Part 19

Initial qualification demonstrates that a facility, utility, equipment, or system is suitable for its defined intended use at the time qualification is completed.

The lifecycle responsibility does not end at GMP release.

Part 19 requires periodic review to consider:

Deviations → Breakdown History → Calibration History → Preventive Maintenance → Change Controls → CAPA → Alarm Trends → Critical Parameter Trends → Qualification Status → Software Changes → Audit-Trail Concerns → Data-Integrity Events → SOP Changes → Training Status → Recurring Failures → Obsolescence.

The purpose is to determine whether accumulated lifecycle evidence continues to support the qualified state and whether corrective action, additional investigation, change control, or requalification is necessary.

19.1 What Is Periodic Review?

Periodic review is a documented, systematic assessment of a qualified system’s lifecycle history and current condition.

It asks:

Does the totality of evidence accumulated since the previous qualification/review continue to support the conclusion that the system remains fit for its intended GMP use?

Periodic review should therefore not be reduced to:

“IQ/OQ/PQ documents are available — Status: Qualified.”

Instead, it should assess what has happened since qualification.

19.2 The Qualified State Is a Lifecycle Condition

A system may have passed IQ, OQ and PQ several years earlier.

Since then it may have experienced:

• hundreds of maintenance interventions;
• instrument drift;
• repeated alarms;
• component replacements;
• software updates;
• process changes;
• SOP revisions;
• deviations;
• CAPAs.

The key question becomes:

Does the current system remain adequately represented by the approved qualification evidence?

19.3 Lifecycle Model

The master source places routine operation within the following lifecycle:

Initial Requirements
        ↓
Risk Assessment
        ↓
DQ
        ↓
FAT / SAT
        ↓
IQ
        ↓
OQ
        ↓
PQ
        ↓
Qualification Summary
        ↓
QA / GMP Release
        ↓
ROUTINE OPERATION
        ↓
┌─────────────────────────────┐
│ Change Control              │
│ Calibration                 │
│ Preventive Maintenance      │
│ Monitoring                  │
│ Deviations                  │
│ CAPA                        │
└─────────────────────────────┘
        ↓
PERIODIC REVIEW
        ↓
Qualified State Assessment
        ↓
Requalification where required
        ↓
Continued GMP Operation

Periodic review is therefore one of the principal mechanisms connecting historical qualification with the current state of control.

19.4 Objectives of Periodic Review

A well-designed periodic review should determine whether:

• the system remains suitable for intended use;
• qualification remains valid;
• critical functions remain controlled;
• changes have been appropriately assessed;
• maintenance remains effective;
• calibration performance remains acceptable;
• recurring deviations exist;
• adverse trends are developing;
• software/configuration remains controlled;
• data-integrity concerns exist;
• SOPs remain current;
• personnel remain appropriately trained;
• requalification is required;
• obsolescence creates new risks.

19.5 Periodic Review Is Not the Same as Requalification

This distinction is important.

Periodic Review

Evaluates accumulated lifecycle evidence.

Requalification

Performs repeat verification/testing where justified.

Therefore:

Periodic Review
      ↓
Evidence Assessment
      ↓
Is Additional Qualification
Evidence Required?
    ┌─────┴─────┐
   NO          YES
    │            ↓
Continue      Define Risk-Based
Qualified    Requalification
State        Scope

As established in Part 18, requalification scope should be risk justified rather than automatically repeating every historical test.

19.6 Periodic Review Scope

The review should define:

• equipment/system;
• equipment ID;
• location;
• review period;
• previous review date;
• current qualification status;
• applicable computerized-system components;
• interfaces;
• associated critical instruments/utilities where relevant.

The review boundary should be clear enough to understand exactly what the final conclusion covers.

19.7 Review Period

The supplied source requires periodic review but does not prescribe a universal review frequency for every system.

Therefore, the interval should be established through the site’s approved pharmaceutical quality system based on factors such as:

• GMP criticality;
• system complexity;
• risk;
• historical performance;
• monitoring capability;
• regulatory/site requirements;
• qualification strategy.

A universal statement such as “every system must be reviewed annually” is not supported by the supplied source.

19.8 Core Periodic Review Model

A practical model is:

SYSTEM IDENTIFICATION
        ↓
Qualification Baseline
        ↓
Review Period
        ↓
Lifecycle Data Collection
        ↓
Trend Assessment
        ↓
Change / Configuration Review
        ↓
Risk Assessment
        ↓
Qualified-State Evaluation
        ↓
Actions / Requalification
        ↓
QA Disposition
        ↓
Continued Qualified State

19.9 Review Area 1 — Deviations

The master source specifically requires deviations to be reviewed.

Review:

• total deviations;
• critical/major/significant deviations according to site classification;
• qualification-related deviations;
• equipment-related deviations;
• recurring deviations;
• open deviations;
• repeated root causes;
• effectiveness of corrective actions.

The objective is not merely to count deviations.

Ask:

Do the deviations collectively indicate deterioration in the qualified state?

19.10 Deviation Trend Table

Numbers above are illustrative only.

19.11 Recurring Deviations

Three deviations may individually have acceptable investigations.

However, periodic review may reveal:

DEV-001 → Temperature drift
DEV-014 → Temperature drift
DEV-027 → Temperature drift
DEV-041 → Temperature drift

The review should ask whether these are genuinely independent events or evidence of a recurring/systemic problem.

This connects periodic review with CAPA and requalification.

19.12 Review Area 2 — Breakdown History

The source specifically requires review of breakdown history.

Assess:

• number of breakdowns;
• affected components;
• downtime;
• repeated failures;
• emergency maintenance;
• critical-component failures;
• breakdown-related deviations;
• post-maintenance qualification activities.

A rising breakdown frequency may indicate deterioration even when individual repairs were successful.

19.13 Breakdown Trend Example

Year / Review Period 1 → 2 breakdowns
Period 2              → 3 breakdowns
Period 3              → 7 breakdowns
Period 4              → 11 breakdowns

The question is not simply:

“Was each breakdown repaired?”

The periodic-review question is:

Why is equipment reliability deteriorating, and does this affect the qualified state?

19.14 Breakdown Review Table

This helps connect maintenance history to qualification impact.

19.15 Review Area 3 — Calibration History

The source specifically requires review of calibration history.

Evaluate:

• calibration completion;
• overdue calibration;
• out-of-tolerance results;
• as-found condition;
• adjustment frequency;
• calibration drift;
• repeated failures;
• instrument replacements;
• impact assessments.

The purpose is to understand whether critical measurements remain reliable.

19.16 Calibration Status vs Calibration Trend

A calibration program should not be reviewed only as:

100% calibration completed.

Consider:

Calibration 1 → 0.2% drift
Calibration 2 → 0.5% drift
Calibration 3 → 0.8% drift
Calibration 4 → 0.95% drift
Tolerance    → ±1.0%

All four events might individually remain within tolerance.

But the trend indicates progressive drift.

Periodic review should detect this pattern.

19.17 Out-of-Tolerance Instruments

Where an instrument was found outside acceptance limits, assess:

• instrument criticality;
• last known acceptable calibration;
• magnitude of error;
• process/product impact;
• associated investigation;
• CAPA;
• replacement/requalification.

Calibration is therefore part of the evidence supporting continued qualification.

19.18 Review Area 4 — Preventive Maintenance

The source specifically requires review of preventive-maintenance history.

Assess:

• PM completion;
• overdue PM;
• missed PM;
• recurring corrective maintenance;
• PM effectiveness;
• component replacement frequency;
• major maintenance;
• post-maintenance qualification.

The question is:

Is the maintenance program effectively preserving the condition assumed by qualification?

19.19 PM Effectiveness

Suppose preventive maintenance is completed 100% on schedule, but breakdowns continue to increase.

This suggests:

PM Compliance ≠ PM Effectiveness

Periodic review should evaluate whether:

• tasks are appropriate;
• frequencies are adequate;
• critical components are covered;
• predictive maintenance might be needed;
• equipment is approaching end of useful life.

19.20 Review Area 5 — Change Controls

The source specifically requires review of change controls.

Review:

• changes implemented during the period;
• qualification impact assessments;
• major changes;
• minor changes;
• temporary changes;
• software changes;
• component changes;
• utility changes;
• process changes;
• open changes;
• cumulative effect.

Part 17 established the required change-control lifecycle:

Change → GMP Impact → Risk Assessment → Qualification Impact → Required Testing → Documentation Update → Approval → Implementation → Verification → Closure.

19.21 Cumulative Change Review

This is particularly important.

Consider:

Original Qualified System
        ↓
Sensor Replacement
        ↓
HMI Upgrade
        ↓
PLC Logic Change
        ↓
Motor Replacement
        ↓
Operating Range Change
        ↓
Recipe Modification

Each change may have been individually justified.

Periodic review should ask:

Does the cumulative configuration remain adequately represented by the qualification baseline?

19.22 Change Summary Table

The actual classification terminology should follow the site’s PQS.

19.23 Review Area 6 — CAPA

The master source specifically requires CAPA review.

Evaluate:

• CAPAs associated with the system;
• overdue CAPAs;
• recurring CAPAs;
• CAPA effectiveness;
• CAPAs involving design modification;
• CAPAs affecting qualification;
• repeated root causes despite CAPA closure.

A CAPA may be administratively closed but still ineffective.

19.24 CAPA Effectiveness

Example:

Failure
  ↓
CAPA: Retrain Operator
  ↓
Failure Repeats
  ↓
CAPA: Retrain Operator Again
  ↓
Failure Repeats

Periodic review should question whether training was actually the appropriate systemic corrective action.

Repeated events may indicate:

• design weakness;
• inadequate procedure;
• maintenance problem;
• automation issue;
• qualification gap.

19.25 Review Area 7 — Alarm Trends

The source explicitly requires review of alarm trends.

For applicable automated systems, review:

• alarm frequency;
• recurring alarms;
• critical alarms;
• alarm duration;
• repeated acknowledgments;
• nuisance alarms;
• alarm-related deviations;
• alarm suppression/configuration changes.

The source does not prescribe a particular alarm-management standard or numerical alarm threshold in Part 19, so site-specific criteria should be used.

19.26 Alarm Trend Example

An increasing alarm frequency may reveal deterioration before complete equipment failure.

19.27 Alarm Flooding and Repeated Acknowledgment

Where applicable, repeated alarms may indicate:

• poor alarm configuration;
• sensor instability;
• process instability;
• equipment deterioration;
• operator workaround.

Periodic review should not merely confirm that alarms exist; it should assess whether alarm history reveals loss of control.

19.28 Review Area 8 — Critical Parameter Trends

The source specifically requires review of critical parameter trends.

Examples may include:

• temperature;
• pressure;
• differential pressure;
• flow;
• speed;
• compression force;
• humidity;
• conductivity;
• TOC where applicable.

The actual parameters depend on the system and intended use.

19.29 Trend Within Limits Can Still Matter

Consider:

Period 1 → 40
Period 2 → 43
Period 3 → 46
Period 4 → 49
Upper Limit → 50

Every result may technically be within the specified limit.

But the trend is approaching the limit.

Periodic review should therefore consider both:

Compliance with limits

and

Direction of performance

19.30 Review Area 9 — Qualification Status

The source explicitly requires review of qualification status.

Confirm:

• original qualification status;
• latest requalification;
• outstanding qualification actions;
• qualification deviations;
• restrictions;
• changes since qualification;
• current configuration;
• overdue requalification if applicable.

The central question:

Is the current system still supported by the qualification evidence?

19.31 Qualification Baseline vs Current State

A useful comparison:

This helps demonstrate configuration control.

19.32 Review Area 10 — Software Changes

The source specifically requires review of software changes.

For applicable computerized/automated systems, assess:

• PLC changes;
• HMI changes;
• SCADA changes;
• firmware;
• operating-system changes where relevant;
• application upgrades;
• configuration changes;
• interfaces;
• security changes;
• user-role changes.

Part 20 of the source requires computerized-system controls to be considered based on applicability and risk.

19.33 Software Version Reconciliation

A periodic review should be able to answer:

What software/configuration was originally qualified?

What is installed now?

Which change controls explain the difference?

What qualification/regression evidence supports the current version?

Example:

19.34 Review Area 11 — Audit-Trail Concerns

The source specifically identifies audit-trail concerns as a periodic-review consideration.

Where audit trails are applicable, review concerns such as:

• unexpected configuration changes;
• unauthorized changes;
• repeated deletion attempts;
• inappropriate administrative activity;
• unexplained time/date changes;
• unusual recipe modifications;
• critical parameter changes.

The source does not specify universal audit-trail review frequencies or algorithms here; those should follow applicable procedures and system risk.

19.35 Audit-Trail Concern vs Audit-Trail Function

Periodic review is not necessarily a repeat of the original OQ audit-trail test.

Instead:

Qualification asks:

Does the audit-trail functionality work as intended?

Periodic review asks:

Has lifecycle use of the system revealed concerns affecting the state of control?

These are complementary questions.

19.36 Review Area 12 — Data-Integrity Events

The source specifically requires review of data-integrity events.

Potential considerations include:

• missing records;
• incomplete records;
• unauthorized modification;
• access-control issues;
• backup failure;
• restore failure;
• interface failures;
• incorrect timestamps;
• unexplained data discrepancies.

Where such events occur, assess whether they indicate deficiencies in the qualified computerized functions.

19.37 Data-Integrity Event Example

Suppose a SCADA system experiences repeated:

Loss of communication resulting in missing process records.

The periodic review should not only count the deviations.

It should assess:

Communication Failure
        ↓
Missing Data
        ↓
Repeated Events
        ↓
System/Network Assessment
        ↓
Qualification Impact
        ↓
CAPA / Change
        ↓
Regression / Requalification
where required

19.38 Review Area 13 — SOP Changes

The source specifically requires review of SOP changes.

Relevant SOPs may include those identified elsewhere in the source:

• operation;
• cleaning;
• setup/changeover;
• preventive maintenance;
• calibration;
• breakdown handling;
• alarm response;
• access management;
• backup/restore;
• audit-trail review;
• data handling;
• recipe management;
• logbooks;
• change control.

19.39 SOP Change Impact

Ask:

• Did operating instructions change?
• Did critical parameter limits change?
• Did cleaning practices change?
• Did alarm response change?
• Did access-management practices change?
• Did recipe management change?
• Does the qualification basis remain aligned with current procedures?

Procedures and qualification should describe compatible states of operation.

19.40 Review Area 14 — Training Status

The source specifically requires review of training status.

Assess as applicable:

• operators;
• maintenance personnel;
• engineers;
• automation personnel;
• system administrators;
• QA reviewers.

Review:

• current training;
• overdue training;
• training following SOP changes;
• training following software changes;
• training following major equipment modifications.

19.41 Training and Qualified State

Qualification can demonstrate that a system is capable of correct operation.

Training helps ensure personnel operate that system within the intended controls.

Therefore:

Qualified Equipment
        +
Approved Procedures
        +
Trained Personnel
        =
Controlled Routine Operation

Training status is consequently relevant to lifecycle review.

19.42 Review Area 15 — Recurring Failures

The source specifically requires review of recurring failures.

Recurring failures may be found across:

• deviations;
• breakdowns;
• calibration;
• alarms;
• maintenance;
• CAPA.

The review should therefore look across systems rather than treating each database independently.

19.43 Cross-System Trend Review

Example:

Calibration Database
      ↓
Repeated Sensor Drift
      +
Maintenance Database
      ↓
Repeated Sensor Replacement
      +
Deviation Database
      ↓
Temperature Excursions
      +
Alarm History
      ↓
High Temperature Alarms
      ↓
COMMON SYSTEMIC SIGNAL

A periodic review is valuable because it brings these otherwise separate signals together.

19.44 Review Area 16 — Obsolescence

The source specifically requires review of obsolescence.

Potential areas include:

• equipment components;
• PLC hardware;
• HMI;
• SCADA;
• operating systems;
• firmware;
• spare parts;
• vendor support;
• instruments;
• communication protocols.

Obsolescence does not automatically mean the system is unqualified.

It may, however, create increasing lifecycle risk.

19.45 Obsolescence Risk

Example:

PLC model is no longer supported.

Potential consequences:

• spare parts unavailable;
• cybersecurity/security updates unavailable;
• replacement requires major modification;
• recovery after failure becomes difficult;
• vendor support unavailable.

Periodic review should identify such risks before an emergency occurs.

19.46 Obsolescence Assessment Table

Risk categories should follow the site’s approved methodology.

19.47 Integrated Periodic Review Dashboard

A practical dashboard can summarize:

This dashboard is a practical expansion of the source-required review topics rather than a mandated format.

19.48 Trend Classification

A site may use categories such as:

Improving / Stable / Deteriorating

or:

Green / Amber / Red

However, the supplied source does not prescribe a particular scoring method.

Any classification should have:

• defined criteria;
• consistent application;
• documented rationale;
• appropriate escalation.

19.49 Periodic Review Should Evaluate Interactions

One of the most important principles is:

Do not assess lifecycle records only in isolation.

For example:

More Breakdowns
      +
More Alarms
      +
Calibration Drift
      +
Repeated Deviations
      ↓
Possible Equipment Deterioration

Individually, each category may appear manageable.

Collectively, they may challenge the continued qualified state.

19.50 Periodic Review and Risk Assessment

Where significant changes or trends are identified, update or revisit risk assessment as appropriate.

Ask:

• Have new failure modes emerged?
• Has occurrence increased?
• Are existing controls effective?
• Have detection mechanisms changed?
• Has residual risk increased?
• Is additional qualification required?

The source’s qualification framework consistently uses risk assessment to determine testing scope and qualification decisions.

19.51 Periodic Review and Requalification Decision

A practical decision model:

Periodic Review Complete
        ↓
Any Significant Deterioration,
Change or New Risk?
      ┌────┴────┐
     NO        YES
      │          ↓
Continue     Assess Qualified-
Qualified    State Impact
State            ↓
            Existing Evidence
            Still Adequate?
             ┌────┴────┐
            YES       NO/PARTIAL
             │          ↓
         Document     Define
         Rationale    Requalification
                         ↓
                      Execute
                         ↓
                    Reassess State

19.52 Possible Periodic Review Conclusions

A practical review may conclude:

1. Qualified State Maintained

No significant concerns identified.

2. Qualified State Maintained — Actions Required

Qualification remains supported, but defined lifecycle improvements are required.

3. Qualified With Restrictions

Continued operation requires documented limitations.

4. Requalification Required

Additional evidence is required.

5. Qualified State Cannot Be Confirmed

Significant unresolved issues prevent a supported conclusion.

The exact terminology should follow the site’s PQS.

19.53 Open Actions

Not every periodic-review action necessarily prevents continued operation.

Examples:

• update obsolete spare-parts list;
• optimize PM frequency;
• schedule noncritical upgrade.

But every open action should have:

• description;
• rationale;
• owner;
• due date;
• GMP impact;
• qualification impact;
• status.

Critical unresolved issues should not simply be transferred to an action list to allow administrative closure.

19.54 Periodic Review Summary Report Structure

A practical report can contain:

1. Document Control
2. Objective
3. Scope
4. System Identification
5. Review Period
6. Qualification Baseline
7. Deviations
8. Breakdown History
9. Calibration History
10. Preventive Maintenance
11. Change Controls
12. CAPA
13. Alarm Trends
14. Critical Parameter Trends
15. Qualification Status
16. Software Changes
17. Audit-Trail Concerns
18. Data-Integrity Events
19. SOP Changes
20. Training Status
21. Recurring Failures
22. Obsolescence
23. Risk Assessment
24. Requalification Assessment
25. Open Actions
26. Overall Conclusion
27. QA Disposition
28. Approval

This structure directly incorporates the review areas required by the source.

19.55 Periodic Review Objective — Example

The objective of this periodic review is to assess lifecycle information generated during the defined review period and determine whether the accumulated evidence continues to support the qualified state and intended GMP use of the identified equipment/system.

19.56 Periodic Review Scope — Example

This review covers qualification status, deviations, breakdowns, calibration, preventive maintenance, change controls, CAPAs, alarm and critical-parameter trends, applicable software changes, data-integrity concerns, SOP/training status, recurring failures and obsolescence for the defined review period.

19.57 Qualification Baseline

Before reviewing lifecycle events, establish the baseline.

Include:

• original qualification report;
• latest requalification;
• qualified operating range;
• approved configuration;
• software version where applicable;
• restrictions;
• critical instruments;
• current intended use.

Without a baseline, it is difficult to determine whether the current system has materially changed.

19.58 Periodic Review Data Sources

Depending on system applicability, evidence may come from:

• qualification records;
• deviation system;
• change-control system;
• CAPA system;
• maintenance system;
• calibration system;
• alarm history;
• trend reports;
• training system;
• SOP/document-control system;
• software/configuration records;
• audit-trail/data-integrity investigations.

The review should identify the actual source records examined.

19.59 Data Cut-Off

Define the review period clearly.

Example:

Review Period: 01 January 2025 to 31 December 2025.

This prevents ambiguity regarding which events were included.

Any significant event occurring after the cut-off but before report approval may need handling according to site procedure and risk.

19.60 Evidence-Based Statements

Avoid unsupported conclusions such as:

“Equipment performance is satisfactory.”

Instead write:

“Review of the defined lifecycle records identified no unresolved qualification-impacting events during the review period, and the available evidence supports continued qualified status.”

The exact statement must match the actual evidence.

19.61 Periodic Review Checklist

A. System Identification

• □ Equipment/system name verified
• □ Equipment ID verified
• □ Location verified
• □ Intended use reviewed
• □ Current configuration identified
• □ Current software version identified where applicable

B. Qualification

• □ Original qualification reviewed
• □ Latest requalification reviewed
• □ Qualification status current
• □ Qualified operating ranges confirmed
• □ Restrictions reviewed
• □ Open qualification actions reviewed

C. Deviations

• □ Deviations reviewed
• □ Significant deviations assessed
• □ Recurring deviations identified
• □ Open deviations assessed
• □ Qualification impact reviewed

D. Breakdown History

• □ Breakdown records reviewed
• □ Repeated failures identified
• □ Major maintenance assessed
• □ Qualification impact reviewed

E. Calibration

• □ Calibration status reviewed
• □ Overdue calibration assessed
• □ Out-of-tolerance events reviewed
• □ Drift trends reviewed
• □ Critical-instrument replacements assessed

F. Preventive Maintenance

• □ PM completion reviewed
• □ Overdue PM assessed
• □ PM effectiveness reviewed
• □ Repeated corrective maintenance assessed

G. Change Control

• □ All applicable changes reviewed
• □ Qualification impact documented
• □ Software changes reviewed
• □ Configuration changes reviewed
• □ Cumulative changes assessed
• □ Open changes reviewed

H. CAPA

• □ CAPAs reviewed
• □ Overdue CAPAs assessed
• □ Effectiveness reviewed
• □ Repeated CAPA themes identified

I. Alarms

• □ Critical alarms reviewed
• □ Alarm frequency assessed
• □ Recurring alarms identified
• □ Adverse trends assessed

J. Critical Parameters

• □ Critical parameter data reviewed
• □ Adverse trends identified
• □ Operation remains within qualified range
• □ Emerging drift assessed

K. Computerized-System Considerations

• □ Software version reviewed
• □ PLC/HMI/SCADA changes reviewed
• □ Access-control concerns reviewed
• □ Audit-trail concerns reviewed
• □ Electronic-record concerns reviewed
• □ Backup/restore events reviewed where applicable
• □ Interface issues reviewed where applicable

L. Data Integrity

• □ Data-integrity events reviewed
• □ Missing/incomplete records assessed
• □ Unauthorized changes assessed
• □ Qualification impact evaluated

M. SOPs

• □ Relevant SOPs current
• □ Significant SOP changes reviewed
• □ Qualification impact assessed

N. Training

• □ Required training current
• □ Training after changes completed
• □ Training gaps assessed

O. Recurring Failures

• □ Cross-system trends reviewed
• □ Repeated root causes identified
• □ CAPA/requalification need assessed

P. Obsolescence

• □ Hardware obsolescence reviewed
• □ Software obsolescence reviewed
• □ Vendor support reviewed
• □ Spare availability reviewed
• □ Lifecycle risk assessed

Q. Final Assessment

• □ Current qualified state assessed
• □ Residual risks evaluated
• □ Requalification need determined
• □ Actions assigned
• □ QA disposition documented

This checklist directly operationalizes the review topics required by the source.

19.62 Periodic Review Summary Table

19.63 Example — Tablet Compression Machine Periodic Review

Consider the tablet compression machine used throughout this handbook.

The original qualification demonstrated functions including:

• compression force;
• pre-compression force;
• turret speed;
• fill depth;
• feeder operation;
• guards;
• interlocks;
• emergency stop;
• reject mechanisms;
• alarms;
• recipe management;
• user access;
• audit trail;
• electronic records;
• power-failure/recovery;
• backup where applicable.

Periodic review should determine whether lifecycle history continues to support those critical functions.

19.64 Example Findings

Suppose the review identifies:

• 14 equipment deviations;
• 9 breakdowns;
• 3 repeated feeder-motor failures;
• all calibrations completed;
• one critical load cell showed increasing drift;
• 6 change controls;
• one PLC modification;
• one HMI upgrade;
• repeated high-motor-load alarms;
• no identified data-integrity event;
• SOPs current;
• training current;
• feeder drive becoming obsolete.

The correct conclusion should not simply be:

“All calibration and PM completed — qualified.”

The combined evidence requires assessment.

19.65 Example Integrated Assessment

The review could identify the following relationship:

Repeated Feeder Motor Failure
        +
High Motor Load Alarms
        +
Increasing Maintenance
        +
Component Obsolescence
        ↓
Potential Reliability Concern
        ↓
Engineering Investigation
        ↓
Risk Assessment
        ↓
CAPA / Change Control
        ↓
Targeted Requalification
if required

This illustrates the value of integrating lifecycle data.

19.66 Example — Stable System

Conversely, a review may find:

• no significant recurring deviations;
• low stable breakdown frequency;
• acceptable calibration performance;
• PM completed;
• changes appropriately qualified;
• no adverse alarm trends;
• critical parameters stable;
• software configuration controlled;
• no significant data-integrity concerns;
• SOPs/training current;
• no significant obsolescence risk.

In that case, the available evidence may support continued qualified status without additional requalification testing.

19.67 Periodic Review Conclusion Example

Based on review of the qualification status and applicable lifecycle records for the defined review period, including deviations, breakdowns, calibration, preventive maintenance, change controls, CAPAs, alarm and critical-parameter trends, software/configuration changes, data-integrity concerns, SOPs, training, recurring failures and obsolescence, the available evidence supports continued qualified status subject to the actions and restrictions, if any, identified in this report.

The conclusion must be adapted to the actual findings.

19.68 Example — Requalification Required

Where evidence identifies uncertainty:

The review identified recurring failures affecting a critical function and an adverse associated alarm trend. Existing qualification evidence does not, by itself, adequately resolve the current concern. A documented risk assessment and targeted requalification are therefore required before confirming continued qualification of the affected function.

Again, the actual disposition should follow the site’s approved PQS.

19.69 Periodic Review Approval

A practical approval matrix may include:

Actual responsibilities depend on the company’s PQS, consistent with the source’s RACI principle.

19.70 Inspector Perspective — “How Do You Know the Equipment Is Still Qualified?”

This is one of the central lifecycle questions anticipated by the source.

A defensible evidence chain is:

Original Qualification → Routine Monitoring → Calibration → Maintenance → Deviations → Change Controls → CAPA → Trends → Periodic Review → Requalification where required → Current Qualification Status

This is much stronger than presenting a five-year-old OQ report alone.

19.71 Inspector Perspective — “Show Me Changes Since Qualification”

A strong periodic review should provide an efficient route to:

Change → Qualification Impact → Risk → Verification → Updated Configuration → Current Status

If the current system differs substantially from the originally qualified system but the differences cannot be traced, the qualification basis becomes difficult to defend.

19.72 Inspector Perspective — “What Trends Do You Review?”

The source itself provides the core answer:

• deviations;
• breakdowns;
• calibration;
• PM;
• change controls;
• CAPA;
• alarms;
• critical parameters;
• qualification status;
• software changes;
• audit-trail concerns;
• data-integrity events;
• SOPs;
• training;
• recurring failures;
• obsolescence.

The specific metrics and thresholds should reflect the system and site procedures.

19.73 Inspector Perspective — “What Did Your Last Periodic Review Find?”

The organization should be able to explain:

1. what records were reviewed;
2. what trends were identified;
3. what risks were found;
4. what actions resulted;
5. whether requalification was required;
6. how the qualified-state conclusion was reached.

The periodic review should therefore be a decision-making document, not simply a checklist-completion exercise.

19.74 Common Periodic Review Deficiencies

19.75 Periodic Review Maturity Model

Level 1 — Administrative

Documents exist and dates are checked.

Level 2 — Compliance

Deviations, calibration and PM are reviewed.

Level 3 — Trend-Based

Historical performance and recurrence are analyzed.

Level 4 — Integrated

Changes, failures, alarms, calibration, CAPA and qualification are assessed together.

Level 5 — Lifecycle/Risk-Based

Emerging risks are detected early and used to drive maintenance, CAPA, change control and targeted requalification.

This maturity model is an explanatory framework, not terminology prescribed by the source.

19.76 Maintaining the Qualified State — Integrated Model

                  QUALIFIED STATE
                        │
        ┌───────────────┼───────────────┐
        ↓               ↓               ↓
   Calibration      Maintenance      Monitoring
        │               │               │
        └───────────────┼───────────────┘
                        ↓
                   Deviations
                        ↓
                 Investigation/CAPA
                        ↓
                  Change Control
                        ↓
                 Updated Verification
                        ↓
                  Periodic Review
                        ↓
               Qualified-State Decision
                        ↓
              Requalification if Needed
                        ↓
              CONTINUED QUALIFIED STATE

19.77 The Central Question

Every periodic review should eventually answer:

Does the current system—as it actually exists and operates today—remain supported by adequate qualification evidence?

Not:

“Was it once qualified?”

Not:

“Are the documents still in the archive?”

Not:

“Was PM completed?”

The decision should consider the total lifecycle evidence.

19.78 Golden Rule of Periodic Review

A qualified state is maintained by continued control, not by the age or continued existence of the original qualification documents.

A robust periodic-review program therefore integrates:

Qualification + Deviations + Maintenance + Calibration + Changes + CAPA + Monitoring + Trends + Software/Configuration + Data Integrity + SOPs + Training + Obsolescence

to determine:

Continued Qualification / Additional Action / Requalification / Restrictions

19.79 Part 19 — Key Takeaway

Part 19 of your master source requires periodic review to examine:

Deviations → Breakdown History → Calibration History → Preventive Maintenance → Change Controls → CAPA → Alarm Trends → Critical Parameter Trends → Qualification Status → Software Changes → Audit-Trail Concerns → Data-Integrity Events → SOP Changes → Training Status → Recurring Failures → Obsolescence.

The practical lifecycle becomes:

Qualified State → Routine Operation → Lifecycle Data → Trend Review → Configuration Assessment → Risk Evaluation → Periodic Review → Requalification Decision → QA Disposition → Continued Qualified State

The strongest qualification program is therefore capable of demonstrating both:

“The system was appropriately qualified before GMP use.”

and

“Lifecycle evidence continues to demonstrate that the current system remains fit for its intended GMP use.”

Next — Part 20: Computerized and Automated Systems Qualification

Part 20 moves into one of the most important modern qualification areas: PLC, HMI, SCADA and other computerized/automated GMP systems, including risk-based assessment of configuration, user roles, access controls, audit trails, electronic records, interfaces, backup/restore, time synchronization, retention, archiving, security and periodic review.

About the Author

Ramesh Palav is a pharmaceutical professional with 20+ years of industry experience in manufacturing, GMP, quality systems, validation, compliance, and operational excellence. Through Pharma Manufacturing Hub, he shares practical insights on pharmaceutical careers, manufacturing, quality, validation, Pharma 4.0, AI, and professional development.

His goal is to help students, freshers, experienced professionals, and career-break professionals build the knowledge and skills needed to succeed in the pharmaceutical industry.