How to Identify a Special Process, and Why Most Companies Get It Wrong
There is one question that comes up in almost every quality system implementation project I work on, and in every audit I perform: which processes in the company require validation?
The answers I get range between two extremes. Some companies validate everything that moves, including processes whose output can simply be measured at the end, and they invest months and budget in protocols nobody needs. Other companies declare that they have no special processes at all, because "we only assemble and test," and then the audit comes and it turns out that the shop floor has a bonding process, a cleaning process and a welding process that nobody has touched.
Both mistakes come from the same place: the company has no structured method for making the decision.
The decision falls on the manufacturing engineer or the quality manager, it is made on gut feeling, and no record of it is left behind.
The document that solves this has existed for more than twenty years, and it is still the basis every regulatory body expects to see: the GHTF guidance document GHTF/SG3/N99-10:2004 Edition 2, Quality Management Systems - Process Validation Guidance.
In this article I will go through the method itself, the decision points where companies trip up, and how to document the decision so that it holds up in front of the auditor.
Where the term came from
The term special process is inherited from ISO 9001:1994, where clause 4.9 included a note defining special processes as processes that require prequalification of process capability, meaning processes whose output cannot be fully verified by subsequent inspection. In later versions of ISO 9001 the term itself disappeared, but the requirement remained.
In the medical device world the term survived in professional language, even though the standard itself does not call the requirement by that name.
In ISO 13485:2016 the relevant clause is 7.5.6, "Validation of processes for production and service provision," and it requires validation of any process whose resulting output cannot be verified by subsequent monitoring or measurement. The clause also requires documented procedures covering criteria for review and approval of the process, equipment qualification and personnel qualification, methods and results, records, and above all, criteria for revalidation.
Clause 7.5.7 adds a separate, mandatory requirement for validation of sterilization processes and sterile barrier systems, before initial use and before any change to the product or process. Clause 4.1.6 deals with software used in the quality management system itself, which is a completely different clause and one that people often confuse.
On the US side, the QMSR came into effect on February 2, 2026, incorporating ISO 13485:2016 into 21 CFR Part 820 by reference. The old requirement of 820.75, which required validation of any process whose results cannot be fully verified by subsequent inspection and test, has given way to the wording of the standard.
The substance has not changed. If you know how to identify a special process according to GHTF, you also meet the MDR through ISO 13485, as well as MDSAP and the QMSR.
The three questions that decide
The GHTF decision tree (Figure 1 in the document) is remarkably simple, and that is exactly why it gets applied incorrectly.
It has five outcomes, but in practice everything depends on three questions.
First question: is the process output verifiable?
The question is not "do we test it," but whether it is actually possible to measure or monitor the critical characteristic the process creates, on every unit that comes out of it.
This is where most companies go wrong. A destructive test is not verification, because the unit that was tested can no longer be sold.
A test that samples from a batch is not full verification of the batch; it is a statistical inference.
A characteristic that only shows up after months of use, such as bond stability or sterile barrier integrity over the shelf life, cannot be verified at the end of the production line.
A quick test:
Three conditions must all be met before we can call something verification.
The tested unit remains a product you can sell, meaning the test is not destructive
The test measures the critical characteristic itself, not an indirect sign that points to it
The test is performed on every unit, not on a sample
If any one of the three is missing, the process requires validation.
Second question: is verification sufficient and cost-effective?
This is the question most companies skip, and it is the one that defines the space for judgment.
Even if the output is verifiable, you need to ask whether verification alone reduces the risk to an acceptable level, and whether it is a cost-effective solution.
This is the point where process validation connects with risk management under ISO 14971.
A process whose failure carries a high risk to the patient, and where 100% inspection relies on human judgment, is a candidate for validation even if technically you can "look at every unit." A 100% visual inspection is not a reliable mechanism: miss rates in human visual inspection are known to be high, and they vary with fatigue, lighting, pace and how hard the defect is to discern.
On the other hand, the economic consideration is also completely legitimate under GHTF.
A process that could be validated, but where the cost of full verification is significantly lower than the cost of validating and maintaining it, can remain under verification.
Third question: can you design the problem out?
The decision point nobody uses is redesigning the product or the process. The GHTF document says this explicitly.
Instead of entering an expensive validation of a sensitive process, you can sometimes change the product design so that the characteristic becomes measurable, add an engineering feature that allows non-destructive testing, or switch technology.
In projects that are still in development, this is the most worthwhile consideration, because at the design transfer stage things can still be changed.
After marketing approval, the same change is managed through an ECO, and sometimes it also requires notifying the notified body.
What is always validation, what is always verification, and what is in between
GHTF gives three lists. They are worth knowing by heart, because auditors use them.
Category | Examples from the document | What it means in practice |
|---|---|---|
Processes that should be validated | Sterilization, clean room ambient conditions, aseptic filling, sterile package sealing, lyophilization, heat treating, plating, plastic injection molding | There is nothing to discuss. If you have the process, full validation is required, along with a definition of revalidation |
Processes covered by verification | Manual cutting, testing for color, turbidity or pH of solutions, visual inspection of printed circuit boards, manufacturing and testing of wiring harnesses | Verification is enough, provided it is documented and was a conscious decision |
The judgment zone | Certain cleaning processes, certain manual assembly processes, numerically controlled cutting, certain filling processes | Here you must run the decision tree and document the rationale |
The third list is the one that generates findings. An auditor will almost never argue about whether sterilization requires validation.
The auditor will, however, ask why your bonding process, which creates a joint that cannot be tested without breaking it, is not on the list, and where that decision is documented.
Examples from the gray zone
Adhesives and bonding. Joint strength is tested by peeling, which is a destructive test. Even if you sample from every batch, you have not verified the units that are sold. This is almost always a special process. The parameters that go into the validation are adhesive quantity, cure time, temperature and humidity during curing, surface preparation, and the adhesive's pot life after the package is opened.
Cleaning. If the acceptance criterion is residues below a threshold, you need an analytical test that is not performed on every unit. That is a special process. If the criterion is "visually clean" and the product is neither sterile nor invasive, visual verification is sometimes enough, but you need to show that you made that decision.
Manual assembly. The process depends on the person, so operator qualification is part of the validation, not a substitute for it. ISO 13485 clause 7.5.6 explicitly mentions personnel qualification as a component of validation. Many companies rely on training alone and call it a control. It is not the same thing.
Marking and labeling, including UDI. The long-term legibility of laser marking and the resistance of a label to disinfection or storage conditions are all characteristics that are not tested at the end of the line. Many companies do not think of labeling as a process that requires validation, and it ends up as a finding.
CNC machines and computerized processes. Even when the dimension can be measured, the software that runs the process requires validation for its intended use. GHTF says this explicitly: even if the process output is verifiable, the software used in the process must be validated.
Processes at suppliers and subcontractors. Outsourcing does not remove the requirement. If a subcontractor sterilizes, injection molds or seals sterile packaging for you, you need to hold the evidence. In practice this means reviewing their validation report as part of the supplier evaluation, defining in the quality agreement who notifies whom about a process change, and checking that their revalidation is carried out.
A full example of pouch sealing
Annex B of the GHTF document gives a full example of validating a pouch sealing process, and it is worth knowing because it shows exactly what the auditor expects to see.
The process: heat sealing of packaging pouches.
The critical characteristic is seal strength, and testing it is destructive. This is classified as a process that requires validation, with no discussion.
The IQ checked electrical supply, air pressure, ergonomic placement, spare parts, clean air exhaust, the ability to clean around the equipment, access for maintenance, and suitability for the pouch sizes. Each requirement was derived from a defined source: the manufacturer's manual, the clean room procedure, and the sealing process procedure.
In the OQ, designed experiments were run. The first stage mapped the variability of time, temperature and pressure. The second stage was a response surface study of 54 runs in different combinations of pouch size, time, temperature and pressure. The finding was that time and pressure had almost no effect on seal strength, but the lower temperature limit of 150 degrees produced unacceptable variability, with a mean of 2.38 kg and a wide spread. The lower limit was raised to 155 degrees, the runs were repeated, and the result was a mean of 2.92 kg with a much narrower spread. It was also discovered that the machine needed twenty minutes of warm-up before it was stable.
In the PQ, a full production week was run for each of the two product codes, with statistical process control. The resulting Cpk was 1.75, the mean was 2.93 kg against a target of 3.0, and the action levels were never breached.
Following the validation, the sealing process procedure was updated with the new temperature limit and warm-up time, the equipment register was updated for maintenance and calibration of the new sealer, the validation master plan was updated so that the sealer would be included in the revalidation cycle, and all production and quality staff were retrained.
A validation that does not lead to changes in procedures, training and routine control is just a document.
How to document the decision
The decision not to validate is a decision that needs to be justified, just like the decision to validate.
The simplest tool is a process list within a Validation Master Plan, which contains the following for every manufacturing process in the company:
Field | What to write |
|---|---|
Process | Name and number of the operating procedure |
Critical output | The characteristic the process creates, not the activity |
Verifiable? | Yes or no, and why, including whether the test is destructive |
Risk classification | Reference to the risk management file |
Decision | Validation, verification, or redesign |
Rationale | Two or three lines explaining the decision point in the tree |
Reference | Validation protocol number or inspection procedure number |
Revalidation triggers | Equipment change, raw material change, negative trend, site transfer, time interval |
This table is the first document an auditor will ask for in a process validation audit. A company that has this document finishes the discussion on 7.5.6 in twenty minutes.
According to GHTF, revalidation triggers include a change in the process that may affect quality, a negative trend in quality indicators, a change in product design that affects the process, transfer of a process between sites, and a change in the application of the process.
There is also a category that gets missed: small changes in raw materials or in the process that accumulate over time, each of which looks negligible on its own.
That is why processes such as sterilization require periodic revalidation even without a triggering event.
The five mistakes that generate findings
There is no process list. There are validation protocols, but no document showing that you reviewed all the processes and made a decision about each one. The finding is about the absence of a method, not about the specific process.
Sample inspection is treated as verification. A sample is a statistical inference about a batch, not verification of every unit. If the characteristic is critical, this leads to validation.
IQ only. Companies buy equipment, receive a FAT report from the equipment manufacturer and file it as validation. The manufacturer's report is an input to the IQ, not a substitute for it, and it does not cover the OQ and PQ either.
GHTF says explicitly that you should not rely solely on the supplier's results.No worst case is defined. An OQ that runs only at the nominal operating point has proven nothing about the process limits. The whole value of an OQ lies in challenging the limits and setting action levels.
The validation is not connected to routine control. The validation document is approved, and nobody updates the procedure, the control plan or the training. At the next audit it turns out that production is running with parameters different from the approved ones.
What to do this week
If you want to close this gap without a project that takes months, there is a short route:
Make a list of all the manufacturing, assembly, packaging, cleaning, installation and servicing processes in the company. Base it on the process map or on the actual work instructions, not on memory.
For each process, write down the critical characteristic it creates and the method used to test it.
Mark every row where the test is destructive, sample-based or visual, or where the characteristic only shows up in use.
Run the GHTF decision tree on the marked rows only, and document the rationale.
Turn the list into an annex to the validation master plan, and for every process that requires validation, define the revalidation triggers.