Installation Qualification for Containment Equipment: Drawings, Utilities, Calibration and As-Built Checks

Signing off an IQ package because equipment is bolted down, powered, and operating is one of the most common ways a containment qualification programme creates deferred risk. The downstream cost is not discovered during IQ itself—it surfaces during OQ when a sensor reading cannot be defended, during a regulatory inspection when an as-built drawing does not match the installed configuration, or during a failure investigation when the root cause cannot be separated from an undocumented field change made during installation. The judgment that resolves this is not procedural diligence in the abstract; it is enforcing a specific threshold: IQ is not approvable until every critical installed component is traced either to the approved design or to a formally accepted change. After reading this, you will be better placed to define what your IQ package must contain before functional testing begins, and where the coordination gaps most commonly cause IQ to be signed prematurely.

Installed configuration compared with approved design

The distinction between “installed” and “qualified” is not a semantic nuance—it determines whether your entire qualification sequence holds. An installed machine is physically present, connected, and capable of output. A qualified installation is one where the configuration has been verified against an approved design baseline, utilities have been confirmed to specification, and safety- and quality-critical components are confirmed present and correctly positioned. These are materially different states, and conflating them at the IQ stage invalidates everything that follows.

EudraLex Volume 4 Annex 15 grounds this in regulatory expectation: equipment must be qualified before it is used in production, and qualification requires documented evidence of conformance, not operational presence. ASTM E2500-25 supports the same principle from a science- and risk-based standpoint, requiring that systems be verified against their approved specifications before controlled use. Neither standard accepts powered operation as evidence of conformance.

The practical consequence for containment equipment is acute. An isolator or containment enclosure that is running but not verified against its approved drawing package may have a seal configuration, filter arrangement, or utility connection that diverges from what the URS described. If OQ proceeds on that basis, every pressure hold result, every airflow measurement, and every cycle test is documenting the performance of an unverified configuration—one that may not match what was engineered, procured, or approved.

The table below captures the core distinction between what typically exists at site handover and what IQ actually requires.

The risk of treating “installed” as “qualified” is not hypothetical. It means OQ can pass a system whose configuration has quietly diverged from the approved design—and that divergence only becomes visible when something fails and no one can agree on what the approved baseline actually was.

Drawings, materials and serial-number reconciliation

As-built verification is the mechanism that closes the gap between what was designed and what was installed. The scope of that verification is broader than most teams plan for at the start of a project: it covers equipment identity, drawings, wiring, piping, product-contact materials, and surface finishes. Missing any of these elements does not create a minor documentation gap—it breaks the traceability chain that IQ is intended to establish.

For containment equipment specifically, materials reconciliation carries additional weight. Seals, gaskets, and product-contact surface finishes in an isolator or high-containment enclosure are part of the containment claim. If the installed seal material cannot be traced to an approved material certificate, the claim that containment integrity meets design intent is not documentable. This is not a theoretical concern; seal material substitutions during manufacturing or installation do occur, and without IQ-level verification, they pass undetected into the qualification record.

Serial number reconciliation matters for a different reason: it establishes that the equipment physically present is the equipment that was tested at FAT, certified, and approved for delivery. A model-level match is not sufficient. If a component was swapped between FAT and site installation—even with equivalent specifications—that substitution needs to be documented and assessed, not assumed equivalent.

The verification scope for a typical containment equipment IQ draws from a consistent set of evidence types across these categories.

A signed as-built package with noted deviations is the deliverable that makes this section of IQ defensible. Redlined drawings that reflect the installed state, wiring check reports, and material certificates attached to the IQ appendix are not administrative overhead—they are the evidence that makes every subsequent OQ result interpretable. When as-built records are missing, incomplete, or held by a contractor who has already demobilised, IQ sign-off is being considered without the evidence that IQ exists to capture.

Utility and calibration evidence in the IQ package

Utilities and instrument calibration are the two areas where IQ packages most frequently carry silent, invalidating gaps. Both are verifiable at installation, both are straightforward to document, and both are routinely deferred or assumed rather than confirmed.

Utility verification is a structured check against the equipment specification and the approved utility qualification data for the facility. The parameters that matter—voltage and phase, compressed air pressure, dew point, oil content, vacuum capacity, water quality, and HVAC room conditions—are each confirmable with on-site measurement at the point of connection. The risk is not that utilities will be grossly wrong; it is that they will be close enough to pass casual inspection but outside the specification band that was used to design the equipment’s performance claims. An isolator designed for a specific compressed air quality operating on air supply that is technically within facility tolerance but outside the equipment’s own specification is a configuration problem that IQ is specifically designed to detect.

Calibration status is a harder line. An out-of-calibration instrument does not produce uncertain data—it produces data that cannot be defended as accurate at all. If an IQ package includes a pressure sensor whose calibration certificate expired before installation was completed, every reading from that sensor during OQ is technically unsupported. The qualification evidence is not weakened; it is invalidated and will require rework. EudraLex Annex 15 requires that critical instruments be identified and their calibration status confirmed as part of qualification. That requirement exists precisely because calibration status determines whether the measurement evidence is usable.

The instrument list in the IQ package should identify every critical sensor, reference its calibration certificate, confirm traceability to national standards, and confirm that no certificates are overdue at the time of IQ sign-off. This applies to supplier-installed instruments and to facility instruments that interface with the equipment.

For containment equipment with pressure monitoring, differential pressure sensors are particularly consequential. A negative-pressure containment zone depends on accurate, calibrated differential pressure measurement to demonstrate that the pressure cascade is maintained. An uncalibrated or out-of-range sensor in that configuration does not just create a documentation problem—it means the pressure cascade evidence that IQ was supposed to establish does not exist.

As-built deviations that affect containment claims

Deviations found during IQ execution are not failures of the process—they are what the process is designed to surface. The failure mode is when IQ is signed without engaging with deviations at all: a generic vendor checklist is completed, the equipment is present and running, and the IQ is approved without any documented as-built verification. This pattern is common enough to have a recognisable shape—a signed IQ with no redlined drawings, no serial number confirmation, no as-built material records, and no deviation log. It is difficult to defend in an inspection and impossible to use as a diagnostic baseline when something fails during OQ or later in service.

Annex 15 is explicit that qualification protocols must document any deviations encountered, discuss their possible impact, and record corrective or preventive actions where applicable. For containment equipment, the impact assessment is not optional—the question is whether the deviation affects the containment claim. A field routing change to a compressed air line may be trivial in many equipment contexts. On a containment isolator with validated pressure balancing, it may alter the pressure response in a way that affects OQ test validity. The IQ deviation record is where that assessment is made, documented, and either closed or escalated to a formal change.

The practical threshold is this: a deviation that affects a containment-critical component—seal geometry, filter housing configuration, pressure sensing point, exhaust path—cannot be closed in the IQ record with a note that it is “acceptable.” It requires an impact assessment that considers whether the approved design’s containment basis still applies to the installed configuration. If it does not, the approved design needs to be updated before OQ begins, or OQ will be testing a configuration that has no approved design basis.

This is the downstream consequence of treating IQ as a paperwork exercise. When OQ reveals an anomaly—a pressure hold that fails, an airflow measurement outside the expected range—the first question in the investigation is whether the installed configuration matches the approved design. If IQ was completed with a generic checklist and no as-built verification, that question cannot be answered without a physical reinspection, which may require disassembly, delays, and in some cases re-execution of IQ.

For teams procuring high-containment systems such as OEB4/OEB5 isolators, the containment claim is part of the product specification. An Ізолятор OEB4/OEB5 leaves the manufacturer with a defined configuration; the IQ is the record that the site installation preserved that configuration. A deviation from the approved configuration is not automatically a problem, but it must be assessed and documented before functional testing begins.

Record gathering across supplier and site contractors

The coordination burden of IQ is consistently underestimated at project planning stages. The records that constitute a complete IQ package originate from multiple parties—equipment supplier, site installer, controls vendor, calibration provider, and facility engineering—and each party operates on a different schedule, uses different document formats, and has different retention practices. By the time IQ execution begins, some of those parties may have already demobilised from site.

The linkage between FAT and IQ is a specific case worth planning for. FAT is not a substitute for IQ, and Annex 15 does not position it as one. What FAT provides is pre-delivery evidence about the equipment’s configuration and performance prior to shipment. If exceptions were found during FAT, those exceptions should appear in the IQ package as closed items with documented resolution—or as open items with an explanation of how they were resolved before or during installation. A FAT report that is not referenced in IQ is not integrated into the qualification record; it is a separate document that may or may not be discoverable during an inspection.

The practical failure points in record gathering are not usually caused by unwillingness to provide documentation. They occur because the documentation was never scoped as an IQ deliverable in contracts or purchase orders, because as-built redlines were treated as installer working documents rather than formal records, or because calibration providers issued certificates that reference instrument tag numbers that do not match the IQ instrument list. Identifying these gaps after IQ execution has begun—or after a contractor has left site—forces retrospective documentation that is harder to complete and less defensible than documentation gathered in real time.

The coordination map above is useful as a gap-awareness tool when planning IQ execution. The practical recommendation is to define documentation deliverables from each party in contractual or project management terms before installation begins, so that record gathering is a structured handoff rather than a post-installation chase. For containment systems with complex interfaces—such as BIBO filter housings with pneumatic seals or integrated decontamination systems—the number of parties contributing to the IQ record is larger, and the coordination risk is proportionally higher.

Teams commissioning BSL-3 environments with multiple containment system interfaces may find the coordination sequence in Введення в експлуатацію лабораторії BSL-3: Покрокове керівництво a useful reference for how IQ record gathering sits within the broader commissioning programme.

IQ approval threshold before functional testing

IQ approval is a gate, not a milestone. Treating it as a milestone—something to be reached and moved past on the project schedule—is the decision pattern that produces expensive rework after OQ has begun. The gate function means that OQ cannot defensibly start until IQ meets a specific completeness threshold: every critical installed component is traceable either to the approved design or to a formally documented and assessed change.

Annex 15 is direct on the sequencing requirement: equipment must be qualified before it is used in a production or validation context, and that means IQ must be approved before OQ proceeds. The practical consequence is that a partially complete IQ—one where calibration certificates are pending, as-built drawings are marked “in progress,” or FAT exceptions are unresolved—does not meet the approval threshold. Proceeding to OQ on that basis means OQ results are built on an unverified configuration, and if IQ is subsequently completed and reveals a deviation, those OQ results may need to be voided.

The approval threshold has six verifiable components for containment equipment IQ. None of them are reducible to a signed checklist without supporting evidence.

The traceability matrix criterion deserves specific attention. For containment equipment, the URS will typically specify pressure cascade performance, containment integrity targets, filter specifications, and seal configurations. The IQ traceability matrix should be able to show, for each of those URS items, which installed component addresses it, what drawing or specification defines the approved configuration, and whether the installed state matches. If a URS item cannot be traced to an installed component and an approved drawing, one of two things is true: the component is missing, or the documentation is incomplete. Both conditions should prevent IQ sign-off.

For door and seal systems that are part of the containment boundary—such as pneumatic seal APR doors used in BSL-3 or high-containment pharmaceutical environments—the pneumatic seal APR door configuration at installation must be verifiable against the approved seal design and the facility pressure cascade specification. IQ is the record that establishes that baseline before OQ seal integrity testing begins.

The practical value of a well-executed IQ is not the document itself—it is the defensible baseline it creates for every test, investigation, and inspection that follows. When OQ results are anomalous, when an audit questions whether the installed system matches the approved design, or when a maintenance intervention raises questions about the original configuration, the IQ package is the primary reference. If it contains generic checklists without as-built evidence, the baseline does not exist in a usable form.

Before approving an IQ package, the teams with the most to lose from a gap—QA, biosafety, and the validation lead—should be able to answer three questions without leaving the document: Does every critical installed component trace to the approved design or an accepted change? Are all calibration certificates current and traceable? Are all deviations documented with an impact assessment that addresses the containment claim? If any of those answers requires assumptions or external knowledge not captured in the IQ record, the package is not ready for sign-off.

Frequently Asked Answers

Q: Our containment isolator was installed two years ago and has been used without a formal IQ. Can we still perform a valid IQ now?
A: Yes, a retrospective IQ is feasible, but it is significantly more difficult than a new-installation IQ. You must physically confirm the as-built configuration—seal materials, filter housings, sensor positions—against the original approved design, and gather any surviving documentation from the supplier and installation contractors. Expect that some evidence may be unavailable, so you will need to document assumptions and potentially supplement with targeted re-verification (e.g., material certification, calibration of in‑situ sensors). The goal remains the same: establish that the installed system matches the approved basis before any further qualification steps are undertaken.

Q: After the IQ package is approved, what must happen immediately before OQ testing begins?
A: The installed configuration baseline must be formally locked and the system released for OQ with a documented statement that all IQ deviations that could influence OQ test conditions have been closed or accepted with impact assessments. Without this step, OQ teams may start testing against a configuration that is still evolving, making any anomalous results impossible to interpret. This release also ensures that the as-built drawings, calibration records, and material certificates are frozen as the reference point for the upcoming dynamic tests.

Q: When, if ever, is it acceptable to merge IQ and OQ into a single integrated protocol for containment equipment?
A: Merging IQ and OQ is only acceptable for simple, non-critical utility systems where a risk assessment shows that the installed configuration cannot independently affect the test outcomes. For containment equipment, the installed state directly determines whether containment claims are valid, so the regulatory expectation—reflected in EudraLex Annex 15 and ASTM E2500—is that IQ must be completed and approved before OQ starts. Combining them blurs the evidence that the system was verified to match the approved design prior to dynamic testing, which undermines the entire qualification sequence.

Q: How do I decide whether an as-built discrepancy found during IQ is serious enough to delay OQ, rather than simply document it and move on?
A: The decision turns on whether the discrepancy affects a containment-critical component—such as a seal geometry, filter housing, pressure sensing point, or exhaust path. If it does, OQ must be delayed until the configuration is resolved or the design baseline is formally updated, because OQ results will be recorded against a baseline that no longer matches what is installed. A non-critical discrepancy (e.g., a minor labeling inconsistency that does not alter function) can be accepted with a documented impact statement and does not need to halt OQ, provided the containment claim is unaffected.

Q: Is a full IQ effort justified for a containment system that will be used only for a short research campaign, or can we rely on the supplier’s installation records?
A: The IQ effort is justified regardless of the planned duration of use. The containment claim itself—the protection of operators from potent compounds—depends on the installed configuration matching the approved design from the moment the system is first used, not on how long it remains in service. Supplier installation records are not an independent verification and will not be accepted by regulators as a substitute for a documented IQ that confirms the as-built state, traceability of critical components, and any deviations that arose during installation.