Validation decays silently. Maturity here is largely about whether the link between change control and validation status is strong enough to keep the position true.
Validation maturity is whether the validated state is maintained, not whether the protocols were once executed.
The process runs when something forces it to.
Packages exist for some systems, acceptance criteria were fitted to results, and the validation master plan no longer matches installed equipment.
Typical weakness. No reliable reconciliation between the plan and the floor.
Risk. Qualification status contradicted during a facility tour, often within the first hours.
Procedures exist and are followed, mostly.
A validation master plan exists and protocols carry predetermined criteria, but revalidation is calendar-driven rather than risk- and change-driven.
Typical weakness. Change control does not reliably trigger a revalidation assessment.
Risk. Validated state decays between periodic reviews without detection.
The process is designed, resourced and measured.
Scope is risk-proportionate, URS requirements are testable, and change control includes an explicit revalidation assessment step.
Typical weakness. Continued process verification collects data that nobody interprets.
Risk. A documentation exercise presented as a control.
It connects to the rest of the quality system.
Continued process verification is reviewed and produces actions, and validation status is reconciled against the equipment list on a defined cycle.
Typical weakness. Cleaning validation limits may still rest on legacy convention rather than health-based limits.
Risk. A defensible-looking position that cannot be justified toxicologically.
It improves itself, and the improvement holds.
The validated position matches the site as it exists today, the maintenance burden is proportionate to risk, and improvements are not deterred by revalidation cost.
Typical weakness. Balancing rigour against the cost of change.
Risk. Over-validation quietly discouraging process improvement.
Annex 15 — Qualification and Validation
ICH Q8, Q9, Q10 and Q12 for the surrounding lifecycle
These five levels are a GMPConsultant.nl framework for structuring a conversation about capability. They are not an official regulatory classification, no authority recognises or issues them, and a maturity level is not a statement of GMP compliance.
The GMP Health Index scores seven domains and maps each to a maturity level, in about ten minutes. It calculates in your browser and stores history on your device only.