Most commissioning failures on BIBO systems are not discovered during qualification — they are imported into it. A unit that leaves the factory without a documented pressure hold, or arrives on site with no record of the bag-out sequence ever being exercised, becomes a problem precisely when the project has the least tolerance for it: during IQ/OQ, under deadline pressure, with the qualification team already engaged. Corrections that would have taken a half-day at the manufacturer’s facility now require partial decommissioning, protocol deviations, or retesting in place — each of which stretches closeout and creates documentation gaps that follow the system into its operational life. The judgment that matters most is deciding which checks are genuinely optional to defer and which ones, if skipped at FAT, transfer their risk entirely to the owner at the worst possible moment.
Critical FAT checks before the BIBO housing leaves the factory
FAT is the point in the project where corrections are cheapest and fastest. The problem is that most teams treat it as a mechanical fit-up review — confirming that welds look sound, dampers move freely, and hardware is present — rather than as an early simulation of the service scenarios the system will actually face. That framing feels thorough in the moment but defers the highest-consequence checks to a stage where rework carries real schedule and containment consequences.
The specific check most often skipped is leak integrity testing. The test pressure for the BIBO housing should be documented in the raw data — a figure of 2500 Pa, for example, is a concrete pass/fail criterion, not a verbal confirmation. A unit that passes a visual weld inspection but has not held pressure to its specified threshold has not been leak-tested; it has been looked at. The distinction matters because on-site discovery of a containment failure may require the housing to come back off the duct, be reworked, and be retested — all while the facility qualification schedule continues running.
The second check that gets deferred is the functional test of bag-out installation hardware and the changeout sequence. Vendors often describe this as something covered by standard factory practice, but unless the sequence was actually run — hardware engaged, bag attached and removed, all steps logged against the manual — there is no evidence it works as intended with the specific unit being shipped. The value of doing it at FAT is not documentation formality; it is that problems found in the factory are solved at the factory.
| FAT Check | Why It Matters | Evidence/Clarification |
|---|---|---|
| Leak integrity test at specified pressure | Prevents discovering containment issues on-site where corrections are slow and costly. | Confirm the test pressure (e.g., 2500 Pa) is documented in the raw data. |
| Functional test of optional bag-out installation hardware and sequence | Simulating real service sequences early identifies problems that would otherwise be found during qualification under project deadline pressure. | Confirm the test sequence follows the manual and is documented. |
After confirming the table entries are met, verify that the evidence for each check exists as a distinct document rather than a line notation on a general inspection sheet. The raw data and the protocol are both needed for turnover — one without the other creates friction at acceptance review.
SAT items that confirm installation matches design intent
Site acceptance testing answers a different question than FAT. FAT confirms the unit was built correctly; SAT confirms it was installed correctly. The gap between the two is where design intent most commonly breaks down — not because the unit was wrong, but because the interface connections were made differently than the design documents specified.
The checks that most directly confirm installation integrity are the ones that verify functional interfaces rather than physical presence. Compressed air lines, exhaust dampers, and optional components such as HEPA afterfilters should be verified not only for correct connection but for correct orientation, routing, and accessibility. A damper that is installed but not accessible for service, or an air line that is connected to the wrong port, is a design conformance failure that a visual walk-down may not catch if the reviewer is not working from the design drawings.
This is also the stage where EudraLex Annex 15 is most directly relevant as a process reference: installation qualification must confirm that the installed configuration matches what was designed and approved. That principle does not prescribe what connections to check on a BIBO system specifically, but it does establish the expectation that as-installed conditions are verified against design intent rather than assumed to match it. The SAT protocol should be structured around that comparison — design drawing against installed condition, line by line — so that any deviation is captured before OQ begins rather than discovered during operational testing.
One failure pattern to watch for: SAT is sometimes conducted by the installation contractor rather than the owner’s commissioning team, and the records reflect that the contractor confirmed their own work. Those records may be accurate, but they are not independent, and they may not reference the design documents the owner actually approved. If the SAT protocol was written by the vendor or installer and reviewed only internally, its defensibility during an audit is limited.
IQ evidence for materials, instruments, and approved documentation
Installation qualification produces the documentary foundation for everything that follows. If that foundation is incomplete, OQ results are difficult to defend, and closeout stalls while teams work backward to reconstruct evidence that should have been captured at the time of installation.
The most common IQ documentation gap is not missing test data — it is missing the context around test data. A calibration certificate with no traceability to the specific instrument used during the test, a wiring diagram that reflects the original design but not the as-built installation, or an installation checklist signed but not dated: each of these creates a question at acceptance review that the project team has to answer, usually under time pressure and without the people who did the original work still on site.
IQ should verify that the complete documentation package has been delivered and that each document is the approved version that matches the as-built system. That includes installation checklists, test records, wiring diagrams, and any certificates associated with materials or instruments used in the installation. EudraLex Annex 15 establishes the principle that installation qualification must produce documented evidence — not that it is sufficient to have done the work, but that the evidence of having done it correctly must exist and be traceable. The practical implication is that verbal confirmation from a vendor that something was tested per standard practice does not satisfy IQ requirements. What satisfies IQ is a signed protocol, calibrated instrument data, and a record that ties the result to the specific unit.
For BIBO systems specifically, instrument calibration records for any gauges used during pressure testing are particularly important to have in hand before IQ is closed. If the gauge used during the factory leak test was not calibrated, or its calibration certificate was not included in the turnover package, the test result is difficult to defend as valid evidence rather than a directional check.
OQ tests for airflow, alarms, leak integrity, and service functions
Operational qualification is where the system has to demonstrate that it performs correctly under its intended service conditions — not that it is installed correctly, but that it works. The distinction matters because a system can be perfectly installed and still fail OQ if its operational parameters were not verified in actual use.
The checks most commonly underspecified in OQ protocols for BIBO systems fall into four areas. Airflow verification should confirm that velocity profiles and directional flow across the filter face match the design specification, not just that airflow exists. Alarm verification should confirm that each alarm condition triggers the correct response and that the alarm is detectable from the operator’s working position — not just that the alarm circuit is wired. Leak integrity at OQ is a repeat of the factory test under installed conditions, and it should produce its own raw data record rather than relying on the FAT result as sufficient evidence. Service function verification should include executing the defined start-up and shut-down sequences in full, under the same conditions the system will face during normal operation.
ASTM E2500-22 is useful here as a testing framework reference: it supports the principle that verification activities should be defined in advance with acceptance criteria and that results should be documented against those criteria. That framework does not prescribe BIBO-specific pass/fail values, but it does establish the expectation that OQ is a defined and documented exercise rather than an informal walk-through. Where OQ protocols are vague on acceptance criteria — stating that airflow should be “adequate” rather than specifying a range — they create exactly the kind of ambiguity that becomes a problem at acceptance review.
One downstream consequence that is easy to miss: OQ results that rely on manual observation without calibrated measurement create a documentation problem later. If airflow was confirmed by feel or by an uncalibrated instrument, the OQ record may satisfy the local team but not the reviewing authority. Build calibrated measurement into the OQ protocol before execution, not after.
Operator rehearsal points often missed before handover
The bag-out procedure is the highest-stakes routine operation on a BIBO system, and it is almost always the least rehearsed before handover. In most commissioning sequences, the protocol is reviewed, the sequence is demonstrated by the commissioning engineer, and operators are shown where the hardware is. That is not rehearsal — it is observation.
The difference matters because the bag-out sequence requires coordination between physical steps, tool use, PPE management, and timing, all of which interact differently in the actual facility environment than they do in a demonstration. Operators working with site-specific PPE — which may restrict grip, visibility, or range of motion differently than the equipment used during factory testing — may find that the sequence is physically harder than it appeared, that a tool specified in the SOP does not fit comfortably in the working position, or that the timing assumptions built into the SOP do not hold under real conditions.
These are not hypothetical risks. The pattern that recurs in practice is that the first live filter change reveals procedural gaps that were not caught during commissioning because operators had never actually executed the sequence themselves. At that point, the system is in service, the commissioning team is gone, and corrections require an SOP revision, retraining, and sometimes a deviation report if the gap affected a change that was already completed.
The practical recommendation is to schedule at least one full rehearsal — using actual site PPE, the tools specified in the SOP, and the local timing assumptions — before handover sign-off. The rehearsal should be observed and any deviations from the written procedure captured while the commissioning team is still present to assess whether the SOP needs to be revised or the procedure needs to be adjusted. This is not a formal qualification step by default, but it is the check most directly connected to preventing errors during the first live use.
The BIBO installation procedures and commissioning guidelines provide useful reference for structuring the rehearsal sequence against the documented procedure, particularly for teams developing site SOPs from the unit’s operational manual.
Commissioning closeout package required for acceptance
Acceptance review is the point where commissioning evidence is evaluated against the standard it was supposed to meet. If the package contains conclusions without supporting data, it will be questioned. If it contains data without calibration records, the data will be questioned. If it contains signed protocols that reference acceptance criteria not met in the raw numbers, the entire closeout may stall while the project team reconstructs what actually happened.
The distinction between a complete turnover package and an incomplete one is usually not about missing test results — it is about missing evidence quality. A vendor statement that the unit passed the factory leak test is not the same as a signed protocol with the test pressure documented, the hold time recorded, and the gauge calibration certificate attached. The former is an assertion; the latter is defensible evidence. Where acceptance review involves a quality team, a regulatory body, or a client who did not witness the tests, only the latter survives scrutiny.
| Item to Include | Risk if Missing | What to Confirm in the Package |
|---|---|---|
| Raw evidence and calibrated data from all tests (e.g., leak test) | Acceptance is delayed or contested based on “standard practice” claims instead of documented evidence. | Data is from calibrated instruments and signed test protocols (e.g., leak test at 2500 Pa). |
| Installation checklists, test records, and wiring diagrams | Friction arises during turnover due to incomplete documentation for operational and compliance needs. | All documents are the approved versions and match the as-built system. |
The documents in the package should be cross-referenced to the as-built system, not just the original design. Wiring diagrams that show the designed configuration but not the installed one, or checklists that cover planned scope but not scope changes made during installation, create a mismatch that reviewers are likely to flag. The standard against which EudraLex Annex 15 evaluates qualification documentation is whether the evidence is complete and traceable — not whether work was done, but whether it can be demonstrated to have been done correctly.
For teams building their commissioning plan from the start, Qualia Bio’s commissioning services are structured around producing the kind of documented, calibrated evidence that supports defensible turnover — which matters most when the client’s quality team and the vendor’s definition of “complete” are not the same.
The most consequential decision in BIBO commissioning is not which tests to run — it is when to run them and what evidence to require. Checks deferred from FAT to site installation become qualification risks. Tests executed without calibrated instruments or signed protocols become acceptance disputes. Operator rehearsal deferred past handover becomes a live operational failure. Each of these is a known and preventable pattern, and each one follows from treating commissioning as a sequence of boxes to tick rather than a controlled process of evidence accumulation.
Before closing out any commissioning phase, the question to ask is whether the package you have would survive review by someone who was not present during the work. If the answer depends on context, verbal history, or trust in the vendor’s standard practice, the package is not complete. What survives review is calibrated data, signed protocols, approved documentation matched to the as-built system, and evidence that operators have executed the critical service sequence under realistic conditions.
Frequently Asked Questions
Q: What if the vendor insists their factory leak test was completed but cannot produce a signed protocol or gauge calibration certificate?
A: Reject it as insufficient IQ evidence. A verbal or informal confirmation of a leak test does not meet the documentation standard required for defensible turnover. What you need is a signed protocol with the test pressure and hold time recorded, and a calibration certificate tied to the specific instrument used — not a general statement that the test was performed per standard practice. If the vendor cannot provide this, the test needs to be repeated under documented conditions, ideally before the unit leaves the factory.
Q: At what point does deferring SAT to the installation contractor rather than the owner’s team become an audit risk?
A: It becomes a risk the moment the SAT records do not reference the design documents the owner approved. Contractor-generated SAT records may accurately reflect what was installed, but if they were written against the contractor’s internal checklist rather than the owner’s design drawings, they cannot demonstrate conformance to design intent — which is the specific requirement EudraLex Annex 15 establishes. If SAT has already been completed this way, the owner’s team should conduct an independent verification pass against the approved design documents and document it separately before OQ begins.
Q: Does a passing FAT leak test at 2500 Pa mean the leak integrity test can be skipped during OQ?
A: No. The FAT result documents factory condition; OQ leak integrity testing documents installed condition after handling, transport, and integration into the duct system. These are distinct states and require separate evidence. An OQ protocol that references the FAT result as sufficient without generating its own raw data record will be questioned at acceptance review, particularly if any interface connections were made or modified after dispatch.
Q: How should a team handle an OQ protocol that states airflow should be “adequate” rather than specifying a numerical acceptance range?
A: Revise the acceptance criterion before execution, not after. A vague qualifier like “adequate” cannot be passed or failed — it can only be interpreted, which means the OQ record will not survive scrutiny from a quality reviewer who was not present. Work back to the design specification to identify the velocity profile and directional flow values the system was designed to meet, document those as the acceptance criteria in the protocol, and confirm you have calibrated measurement equipment that can produce traceable results against those values.
Q: Is operator rehearsal with site PPE considered a formal qualification step that needs to appear in the closeout package?
A: Not by default, but the decision to exclude it from the package carries forward risk. If the rehearsal reveals that the written SOP cannot be followed as documented under real conditions — because of PPE restrictions, tool fit, or timing assumptions — that finding has to go somewhere. If it is not captured while the commissioning team is present, the first live filter change becomes the de facto test, and any resulting deviation report will reference a gap that was observable during commissioning but not recorded. At minimum, the rehearsal observation and any SOP adjustments made as a result should be documented and cross-referenced in the handover record.
