation Master Plan (VMP) skeleton. Replace every <<FILL: ...>> placeholder with your own specifics, route it through your document control system, and have it reviewed and approved before treating any section as governing policy. A filled specimen follows. Verify every cited reference against its current published version before issue.
Document control header
| Field | Entry |
|---|---|
| Document title | Validation Master Plan for <<FILL: site / program / facility>> |
| Document number | <<FILL: e.g. VMP-2026-01>> |
| Version | <<FILL>> |
| Effective date | <<FILL>> |
| Next scheduled review date | <<FILL: default interval below>> |
| Site(s) covered | <<FILL>> |
| VMP owner | <<FILL: e.g. Head of Validation>> |
| Supersedes | <<FILL: prior version number, or "None, initial issue">> |
1. Purpose
This Validation Master Plan states the scope, risk-based approach, phase-appropriate rigor, and governance for all qualification and validation activity at <<FILL: site / program>>. It is the policy document individual protocols, IQ/OQ/PQ, process performance qualification, cleaning validation, method validation, and computerized system validation, apply; it does not itself validate any system or process.
2. Scope
| Dimension | Decision |
|---|---|
| Facility / site(s) | <<FILL>> |
| Modality / product(s) | <<FILL: e.g. autologous CAR-T, AAV gene therapy, oligonucleotide drug product>> |
| Development phase this plan assumes | <<FILL: e.g. Phase 2, pre-BLA, commercial>> |
| Systems and processes explicitly out of scope, with rationale | <<FILL>> |
3. Scoping methodology: the GxP-impact test
A system, process, or computerized system is in scope for this VMP if it creates, modifies, stores, or affects data or decisions that bear on product quality, patient safety, or data integrity. Anything that clears this test is in scope; anything that does not is recorded here as out of scope with the reasoning stated, not simply omitted from the inventory.
| System / process category | In scope by default | Notes |
|---|---|---|
| Manufacturing equipment and process steps | Yes | <<FILL>> |
| Utilities (purified water, clean steam, compressed gases) | Yes | Commonly under-scoped; state explicitly |
| Facility systems (HVAC, classified spaces, cold storage) | Yes, where product-contact or environment-critical | <<FILL>> |
| Computerized systems recording or controlling GxP data | Yes | Cross-reference the risk classification matrix (Section 5) |
| Administrative or non-GxP tools (scheduling, internal communication) | No, unless a specific tool touches GxP data | State the exclusion rationale, do not omit silently |
4. Phase-appropriate rigor
| Phase | Expected validation state | What this VMP requires |
|---|---|---|
| Phase 1 / first-in-human | Basic equipment qualification, method verification | <<FILL>> |
| Pivotal trial / registration-enabling | Formal comparability and validation protocols scoped before batches run; methods validated | <<FILL>> |
| Commercial / post-BLA | Full PPQ with documented batch-count rationale; Stage 3 continued process verification / ongoing process verification in place | <<FILL>> |
State plainly which row applies to the program today, and the trigger (a phase change, a facility change) that would move it to the next row.
5. Risk classification (GxP-impact tiers)
Every in-scope system or process is scored against a defined tier, and the tier determines the rigor and periodic review cycle applied. Use the paired Validation Risk Classification Matrix template for the full scoring methodology and worked assessment table; summarize the tier definitions here.
| Tier | Definition | Typical validation approach | Periodic review interval |
|---|---|---|---|
| Tier 1 | Direct impact on a quality decision or patient safety | Full qualification/validation, data integrity risk assessment where a computerized system | <<FILL: e.g. 12 months>> |
| Tier 2 | Indirect impact, supports a Tier 1 system or decision | Risk-scaled qualification, narrower than Tier 1 | <<FILL: e.g. 24 months>> |
| Tier 3 | No GxP impact | Excluded from formal validation scope, documented as such | Not applicable |
6. Dual lifecycle framework (FDA and EU/PIC-S)
This VMP maps to both regulatory vocabularies describing the same underlying activity: process design and characterization, a demonstration that the process performs reproducibly, and ongoing monitoring that the demonstrated state holds.
| FDA (2011 process validation guidance) | EU Annex 15 / PIC/S PI 006-4 | This program’s status |
|---|---|---|
| Stage 1: Process Design | Design qualification through process development | <<FILL>> |
| Stage 2: Process Qualification (PPQ) | Performance qualification; traditional, continuous, or hybrid process validation | <<FILL: state which approach applies and why>> |
| Stage 3: Continued Process Verification | Ongoing process verification | <<FILL>> |
State the validation approach, traditional, continuous, or hybrid, that applies to each major process, and the basis for that choice.
7. Roles and responsibilities
| Role | Responsibility |
|---|---|
| VMP owner | Maintains the current version, tracks periodic review, decides on off-cycle updates |
| Validation lead per system/program | Applies this VMP’s risk framework to scope, write, and execute protocols |
| Quality Assurance | Approves this VMP and every protocol under it; final decision on disputed GxP-impact classification |
| Site / facilities engineering | Maintains utility and facility qualification status |
| Computerized systems owner | Maintains CSV status and periodic review for Tier 1/2 systems |
| Executive sponsor | Approves resourcing this VMP commits the organization to |
8. Periodic review and update triggers
This VMP is reviewed on a defined cycle of <<FILL: e.g. 24 months>>, and off-cycle whenever any of the following occurs: a new modality enters the pipeline that the current scope logic does not clearly cover; a new facility or manufacturing site change; a shift in development phase, particularly clinical to commercial; a reorganization changing who holds the roles assigned in Section 7; or a material revision to a referenced regulation or recommendation, including a PIC/S PI 006 revision, taking effect.
9. Deliverables and traceability
Every protocol executed under this VMP states, in its own header or introduction, which VMP scope decision and risk tier it traces to. Deliverables under this VMP include: the system and process inventory (Section 2), maintained as a live register (see the paired GxP System and Process Inventory Register), the risk classification matrix (Section 5), individual qualification and validation protocols, and the periodic review record (Section 8).
10. References
FDA guidance, “Process Validation: General Principles and Practices” (January 2011). ICH Q8(R2), Pharmaceutical Development. ICH Q9(R1), Quality Risk Management. ICH Q10, Pharmaceutical Quality System. EU GMP Annex 15, Qualification and Validation. PIC/S PI 006-4, Recommendation on Qualification and Validation (in force 1 October 2026). PDA Technical Report No. 60 (Revised 2026), Process Validation: A Lifecycle Approach. PDA Technical Report No. 56 (Revised 2026), Application of Phase-Appropriate Quality Systems and Good Manufacturing Practice to the Development of Biological Product Drug Substance.
Confirm the current version of each reference before issue.
11. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL>> | <<FILL>> | Initial issue. |
12. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Validation) | <<FILL>> | ||
| Reviewer (Manufacturing) | <<FILL>> | ||
| Reviewer (Quality Control) | <<FILL>> | ||
| Approver (Quality Assurance) | <<FILL>> |
Filled specimen
Extract for a clinical-stage cell therapy company transitioning from Phase 2 into a pivotal program at a single CDMO site.
| Field | Entry |
|---|---|
| Scope | Acme Therapeutics, autologous CAR-T program, single CDMO manufacturing site, Phase 2 moving into a pivotal trial |
| Phase-appropriate rigor applied | Row 2: pivotal trial / registration. Comparability protocol scoped before the site’s first batch supporting the pivotal trial; potency and identity methods validated, not just verified |
| Tier 1 system example | Chromatography data system generating release results. Full CSV, data integrity risk assessment, 12-month periodic review |
| Tier 3 example, excluded | An uncontrolled spreadsheet used only to schedule internal team meetings. GxP-impact test fails; excluded with rationale recorded here rather than omitted |
| Lifecycle mapping | Stage 2 / performance qualification: three-batch PPQ campaign, traditional process validation approach, justified by limited manufacturing history at this scale and the absence of continuous monitoring infrastructure mature enough to support a continuous verification approach yet |
| Periodic review trigger exercised | The VMP’s next scheduled 24-month review was pulled forward by six months when the program moved from Phase 2 into the pivotal trial, per the phase-change trigger in Section 8 |
Common inspection findings this plan prevents
- A VMP whose stated scope does not match the current system and process inventory when the two are compared line by line.
- Utilities, facility systems, or computerized systems excluded from scope with no recorded rationale.
- A VMP written at commercial-launch rigor for a Phase 1 program, or the reverse, a commercial program still running on clinical-stage rigor.
- Roles assigned by name rather than by function, going stale the first time someone changes teams.
- A reference list citing a superseded standard, PIC/S PI 006-3 after 1 October 2026 being the current example, because no periodic review trigger caught the transition.
- No periodic review history, so “current version” is ambiguous the moment an inspector asks.
How to adapt this plan
- Set your document number, site, phase, and modality in the header and Section 2.
- Run the GxP-impact test in Section 3 against your actual system inventory; do not copy a prior program’s list.
- State your phase-appropriate rigor in Section 4 and your risk tiers in Section 5 using the paired Validation Risk Classification Matrix template.
- Map your program to both lifecycle frameworks in Section 6, and state which validation approach applies to each major process.
- Confirm every reference in Section 10 against its current published version, including the PIC/S PI 006 number, before issue.