Equipment that passes a power-on check at the factory and then reveals valve sequencing faults, misfiring interlocks, or pressure cascade errors during site commissioning does not represent bad luck — it represents a FAT scope that stopped short of what the equipment actually needed to prove. The downstream cost of that gap is not abstract: site rework on containment equipment requires controlled conditions, decontamination steps, and often regulatory notification, all of which compress the commissioning schedule and can push qualification start dates by weeks. The decision that prevents most of that damage is not a more rigorous SAT — it is a more complete FAT, with a protocol approved before the visit and a clear agreement about what must close before the equipment leaves the building. Understanding where that boundary sits, and what evidence to request at each stage, is what allows buyers to make a defensible shipment decision rather than an optimistic one.
Factory checks for VHP, BIBO and isolator assemblies
Confirming that an isolator, BIBO housing, or VHP transfer unit is physically complete is a necessary starting point, but it is not a sufficient one. The meaningful factory checks are those that generate measurable pass/fail evidence against pre-agreed criteria — evidence that either closes a potential failure mode before shipment or flags it early enough for factory correction.
For containment equipment specifically, four verification activities carry the most downstream consequence if skipped. A containment performance test on an isolator or discharge system confirms that the containment boundary holds under representative conditions before the unit is loaded onto a truck. A pressure hold test or vacuum leak test applies measurable criteria to what would otherwise be a visual inspection: the assembly is either airtight or it is not, and the result is recorded against an agreed acceptance value. HEPA filter integrity testing, conducted within the framework of ISO 14644 and consistent with the GMP documentation requirements referenced in Annex 15, verifies that filtration performance meets specification before the unit is in a controlled area where remediation is far more complicated. Dimensional inspection using calibrated instruments may appear administrative, but mismatches between factory-recorded dimensions and site drawings create alignment problems that are genuinely expensive to correct once other trades have progressed.
| Test / Check | Verification Purpose | Risk if Not Performed |
|---|---|---|
| Containment Performance Test (e.g. ANFD discharge isolators) | Confirms containment integrity before shipment | Undetected leaks move to site, raising exposure risk |
| Pressure Hold Test (PHT) / Vacuum Leak Test (VLT) | Verifies airtight construction with measurable pass/fail criteria | Hidden leak paths discovered only during SAT, forcing rework |
| HEPA Filter Integrity Test | Demonstrates filter compliance with ISO 14644 and GMP | Regulatory non‑compliance; rework or replacement at site |
| Dimensional Inspection (calibrated instruments) | Confirms equipment fits the intended site footprint | Costly site‑fit modifications and alignment corrections |
The risk profile of each skipped check is different in kind, not just in degree. An undetected leak on a biosafety isolator moves from a factory correction to an operator exposure risk. A dimensional discrepancy moves from a drawing check to a structural modification. Framing these as optional confidence builders understates what they actually are: the last point in the project where correcting each failure class is relatively inexpensive.
Control sequence and alarm evidence buyers should witness
The FAT test that most often gets compressed under schedule pressure is the one that matters most for operator safety: witnessed execution of the control logic under fault conditions, not just under normal operation. Dry-run sequencing confirms that the PLC program exists; it does not confirm that the glove-off alarm triggers correctly, that the emergency stop halts the system in the correct sequence, or that opening a guard door forces the system into a defined safe state rather than continuing to cycle.
Witnessing these tests matters because the failure modes they catch are not visible in drawings or documentation reviews. A glove-off condition that fails to annunciate correctly, an interlock that acknowledges an open guard but does not interrupt the sequence, or an emergency stop that halts motors but leaves a pressurised line open — none of these defects appear in the as-built drawing package. They appear only when the test is run. Buyers who attend FAT but do not witness interlock transitions and alarm responses are, in practical terms, accepting those items on trust.
The trade-off is real: witnessing more test steps extends the factory visit and requires more buyer-side personnel time. That extension is only manageable if the test protocol is finalised and agreed before the visit, so that the factory team is not waiting for approval while the clock runs. Where safety system response-time measurement is included — applicable where a specific performance level is defined in the safety specification — that testing requires pre-agreed instrumentation and timing methodology that cannot be improvised on the day.
| Control Sequence / Alarm Test | What to Witness / Confirm | Potential Consequence if Not Witnessed |
|---|---|---|
| Glove‑off condition test | Safety alarm triggers and system enters safe state | Operator‑exposure risk if alarm logic is defective |
| Emergency stop test and reset procedure | Motors halt safely and system resets without fault | Safety incident on site; restart faults cause commissioning delays |
| Interlock condition test (guards opened) | System forces safe state without manual intervention | Latent interlock defects compromise operator safety |
| Critical alarm testing (tightening sensors, diverter, metal detection, etc.) | Each alarm setpoint and annunciation verified | Undetected sensor failure may go undiscovered until production |
| Control system testing (PLC logic, HMI, dry runs) | Automated sequences, displays and logic operate correctly before motor energization | Site debugging extends schedule; logic errors require re‑programming |
| Safety systems testing (individual devices and response‑time measurement) | Performance level (e.g. SIL/PL) and timing confirmed | Regulatory non‑compliance or reduced safety integrity |
Control logic defects that travel to site do not simply require a software correction. On containment equipment, diagnosing an interlock fault often requires the area to be cleared, access procedures to be followed, and any correction to be re-documented under change control. The cost multiple over factory rework is rarely less than three to one, and that estimate does not include qualification schedule impact.
Documentation review before equipment leaves the factory
Documentation deficiencies discovered at SAT or IQ are not minor administrative corrections. When the physical equipment does not match the revision-controlled drawings shipped with it, or when the manufacturing databook is missing material certifications for components that contact product or process air, the qualification team cannot proceed without resolving those gaps — which means re-engaging the supplier after the equipment is installed, under time pressure, and often with limited leverage.
The Annex 15 principle that documentation must reflect the as-built state before qualification proceeds sets the reference frame here: what leaves the factory is the baseline against which every subsequent qualification phase is measured. If that baseline is incomplete or mismatched at the point of shipment, the deficiency does not disappear — it either delays IQ or becomes a finding.
| Document / Record | What to Confirm | Risk if Incomplete or Incorrect |
|---|---|---|
| GA drawings, P&IDs, manufacturing databooks | Material traceability and core design documents included | Compliance gaps and missing baseline for future troubleshooting |
| As‑built drawings capturing FAT deviations | Red‑lined changes reflected in final revision | Discrepancies between physical equipment and documentation; maintenance and validation issues |
| Component nameplates vs. BOM and engineering drawings | Physical nameplates cross‑referenced to design records | Mismatched components cause spare‑part errors or compliance findings |
The highest-value documentation check during FAT is the red-line reconciliation: confirming that deviations identified and corrected during the FAT itself are captured in an updated drawing revision, not recorded only in the FAT report as a note. A FAT report that describes a valve repositioned during testing, with no corresponding update to the P&ID, creates a documentation state that will produce an IQ non-conformance. Catching it at the factory, while the original design team is still present, is substantially more efficient than catching it during IQ when the equipment is installed and the site team is working from the uncorrected drawing.
For more detail on the documentation baseline that should precede FAT attendance, the OEB4/OEB5 isolator documentation best practices guide covers the records that should be in place before qualification begins.
Protocol approval timing before FAT attendance
The most common reason FAT punch lists grow longer than they should is not poor manufacturing quality — it is late protocol approval. When QA comments on the FAT protocol arrive after the equipment is already assembled, two things happen simultaneously: the acceptance criteria may need revision to reflect what was actually built, and any acceptance criteria that require physical changes create retesting obligations that compress the time between FAT completion and planned ship date.
Scheduling FAT two to four weeks before the planned ship date is a practical planning criterion that exists to create a correction window. That window only works if the protocol is approved before FAT begins — not being reviewed during it. In practice, this means the supplier must issue the draft protocol early enough to absorb a meaningful comment cycle, and the buyer must treat protocol review as a project task with a deadline, not a background activity.
For virtual FAT, the coordination requirements are higher, not lower. Roles, communication channels, screen-sharing arrangements, and test-step handoff procedures need to be defined before the session starts, because the ability to pause and clarify is more limited than in-person, and re-running test steps across time zones is genuinely disruptive. Pre-approving the protocol and freezing the equipment design before the virtual session are not administrative preferences — they are the conditions under which a virtual FAT can generate reliable evidence.
The point at which acceptance criteria should be agreed is before the build is complete, not after it. Once the equipment is assembled, retrofitting acceptance criteria to match what was built may satisfy the protocol, but it removes the purpose of having had criteria in the first place. Agreeing criteria early — at URS stage or during design review — means the factory build targets are known, and the FAT protocol reflects genuine performance requirements rather than a post-hoc record of what was observed.
Punch-list items that should block shipment
Not every open FAT item has the same consequence at shipment. The practical distinction is between items that can only be verified on site — utility connections, pressure cascade balance, integration with building management systems — and items that reflect unresolved factory defects that the factory is best positioned to correct. Conflating those two categories, either by shipping with unresolved critical items or by holding shipment over genuine site-dependent commissioning points, creates unnecessary friction in both directions.
A well-managed punch list assigns each item a category, a responsible party, and either a closure target date or a documented agreement that the item transfers to SAT with defined acceptance criteria. The accountability function matters as much as the tracking function. An open punch-list item with no assigned owner and no agreed resolution path does not become anyone’s priority — it becomes a dispute when the site team encounters it during commissioning.
Items that should block shipment are those where the defect is factory-originating, where factory resources are required to resolve it, and where the risk of shipping without resolution includes operator safety, containment integrity, or qualification baseline validity. Valve sequencing errors, alarm logic faults, structural non-conformances, and documentation state mismatches fall into that category. Items that represent interface-dependent commissioning work — utility flow rates, final filter balancing, network integration — do not block shipment but do need to be formally recorded as SAT scope with agreed criteria.
The BIBO commissioning checklist covers the transition between FAT punch-list closure and SAT scope in more detail for bag-in bag-out systems specifically.
Shipment decision based on critical FAT closure
The shipment decision is the last point in the project at which the buyer holds meaningful leverage over the supplier. Once equipment leaves the factory, the supplier’s ability to correct physical defects requires either a site visit under controlled conditions or a return shipment — both of which are substantially more expensive than factory rework, and neither of which the supplier has a contractual incentive to prioritise quickly once payment terms are satisfied.
Releasing shipment with open critical items on the assumption that site commissioning will absorb them is a pattern that procurement schedules frequently encourage and that validation teams subsequently inherit. The practical consequence is a commissioning phase that begins with known defects, a site team using project time to diagnose problems that were already visible at FAT, and a qualification start that depends on resolving those problems under change control rather than under factory correction.
The defensible shipment-release practice — supported in principle by Annex 15’s requirement that unresolved items be formally tracked before the next qualification phase proceeds — is to require one of two conditions before releasing the unit: either documented closure evidence for every critical punch-list item, or a written agreement that explicitly classifies the item as site-dependent SAT scope, defines the acceptance criteria, and assigns responsibility. The key word is written. A verbal understanding that the site team will handle it does not create accountability; it creates an expectation gap that surfaces at exactly the wrong moment.
For VHP pass box and bag-in bag-out units where decontamination cycle performance and filter housing integrity are core to the containment function, releasing shipment with unresolved pressure integrity or cycle logic items effectively defers a containment qualification risk to site — where resolving it is more complex, more expensive, and more visible to regulators.
The shipment decision is where FAT evidence either holds or it doesn’t. A FAT that witnessed alarm response, confirmed interlock transitions, verified pressure integrity, and produced a complete documentation package generates a shipment release that a QA team can sign off on with confidence. A FAT that confirmed power-on status and visual completeness generates a shipment release that is, in practice, a transfer of unresolved risk to the site team.
Before attending FAT, the most productive step a buyer can take is to confirm that the protocol is approved, that acceptance criteria were set before the build was complete, and that the punch-list classification framework distinguishes factory-resolvable items from genuine site-dependent SAT scope. Those three conditions determine whether the FAT visit produces evidence or produces a schedule event — and that distinction matters far more to commissioning and qualification than the number of days the visit takes.
Frequently Asked Questions
Q: What happens if the FAT protocol has not been formally approved before the factory visit takes place?
A: The FAT visit will generate a schedule event rather than defensible evidence. Without a pre-approved protocol, acceptance criteria may be revised to match what was built rather than what was specified, test steps may be disputed on the day, and any QA comments that require physical corrections will compress the window between FAT completion and the planned ship date — potentially forcing a choice between holding shipment and releasing with open items.
Q: Is a virtual FAT sufficient for containment equipment such as isolators and BIBO systems, or does it require in-person witnessing?
A: A virtual FAT can generate reliable evidence, but only under stricter preconditions than an in-person visit. Roles, communication channels, screen-sharing arrangements, and test-step handoff procedures must be defined before the session starts, and the protocol must be fully approved in advance. The ability to pause, clarify, and re-run a step is more limited across time zones and remote setups, so any ambiguity in the protocol or equipment design that would be quickly resolved in person is likely to require a separate session — which carries real schedule cost.
Q: At what point in the project should acceptance criteria for FAT be defined?
A: Acceptance criteria should be agreed before the equipment build is complete, ideally at URS stage or during design review. Once the unit is assembled, setting criteria retrospectively to match what was built satisfies the protocol on paper but removes the purpose of having criteria at all. Early agreement means the factory build has defined performance targets, and the FAT protocol reflects genuine qualification requirements rather than a record of observed outcomes.
Q: How should a buyer decide whether to hold shipment or accept an open punch-list item as site-dependent SAT scope?
A: The deciding factor is whether factory resources are required to resolve the defect. Items where the fault is factory-originating — valve sequencing errors, alarm logic failures, pressure integrity non-conformances, documentation mismatches — should block shipment until closure evidence exists. Items that are genuinely interface-dependent, such as utility flow balancing or building management system integration, can transfer to SAT provided there is a written agreement that defines the acceptance criteria and assigns responsibility. A verbal understanding is not sufficient; without a written classification, the item has no owner and no resolution path at site.
Q: Does a thorough FAT reduce the scope of SAT, or do both need to remain fully independent?
A: A thorough FAT does not replace SAT, but it materially changes what SAT is validating. FAT closes factory-resolvable failure modes — containment integrity, alarm response, control logic, documentation state — so that SAT can focus on site-specific performance: utility connections, pressure cascade balance, integrated alarm routing, and installed filter performance under actual operating conditions. When FAT scope is compressed, SAT inherits both its own legitimate scope and the unresolved factory defects, which means the site team is diagnosing problems under change control rather than under factory correction, at a cost multiple that is rarely less than three to one.
