Driving the Future of Commissioning and Qualification: Inside ISPE’s New C&Q Implementation Addendum and Webinar Series

With the release of the ISPE Commissioning and Qualification Baseline® Guide (Second Edition) in 2019, organizations had a comprehensive resource for modernizing C&Q practices. To help translate theory into action, the ISPE Commissioning & Qualification Community of Practice (CoP) developed a new ISPE Addendum to ISPE Baseline® Guide: Commissioning and Qualification (Second Edition) which will be released soon. This resource codifies a pragmatic, science-based, and risk-based delivery model based on product and process knowledge (PPK) and provides the foundation to formalize a manufacturing process control strategy (MPCS). It aligns with ICH Q9(R1) (risk), ICH Q10 (control strategy), and the revised ASTM E2500-25.

To further support broader adoption of industry best practices for C&Q, the ISPE C&Q COP launched a complimentary nine-part webinar series. This initiative serves as both a learning platform and a global forum, guiding participants on how to implement quality risk management (QRM) in C&Q across facilities, systems, and equipment.

What makes the Addendum and webinar series especially compelling is its relevance: it is not an abstract academic exercise, but a direct response to the realities of today’s pharmaceutical landscape, one where regulators expect true risk-based justification, companies seek accelerated timelines, and patients demand reliable therapies.

The Addendum emphasizes a truth regulators share: product quality and patient safety are the point, and faster delivery is a legitimate, measurable benefit of integrated, QRM-based C&Q. Teams using this approach have delivered ahead of schedule precisely because the design embeds control and the testing verifies what matters.

Bottom line: conditions are ripe to standardize what early adopters have proved works an integrated approach that treats qualification as the verification of a designed control strategy, not a separate end of project paper exercise.

Why Now?

• Regulatory alignment is clearer than ever. It is clear through multiple regulatory updates and audits that there is a continued focus on QRM and control-strategy-centric qualification vs. protocol theater.
• Standards moved forward. ASTM E2500-25 reconfirms the science- and risk-based specification/design/verification approach for manufacturing systems closing the gap between engineering and GMP.
• Risk management is renewed. ICH Q9(R1) refocused hazard vs. harm distinctions and expectations for risk control decisions that the Addendum maps directly into system risk assessment (SRA) and design qualification (DQ) deliverables.

Major Addendum Points

New Model: “MPCS-First” Delivery

The Addendum defines the MPCS as the collective controls (known as the critical aspects or CAs) associated with the manufacturing process systems and equipment. The MPCS forms an element of the overall control strategy (ICH Q10) related to critical process parameter (CPP) control resulting in final end product quality as defined by critical quality attributes (CQAs).

Therefore, the Addendum formalizes a hypothesis many teams have proven informally: If you finalize the MPCS early and make CDEs the currency of design and verification, project performance improves.

Practically, this means:

• Traceability lives in engineering, not just QA. A live traceability matrix (TM) that ties CQA, CPP, CA, CDE, and test location (FAT/SAT/vendor IOQ/IOV) keeps the team focused and allows Quality to approve the plan once, then verify it was executed. See Figure 1.
• Design choices are risk choices. DR/DQ must explicitly show how risk controls are built into the design, so verification is confirmation, not discovery. This is the application of quality by design (QBD).

1) Start with Product and Process Knowledge (PPK) to Define the MPCS

ISPE Baseline® Guide: Commissioning and Qualification (Second Edition) figures 1.1 and 4.2 provide an overview of the QRM C&Q process for delivery of quality impacting. However, many in the pharmaceutical industry have had difficulty in identifying and incorporating the necessary elements of a QRM C&Q delivery process to provide the proper QA focus and to identify and implement the necessary site quality system elements and site quality system supporting the use of Good Engineering Practice (GEP) to deliver qualified systems meeting GMP requirements. The C&Q delivery process (see Figure 2) is updated within the BG5 Addendum to reflect the process described next.

• Use CQAs and CPPs as the non-negotiable inputs to risk management. The C&Q team collects these; they don’t invent them.
• Convert risk thinking into a concrete MPCS: alarms, data management, automated controls, and procedural controls that keep CPPs in control across ranges and durations while providing data integrity.

What’s new?

The Addendum explicitly positions the MPCS as the ICH Q10 sub-element you verify during integrated C&Q, and the CDEs born from QbD are the verification focus.

2) Classify Systems and Risk Where It Matters

For direct-impact systems, perform a system risk assessment (SRA), a qualitative, C&Q-aligned analysis focused on CPP control failure and its mitigations (CAs/CDEs). It assigns H/M/L and drives design controls.

Note: SRA = risk assessment and risk control, and risk control decisions need to be explicit, in line with ICH Q9(R1), i.e., assessment and control are related but distinct steps. Evaluation and control can be addressed concurrently given that the correct expertise is present.

3) URS, DR, and DQ: The Traceable Design Thread

• URS captures what (not how), with a quality classification column that groups product CQAs, process CPPs/established conditions (ECs), and regulatory/company quality requirements (ICH Q12).
• Design review (DR) traces engineering features, design elements, back to URs and risk mitigations from the SRA; any feature tied to a control/CA is tagged as a CDE.
• Design qualification (DQ) then verifies the robustness of risk controls (CDEs/acceptance criteria) and that user requirements are met by design before fabrication, with quality approval; for simple off-the-shelf equipment, DQ can substitute for SRA and a simple cover sheet to the cut sheet can substitute for the URS.

4) Verify Once, Commission Always: Using GEP Across the Life Cycle

• Commissioning is executed with GEP documents (FAT/SAT/vendor IOQ/IOV), covers all user requirements and engineering specifications (quality-impacting and not), and provides the data to verify CDEs/CAs; no redundant IOQ scripts are required post commissioning.
• Testing scope is driven by controls: all documented controls and their CDEs must be demonstrated; ALCOA/ALCOA+ applies. (Note: ALCOA+ assumes PCS and data integrity verification activities.)

5) Acceptance and Release: The Pivot to Operations

• A quality-approved summary confirms URs and specifications are met, discrepancies and changes are closed, and the PQS elements (SOPs, calibration/maintenance, training) are ready. This is the formal start of the qualified state and transition to PQ/PPQ.

What the Addendum Clarifies

• Risk-based does not equal less testing. You test all controls/CDEs that manage CPP risk; risk informs what matters, not whether to verify. Hence, the power of this methodology: we tie process variability and process risk to product quality while documenting risk mitigations.
• URS bloat. Keep URS focused on quality-impacting requirements and business/EHS needs: don’t cram in design/procurement language that belongs in contracts/specifications.
• Commissioning does not mean relabeled qualification. It’s a well-managed and documented GEP process that informs qualification; quality approves the plan and outcomes, not every test script.
• SRA is qualitative on purpose. Use PPK and SME judgment to drive mitigations; reserve quantitative RPN tooling for broader process risk assessments.
• Change management is the make-or-break. Without ECM and issues management during commissioning, you’ll lose control and have to retest. With it, you move quickly and cleanly.

Strategic Issues the Addendum Surfaces

• Established conditions (ICH Q12) meet URS. If your filings designate ECs (parameters/attributes that require submission to change), treat them as quality-impacting URs and flow them through SRA→DQ→CDE→verification. This makes post-approval changes predictable and compliant.
• CSV alignment for PCS-enabled systems. Pass data integrity system lists and CDE summaries to CSV early so GAMP activities and C&Q converge at FAT/SAT/IOV, not collide there.
• Vendor quality is a gating factor. If you will leverage vendor FAT/SAT data, audit the vendor’s quality system and adjust controls if gaps exist. Otherwise you’ll pay twice.

Webinar Focus Areas and Webinar Series Breakdown

“This series underscores a fundamental shift: from document-heavy, traditional models to life cycle-driven strategies that enhance speed, safety, and compliance.”

The webinar series digs deep into the main topics and major C&Q deliverables. Access the webinar series via the following link on the ISPE website: https://ispe.org/webinars/past/videos/recordings-past-webinars

Webinar Series Abstracts

Inside the Series: Building Knowledge Step by Step

The strength of the ISPE program lies in its structure. Each webinar builds on the last, creating a progressive journey that mirrors how C&Q unfolds in practice.

Foundations of QRM-Based C&Q

The opening sessions establish the rationale and advantages of adopting a risk-based approach. Participants gain a clear understanding of how QRM underpins modern qualification strategies, the relationship to QbD, and the enablers that make integration possible.

Transitioning Programs and Audit Defense

Moving from a traditional model to a new approach is rarely seamless. These webinars address the hybrid reality many organizations face, exploring how to overcome internal objections, manage resistance to change, and prepare for regulatory audits that will scrutinize these new methodologies.

“Regulators are not only open to risk-based approaches—they expect them. Audit readiness must be baked into the transition process.”

Good Engineering Practice (GEP)

Central to the new C&Q model is the role of GEP. Sessions on this topic show how GEP provides the foundation for efficient project delivery and regulatory compliance. By embedding quality into design, fabrication, installation, and commissioning, GEP reduces the reliance on retrospective qualification and streamlines the pathway to compliance.

Engineering Change Management (ECM)

As assets evolve across their life cycle, change management becomes critical. This webinar examines how ECM, coupled with quality change control, ensures changes are managed in a controlled, science-based way. Case studies demonstrate how ECM safeguards both compliance and innovation in real-world pharmaceutical operations.

User Requirement Specification (URS)

Clarity at the outset of a project is essential. The URS session unpacks what makes a robust specification, the common pitfalls, and how URS directly influences project delivery timelines and success.

System Boundaries and Classification

Defining boundaries and classifying systems as direct-impact or non-impact systems is one of the most crucial project management steps. This session explores methodologies for boundary-setting, scalability, and how system classification ties back to URS and downstream risk assessments.

System Risk Assessments (SRAs)

The series culminates with a deep dive into SRAs. Attendees learn how to identify critical aspects, differentiate between direct and indirect systems, and apply the appropriate strategy—whether through GEP, commissioning, or qualification. Real-world examples illustrate best practices, common challenges, and the practical integration of SRAs into project workflows.

Commissioning

This webinar demonstrates how to plan and execute commissioning activities that directly support qualification, in full alignment with ISPE guidance. Attendees will learn how early integration of commissioning into the C&Q life cycle improves verification quality and efficiency through the application of GEP, robust engineering ECM, and effective vendor assessments. Using real-world examples, the session will show how well-planned commissioning programs drive regulatory readiness, reduce duplication, and enable successful project delivery in regulated environments.

Qualification, Acceptance, and Release

This webinar demonstrates how to plan and execute qualification activities that deliver regulatory confidence while optimizing project execution, in alignment with the ISPE Baseline® Guide: Commissioning and Qualification (Second Edition) addendum and ASTM E2500-25 principles. Attendees will learn how risk-based qualification, built on GEP and supported by clear traceability from requirements to verification, ensures systems are fit for intended use without unnecessary testing or documentation. Through real-world examples, the session will highlight how integrating qualification planning early in the C&Q life cycle enhances quality, accelerates speed to patient, and drives consistent, compliant outcomes across global capital projects.

Conclusion

Industry Impact: More Than Compliance

Beyond the technical details, the ISPE Addendum speaks to a larger cultural shift in pharmaceutical engineering: the recognition that risk-based, science-driven practices are no longer optional, they are essential.

Companies adopting these approaches report more efficient project execution, reduced documentation burdens, and improved collaboration between engineering, quality, and manufacturing teams. Regulators, in turn, see clearer rationales for decisions, stronger patient safeguards, and greater alignment with international standards.

“QRM-based C&Q is not simply about meeting standards—it’s about building resilient systems that safeguard patients and support innovation.”

For many organizations, the integration of GEP and the engineering quality process has already shown measurable impact: shorter project timelines, fewer compliance deviations, and smoother regulatory inspections. The benefits extend beyond compliance. They touch every aspect of project delivery and operational excellence.

Looking Ahead: A Global Learning Community

One of the most exciting outcomes of the webinar series is the community it is building. With participation spanning continents, the webinars have become a platform for cross-pollination of ideas. Engineers in Europe are learning from case studies in the US; quality leaders in Asia are comparing approaches with counterparts in Latin America.

By the series’ conclusion, participants will understand the intricacies of ISPE Baseline^® Guide: Commissioning and Qualification (Second Edition) and ISPE Baseline® Guide: Oral Solid Dosage Forms (Third Edition), and be armed with strategies to apply it confidently in their organizations. This shared knowledge base is helping to harmonize practices globally, ensuring consistency in how facilities are commissioned and qualified.

The future of C&Q, as charted by ISPE and embraced by industry professionals worldwide, is one in which speed, safety, and regulatory excellence are not in conflict but mutually reinforcing.1^, 2^, 3^, 4^, 5^, 6