IQ, OQ and PQ

Installation qualification or installation verification testing

Documented verification that a system is installed according to written specifications for design and configuration.

IQ is the first phase of system testing is installation qualification (IQ), also referred to as installation verification testing. IQ should provide documented evidence that the computerized system, including software and associated hardware, is installed and configured in the intended system testing and production environments according to written specifications.

The IQ will verify, for example, that the computer hardware on which the software application is installed has the proper firmware and operating system; that all components are present and in the proper condition; and that each component is installed per the manufacturer or developer instructions.

IQ should include verification that configurable elements of the system are configured as specified.

Operational qualification or operational/functional verification testing

Documented verification that a system operates according to written operational specifications throughout specified operating ranges.

The OQ, or operational/functional verification resting, should provide documented evidence that the software and hardware function as intended throughout anticipated operating ranges.

Functional testing should include, based upon risk:

• an appropriate degree of challenge testing (such as boundary, range, limit, nonsense entry testing) to verify the system appropriately handles erroneous entries or erroneous use;
• verification that alarms are raised based upon alarm conditions;
• flags are raised to signal invalid or altered data.

Functional testing of hardware

• The extent of validation should depend on the complexity of the system. Appropriate tests and challenges to the hardware should be performed as part of validation.
• Hardware is considered to be equipment and the focus should be on location, maintenance and calibration of hardware, as well as on qualification.
• The qualification of the hardware should prove:
  •  that the capacity of the hardware matches its assigned function (e.g. foreign language);
  •  that it operates within the operational limits (e.g. memory, connector ports, input ports);
  • that the hardware configuration settings are appropriate and meet user and functional requirements;
  • that it performs acceptably under challenging conditions (e.g. long hours, temperature extremes);
  • reproducibility/consistency.
•  Some of the hardware qualification may be performed by the computer vendor. However, the ultimate responsibility for the suitability of equipment used remains with the company.
• Qualification protocols, reports (including data) should be kept by the company for the hardware in its configured state. When qualification information is produced by an outside firm, e.g. computer vendor, the records should be sufficiently complete (including general results and protocols) to allow the company to assess the adequacy of the qualification and verification activities. A mere certification of suitability from the vendor, for example, will be inadequate.

Functional testing of Software

•  Functional testing of software should provide assurance that computer programs (especially those that control critical activities in manufacturing and processing) will function consistently within pre-established limits for both normal conditions as well as under worst-case conditions (e.g. out-of-limit, out-of-range, alarm conditions).
• Functional testing, also known as “black box” testing, involves inputting normal and abnormal test cases; then, evaluating outputs against those expected. It can apply to computer software or to a total system (reference: CEFIC GMP).

Performance qualification or performance/requirements verification testing

Documented verification that a system is capable of performing or controlling the activities of the processes it is required to perform, according to written user requirements and specifications, in its intended business and computing environment.

The PQ should be conducted in the production environment or in a validation environment that is equivalent to the production environment in terms of overall software and hardware configuration.

PQ testing should also include, as applicable, an appropriate degree of stress/load/volume testing based upon the anticipated system use and performance requirements in the production environment.

In addition, an appropriate degree of end-to-end or regression testing of the system should be conducted to verify the system performs reliably when system components are integrated in the fully-configured system deployed in the production environment.
User acceptance testing should be conducted by system users to verify the adequacy of system use SOPs and data review SOP(s) and training programmes. The user acceptance testing should include verification of the ability to readily discern invalid and altered data, including the ability to efficiently review electronic data and metadata, such as audit trails.

IT system administrators should verify the adequacy of system administration SOP(s) and controls that will be routinely executed during normal operational use and administration of the system, including backup/restore and archival/retrieval processes.