FDA 483 Citation 21 CFR 820.75: Process Validation Not Performed

"A process whose results cannot be fully verified by subsequent inspection and test has not been [adequately] validated according to established procedures." In fiscal year 2025 FDA investigators cited 21 CFR 820.75(a) with that wording 93 times on system-generated Form FDA 483s. Two related citations added more:

• "Procedures for monitoring and control of process parameters for a validated process have not been [adequately] established," cited 23 times under 820.75(b)

• "Process validation [activities] [results] have not been [documented] [approved] ...," cited 21 times under 820.75(a)

Process validation observations are serious because they question whether every unit made by the process is acceptable. If a seal, weld, bond, molding or sterilization process cannot be checked on every part, validation is the only evidence it works.

What the citations mean

Typical examples after "Specifically" include:

• A special process, such as sealing, welding, bonding, molding or cleaning, in use with no validation at all

• A validation protocol with no predefined acceptance criteria

• Installation, operational or performance qualification steps skipped or not documented

• Sample sizes with no statistical rationale

• Validation reports never approved, or approved without a date and signature

• Process parameters during production not monitored or recorded

• Equipment, materials or settings changed after validation without revalidation

What 21 CFR 820.75 required

Under the Quality System Regulation:

• 820.75(a): where the results of a process cannot be fully verified by subsequent inspection and test, the process had to be validated with a high degree of assurance and approved according to established procedures. Validation activities and results, including the date and signature of the individual approving the validation and, where appropriate, the major equipment validated, had to be documented.

• 820.75(b): procedures for monitoring and control of process parameters for validated processes, to ensure the specified requirements continue to be met. Validated processes had to be performed by qualified individuals, and monitoring and control methods and data, the date performed and, where appropriate, the individual performing the process or the major equipment used had to be documented.

• 820.75(c): when changes or process deviations occur, the process had to be reviewed and evaluated and revalidation performed where appropriate, with these activities documented.

What changed under QMSR

Under QMSR, in effect since February 2, 2026, the requirements come from ISO 13485:2016 clause 7.5.6, Validation of processes for production and service provision. It requires validation of any process where the resulting output cannot be or is not verified by subsequent monitoring or measurement, so that deficiencies become apparent only after the product is in use. The documented procedure must cover:

• Defined criteria for review and approval of the processes

• Equipment qualification and qualification of personnel

• Use of specific methods, procedures and acceptance criteria

• As appropriate, statistical techniques with rationale for sample sizes

• Requirements for records

• Revalidation, including criteria for revalidation

• Approval of changes to the processes

Clause 7.5.6 also requires validation of computer software used in production and service provision, and clause 7.5.7 adds specific requirements for sterilization and sterile barrier system processes. ISO 13485 is more explicit than the old regulation about statistical rationale for sample sizes and about criteria for revalidation, so many validation files need those added.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action. Validation work often takes longer than that, so your response must show a plan with dates.

Assess product risk first

For each unvalidated or poorly validated process cited, evaluate whether product already made or shipped could be affected. Describe interim controls you put in place, such as 100% inspection or additional testing, until validation is complete. If shipped product could be unsafe, evaluate the need for a field action.

Validate the cited processes

Write protocols with predefined acceptance criteria and statistical rationale, then execute installation qualification (IQ), operational qualification (OQ) and performance qualification (PQ) as appropriate. Give FDA the schedule and, where available, the completed reports.

Fix the validation system

• A validation procedure covering when validation is required, how protocols are written and approved, sampling rationale, IQ/OQ/PQ, reporting and revalidation

• A master validation plan or process inventory that lists every process, whether it is verified or validated, and its validation status

• Defined revalidation triggers, such as equipment changes, material changes, process deviations, trends and periodic review

• Monitoring and control of validated process parameters in production records

Look back across all processes

Build an inventory of every manufacturing process. For each one, decide whether it is fully verified or must be validated, and check the validation file. Report the number of processes reviewed and the plan for each gap.

What a compliant process validation procedure must contain

• Criteria to decide whether a process needs validation

• Responsibilities and approval requirements

• Protocol content, including acceptance criteria

• Equipment qualification (IQ) and process qualification (OQ, PQ)

• Statistical methods and sample size rationale

• Personnel qualification

• Reporting and approval with date and signature

• Monitoring and control of process parameters in production

• Revalidation criteria and change control

• Software validation for production software

• Records

Common mistakes in process validation responses

• Running a few good parts and calling it validation, with no criteria set in advance

• Validating only the processes named on the 483 instead of reviewing all processes

• Choosing sample sizes without any statistical basis

• Validating once and never monitoring the parameters afterward

• Overlooking changes to equipment, tooling or materials since the original validation

Example: how one response section might read

This illustrates structure only; your response must describe your own processes and facts.

Observation 5: A process whose results cannot be fully verified by subsequent inspection and test has not been adequately validated. Specifically, the pouch sealing process has no validation.

Response:

• Interim control: Effective on a stated date, every sealing lot is held until seal peel testing and dye penetration testing on samples meet criteria.

• Product assessment: Retained samples from lots sealed in the past 12 months were tested; all met seal strength and integrity requirements. Complaint history showed no seal-related complaints.

• Validation: An IQ/OQ/PQ protocol with predefined acceptance criteria and a statistical sample size rationale was approved on a stated date. IQ and OQ are complete; PQ on three consecutive production runs will finish by a stated date.

• Root cause: The firm had no process inventory and no criteria for deciding which processes require validation.

• Corrective action: A validation procedure and a master validation plan listing all 22 manufacturing processes were approved. Four additional processes requiring validation were identified, with dates for each.

• Verification: Validation status is now a management review input.

Frequently asked questions

How do we decide whether a process must be validated?

Ask whether the output can be fully verified by later inspection or test without destroying the product. If not, or if you choose not to verify every unit, the process must be validated. Seals, welds, bonds, sterilization, molding and cleaning are common examples.

What sample size should we use?

ISO 13485 requires statistical techniques with a rationale for sample sizes where appropriate. Sample size should come from the risk of the failure and the confidence and reliability levels you set, not from convenience.

When must we revalidate?

When changes or deviations could affect the process, including equipment, materials, settings, location or trends, and at periodic review intervals your procedure defines.

How A.P. Lyon documents help

A.P. Lyon's Medical Device Process Validation Procedure covers when validation is required, IQ/OQ/PQ, acceptance criteria, sampling and revalidation. The Validation Protocol and Report Procedure sets the format for protocols and reports, and the ISO 13485 Process Validation Procedure Bundle groups the validation documents together. Specific procedures are also available for software validation, injection mold validation, ethylene oxide sterilization and gamma sterilization.

Documents are editable Word and Excel files. They must be adapted to your processes, equipment and products, and validation itself must still be planned and executed by qualified people.

Next steps

• Assess risk to product already made with each process cited

• Put interim controls in place and validate the cited processes

• Inventory every process and close validation gaps on a schedule

• Respond within 15 business days with the validation plan and dates

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.