How to Write a URS for a BIBO System in GMP and Biosafety Projects

A purchase order placed against a vague BIBO specification rarely causes problems the week it is signed. The problems surface during qualification — when the validation team asks for traceable FAT records that were never required, when the scan-test method turns out to be whatever the vendor defaulted to, and when the as-built package arrives incomplete six weeks before a regulatory inspection. By that point, rework is scheduled under pressure, and the root cause is almost always a User Requirements Specification that described an outcome rather than defined a deliverable. The difference between a URS that passes internal review quickly and a URS that actually protects the project is the degree to which every high-risk function is tied forward to a named verification activity with defined acceptance criteria. What follows is a structured framework for getting that specificity right before the purchase order leaves procurement.

Project risks a BIBO URS must control from the start

The most damaging URS failure mode does not show up during document review — it shows up at qualification. When a URS specifies only that a BIBO system must be “GMP-compliant” without naming the leak-test method or its acceptance criteria, that decision is not simply deferred. It is transferred to the vendor, who will fill the gap based on their standard practice, not the project’s containment requirement. By the time the qualification team discovers this, the test protocol is already drafted around whatever method the vendor chose, and revising it means revisiting risk assessments, potentially re-running tests, and justifying the change in the audit trail.

Defining the scan-test method and its acceptance criteria in the URS is, in practical terms, a procurement control mechanism. It prevents a containment-critical performance decision from being made by default rather than by deliberate engineering judgment. The URS is the only document with enough authority, at the right project stage, to bind that decision before the contract is signed.

In-situ disinfection capability is a second requirement that regularly gets treated as a vendor option rather than a URS clause. For biosafety-classified projects, the ability to decontaminate a filter housing before maintenance access is not incidental — it is a precondition for safe operation. Leaving this undefined means scope negotiations happen after commissioning, when options are limited and any add-on affects the validated state.

These two failure modes — undefined test criteria and unscoped disinfection requirements — represent the class of gap where silence in the URS has a real cost, and where the specification should do explicit control work before procurement.

The pattern in both rows of that mapping is the same: ambiguity that appears harmless during concept review becomes a qualification liability when traceability is required. The URS review should treat both items as non-negotiable scope inclusions before any commercial conversation begins.

Performance parameters that belong in the core requirement set

A URS that does not fix airflow, filtration class, and pressure drop before procurement gives the vendor meaningful latitude over the system’s core engineering design. That latitude is rarely exercised in the project’s favor.

Rated air volume should be specified as a discrete value rather than a range, selected against the facility’s actual process airflow conditions. Typical system configurations are designed around values such as 1,700, 3,400, and 5,100 m³/h, but these are design reference points, not regulatory thresholds — the correct value for any given installation must be confirmed against the specific process conditions before the URS is finalized. Leaving this as “to be determined during detailed design” is a scope-creep vector: equipment sized at a different airflow tier may require housing modifications, duct rerouting, or fan changes that fall outside the original contract.

The filtration class combination — typically a G4 pre-filter paired with an H14 HEPA filter — defines what the system must actually do from a containment standpoint. Stating this explicitly in the URS fixes the performance specification for downstream filter change-out procedures, differential pressure monitoring thresholds, and the acceptance criteria used in qualification testing. A URS that names only “HEPA filtration” without specifying filter class leaves the vendor free to supply a unit that meets a different efficiency tier, and leaves QA with no clear basis for acceptance.

Allowable pressure drop across the filter system — typically in the range of 200–300 mm water column for loaded conditions, though the applicable figure must be confirmed for each project — is a parameter that connects directly to fan sizing and energy performance. Specifying this in the URS prevents a common downstream problem: a system that operates within spec at FAT but shows pressure drop behavior that the facility’s ventilation controls were not designed to handle.

The prose description of why each parameter matters is less important than confirming that each one appears in the URS as a numbered requirement with a defined acceptance threshold — because that is the only form in which validation can trace it forward to a test record.

Materials, finishes, and bagging components that need defined acceptance criteria

When acceptance criteria for materials and components are absent from the URS, procurement evaluates suppliers on price and lead time rather than specification compliance. The result is not always a poor product — but it is consistently a product that QA cannot formally accept, because there is nothing to accept against.

Housing material is a straightforward example. A URS that specifies sprayed 304 stainless steel construction, with 316L available as an upgrade for more aggressive chemical environments, removes vendor discretion on a parameter that affects cleanability, corrosion resistance, and long-term surface integrity. Without that clause, two compliant proposals may arrive in completely different materials, and the project team is forced to make a materials engineering decision at vendor selection rather than at URS approval — the wrong stage, under commercial pressure.

Bag material and bag length present a less obvious but more operationally consequential gap. The change-out bag is the primary containment interface during filter removal. Its material properties — chemical compatibility, flexibility under field conditions — and its specified length determine whether a safe change-out procedure can actually be executed as designed. A bag length of 2,700 mm is a design figure from specific unit configurations rather than a universal specification, but the principle applies broadly: the URS must state a length, and that length must be confirmed against the actual unit geometry before the requirement is locked. A bag that is too short to seal safely before the filter is dislodged is a containment failure waiting for a maintenance cycle.

Gel sealing for HEPA filters is a sealing method that prevents bypass contamination at the filter frame interface. Specifying the sealing method in the URS means this detail is assessed at procurement, not discovered during an IQ inspection when the as-installed configuration needs to be verified against a requirement.

The shared implication across all three rows is that undefined acceptance criteria at the URS stage do not resolve themselves cleanly downstream — they convert into qualification ambiguity that the validation team is asked to resolve without the engineering authority to do so.

FAT, SAT, IQ, and OQ deliverables to name before purchase order release

One of the more reliable ways to predict a slow qualification is to read a URS that does not name any specific FAT or SAT deliverables. Without those requirements written into the contract, the vendor’s factory test is whatever their standard protocol covers — and their standard protocol was not written for this project’s qualification requirements.

Filter seal integrity testing is a clear example of a deliverable that must be explicitly named. It ties the core containment performance parameter — filter seal integrity — to a required verification activity with defined evidence. If the URS does not require seal integrity testing as a FAT deliverable, with specified test method and pass/fail criteria, the vendor has no contractual obligation to provide it. The FAT report may document pressure drop measurements and visual inspection results, but the qualification team will still need evidence of seal integrity — and at that point, the choices are to accept a gap or to run additional testing after delivery, under site conditions that are harder to control.

Specifying the internal drive locking arm verification as a factory test item illustrates a broader principle. A locking arm mechanism that ensures fluid seal engagement is a discrete mechanical function on a specific unit design — exactly the kind of detail that is assumed to be tested at the factory but rarely appears in a default FAT scope. If it is not named in the URS, it falls outside formal FAT coverage, and any field issue with that mechanism has no factory test record to reference. The URS is the instrument through which engineering defines what the factory test must cover; a named list of mechanical functions is more useful than a general requirement for “functional testing.”

Frameworks such as ASTM E2500-22 and EudraLex Volume 4 Annex 15 both support the principle that qualification deliverables should be defined upstream — before the system is designed and built to a specification that never required them. The practical application for BIBO procurement is straightforward: IQ, OQ, and SAT scopes should be drafted in parallel with the URS, so that the FAT requirements the URS places on the vendor are aligned with the evidence the qualification plan will later need.

For teams planning broader commissioning and qualification activities, the structured approach to inspection and testing — where verification activities are defined before equipment arrives — is directly relevant to how FAT and SAT evidence chains are built. Inspection and testing requirements that are integrated into the commissioning scope from the start are significantly easier to defend in an audit than test records assembled after the fact.

Documentation and traceability clauses vendors should not leave open

Vendors do not routinely provide as-built documentation without being contractually required to do so. This is not a criticism of vendor practice — it is a description of default scope. If the URS does not include an explicit as-built documentation clause, the project team will typically receive installation and operation manuals, perhaps a dimensional drawing set, and a CE declaration. What they will not receive, unless it was specified, is a traceable package showing final installed configuration, any field modifications, calibration records for instruments fitted to the system, and verified compliance against the design specification.

As-built drawings are a prerequisite for effective maintenance, for any future modification that touches the validated state, and for audit responses that require demonstrating the installed configuration matches what was qualified. Treating this as a deliverable that will arrive naturally at project close is one of the more common documentation assumptions that does not survive contact with reality.

A Certificate of Conformity issued on completion of installation and commissioning serves a different but related function. It is a formal declaration by the vendor that the installed system meets the agreed specification — and structuring it as a release-for-payment milestone converts it from an administrative document into a contractual closure mechanism. When payment release is tied to CoC issuance, the incentive structure for documentation completeness becomes much cleaner.

Instrument calibration records deserve specific mention because they surface repeatedly as a friction point in OQ preparation and regulatory inspection readiness. A URS that requires the vendor to provide calibration certificates for all instrumentation supplied with the system — with traceability to a national standard — removes a common gap that otherwise requires a post-installation calibration campaign. Writing this as a URS clause before purchase order release takes less effort than sourcing calibration records retroactively from a vendor who has moved on to the next project.

URS review checklist for engineering, QA, and biosafety alignment

A URS review that goes only to engineering and QA will miss biosafety requirements that are not instinctively captured in an equipment specification. The inverse is also true: a biosafety-led review may not surface the fabrication details that determine whether a requirement is actually verifiable. This is the alignment problem the URS review step must solve — not consensus on what is preferred, but confirmation that each discipline’s requirements are present in the document in a form that can be verified.

External flanges on all housing connections are an example of a detail that matters to engineering for installation access reasons and to biosafety for a different reason: keeping connection points outside the contaminated airflow path. Neither discipline is wrong to want this, and both would confirm its presence in a joint review. The risk is that a single-discipline review approves a URS that is silent on this point, the vendor supplies an internally connected configuration, and the field installation team discovers the problem when the ductwork is already positioned.

The requirement for a separate door and protective bag for each filter component — pre-filter and HEPA — is a biosafety-driven requirement with engineering and QA implications. It allows individual filter maintenance without disturbing the containment integrity of adjacent filter stages. A pre-filter that can be changed independently, under its own bag, without compromising the HEPA stage, materially reduces the risk profile of routine maintenance. This requirement should appear in the URS as a named functional requirement, not as an assumption that the vendor’s design will include it.

The practical use of a checklist review is to confirm that engineering, QA, and biosafety have each actively verified their domain requirements are present — before the URS is released for procurement. A signature on a review form is not the same as that confirmation. The review should be structured so that each discipline can point to a specific requirement clause for each item in their scope, and flag any item that exists only as an assumption. Requirements that live only in assumptions do not survive vendor proposals, field conditions, or audit questions.

Teams working toward a complete commissioning and qualification deliverable set will find that Qualia Bio’s commissioning services approach reflects this alignment logic directly — verification activities defined in sequence from URS through IQ and OQ, with documentation that can be traced at each stage.

The strongest argument for a detailed BIBO URS is not regulatory compliance — it is that a detailed URS is the only reliable way to prevent qualification rework under schedule pressure. Every undefined parameter in the URS eventually becomes a decision that someone else makes: the vendor, the commissioning engineer, or the validation team. The later that decision is made, the more expensive it is to revisit.

Before releasing a BIBO URS for procurement, the document should be able to answer three questions for every high-risk function: what is the acceptance criterion, what test will verify it, and what evidence will be delivered. If those questions cannot be answered for the scan-test method, the bag material specification, the as-built documentation clause, or the FAT deliverable list, the URS is not yet complete — and it is worth the internal friction to resolve that before the purchase order sets the project’s qualification baseline.

Frequently Asked Questions

Q: What if the project team is under schedule pressure and needs a shorter URS approved quickly — is a lean URS ever acceptable?
A: A shorter URS is acceptable only if every high-risk function still has a named acceptance criterion and a verification activity tied to it. The trade-off is real: a brief URS moves faster through internal approval but shifts unresolved decisions to the vendor, the commissioning engineer, or the validation team — each of whom will make those decisions later, under worse conditions. The cost is not visible at URS sign-off; it appears as qualification rework, retroactive test campaigns, or audit gaps when the project can least absorb them. If schedule pressure is the driver, prioritize completeness on the highest-risk items — scan-test method, bag specification, FAT deliverables, and as-built documentation — and document any deliberate deferral explicitly rather than leaving it as silence.

Q: Once the URS is approved and the purchase order is placed, what is the immediate next step to protect the qualification baseline?
A: The first action after PO placement is to confirm that the vendor’s FAT protocol reflects the specific deliverables named in the URS — before factory testing begins. A URS clause requiring seal integrity testing or locking arm verification has no practical effect if the vendor’s standard FAT template does not include it and no one checks before the test date. At the same time, the IQ and OQ protocol drafts should be actively compared against the URS requirement set to identify any verification activities that depend on evidence only the factory test can generate. Gaps found at this stage can still be closed by issuing a protocol review comment; gaps found after FAT completion require either a test waiver or a retest.

Q: Does this level of URS detail apply equally to a BIBO replacement on an existing validated system, or only to new installations?
A: For a like-for-like replacement on an existing validated system, some URS parameters — housing dimensions, airflow rate, filtration class — may already be fixed by the validated state and the change control record. However, the documentation and traceability clauses apply with equal or greater force: as-built drawings, calibration records, and a Certificate of Conformity are still required to close the change control and demonstrate that the installed replacement matches the approved specification. The scan-test method and acceptance criteria must also be confirmed, because a replacement unit from a different vendor may use a different default test approach. Treating a replacement project as lower-stakes on documentation is a common error that surfaces during post-change inspections.

Q: How does specifying a detailed URS compare to relying on a vendor’s proven standard product with an established qualification package?
A: A vendor’s standard qualification package documents what the vendor tested under their conditions — it does not document that the unit meets the project’s specific containment requirements, airflow targets, or site acceptance criteria. The two can align closely, but that alignment needs to be verified against the URS, not assumed. A vendor IQ/OQ package built around a standard product is a useful starting point and can reduce qualification workload significantly, but it requires a gap assessment against the project’s own requirement set. If the URS does not exist in sufficient detail to run that gap assessment, the project cannot confirm what the vendor’s package actually covers. The detailed URS is what makes the vendor’s documentation usable rather than decorative.

Q: At what point does a BIBO URS become over-specified — where additional detail creates more problems than it solves?
A: Over-specification becomes a genuine risk when the URS fixes parameters that should remain within the vendor’s engineering discretion — internal structural design, proprietary sealing geometry, or manufacturing tolerances that affect performance but fall outside the project’s ability to verify. A URS that specifies a bag length figure derived from one vendor’s unit geometry and then applies it as a universal requirement can eliminate compliant alternatives without a containment rationale. The practical boundary is whether a requirement is traceable to a measurable project risk: airflow rate, seal integrity method, bag change-out safety, and documentation deliverables all clear that threshold. Internal fabrication details that do not connect to a verification activity or a containment outcome generally should not appear as numbered requirements. The test is whether QA can write an acceptance criterion for the clause — if not, it likely belongs in a technical specification dialogue with the vendor rather than in the URS.