C&Q Program

Commissioning, Qualification & Validation

One Platform for Your Entire C&Q Program

Define requirements. Assess risk. Execute IQ/OQ/PQ protocols with structured data capture. Manage deviations, collect e-signatures, and release systems — all from a single digital workspace that replaces paper binders and disconnected spreadsheets.

Supports science and risk-based C&Q aligned with the ISPE Baseline® Guide, EU GMP Annex 15, and ICH Q9.

End-to-End Workflow

From first requirement to system release. Every step of your C&Q program lives in one place — no handoffs between systems, no version confusion, no chasing signatures across email.

1

Define & Classify

Capture user requirements, system purpose, and regulatory scope. Classify systems by product quality impact to set qualification depth.

VPREQCS
2

Assess Risk

Build structured risk assessments that connect quality attributes to process parameters and the design controls that mitigate each risk. Use AI or go manual.

RARisk Dials
3

Test & Execute

Run qualification protocols with structured data capture. Record results, attach evidence, and manage deviations — all from one interface.

IQOQPQCQ
4

Release & Maintain

Verify every requirement is traced to a test result. Close deviations, collect approval signatures, lock the package, and generate True Copy PDFs.

TMXSR

Configurable Scope

Right-size every qualification package. Not every system needs the same depth. Classify by product quality impact and automatically adjust scope — from full IQ/OQ/PQ down to streamlined verification for support systems.

  • Package setup captures system name, version, purpose, description, location, and regulatory references
  • Impact categories (Direct, Indirect, None) set the baseline risk posture for each system
  • Implementation method scoring (Custom, Configured, Out of the Box) fine-tunes risk level per function
  • Calculated risk scores from 1–5 drive how rigorous AI-generated test scripts will be
  • High-impact systems get full document suites; support systems use reduced-scope packages

Impact Level Sets Package Scope

Direct Impact

System affects product quality or critical utility output. Full risk assessment + IQ/OQ/PQ.

Not Direct Impact

No direct product quality effect. Commissioning with engineering documentation.

Risk Rating Matrix
ImpactOut of the BoxConfiguredCustom
Direct345
Indirect233
None112

AI-Powered Risk Assessment

Build the risk-to-test chain automatically. Structured risk connects quality attributes, process parameters, and design controls — then links forward to the test steps that verify them.

CQACPPCACDETEST
  • Structured risk format: quality attributes, process parameters, design controls, procedural controls, and residual risk per process step
  • Gen AI creates risk items from your system description, regulatory framework, and package context
  • Agentic AI ingests unstructured source data — manuals, specs, SOPs, up to 50,000 characters — and outputs structured risk items
  • Requirement → Risk → Test Step linking creates full traceability from what matters to how you prove it
  • Risk scores drive test script depth — AI-generated scripts automatically adjust based on your risk dial settings
Illustrative Risk Assessment Extract
Process StepCQACPPDesign ControlRisk
MixingHomogeneitySpeed/TimeSetpoint interlock5
HeatingPotencyTemperatureTemp alarm & control4
FiltrationParticle countPressure diff.Filter integrity test3
CIP cycleCleanlinessFlow/TempRecipe parameters1

Protocol Execution

Run IQ, OQ, PQ, or combined qualification protocols directly in the platform. Structured data capture tables, pass/fail recording, photo and file evidence, and automatic deviation generation when a step fails.

  • Data capture tables collect structured measurements in configurable column formats (text, number, date)
  • Pass/fail recording with evidence capture from any device — photos, screenshots, certificates, logs
  • Failed steps auto-generate deviations with documentation, cause determination, and corrective action workflow
  • Deviation resolution requires designated approver sign-off prior to closure
  • Real-time progress tracking: total steps, passed, failed, remaining across all qualification documents
  • Executable Summary Reports generated per IQ, OQ, and PQ with results and deviation summaries

Deviation Management

StepDescription
1Failed test step auto-generates deviation with full documentation
2Evaluation and assignable cause determination
3Corrective action: define, approve, implement, test, confirm
4Designated approver sign-off required before deviation closure
5Re-test verification documented in the same package

Document Workflow

DraftReviewSignatureExecutePost-ExecApproved

Built-In Data Integrity

ALCOA enforced at the platform level — not by procedure, but because the platform architecture makes it impossible to create non-compliant records.

  • PIN-authenticated e-signatures with signer name, role, date/time permanently recorded
  • Unalterable audit trail: all entries and actions time-stamped as they occur; changes never obscure prior records
  • System-generated True Copy PDFs with document ID, version, and complete signature blocks
  • Comment history fully preserved — conversation trails exportable for regulatory inspection
  • Version control blocks unauthorized changes; rejected documents route back to the correct prior stage
A

Attributable

Every action linked to authenticated user. PIN-secured e-signature with name, role, timestamp.

L

Legible

CQValence editor with consistent formatting. True Copy PDFs with structured layout and TOC.

C

Contemporaneous

Time-stamped audit trail captures all entries at time of action. Status transitions logged automatically.

O

Original

Unique document IDs. Version control prevents unauthorized changes. System-of-record for all records.

A

Accurate

Unalterable audit trail. Record changes never obscure prior information. Full comment history preserved.

System Release

Trace everything, then lock it down. Before release, Valkit confirms every requirement traces to a test result, every deviation is closed, and every approval signature is collected.

  • Trace Matrix auto-generated from requirement → risk → test step links — shows complete verification coverage
  • Summary Report pulls execution results, deviation summaries, and release conclusions into one document
  • All designated approvers must complete PIN-authenticated e-signatures before release
  • Package completion locks all documents — no further editing possible
  • True Copy PDFs generated with document ID, version, signatures, and timestamps for every document

Release Checklist

Requirements Verified

Trace Matrix confirms every requirement and risk item has been tested through IQ/OQ/PQ execution.

Supporting Procedures Referenced

SOPs and sampling procedures documented and linked within the validation package.

Deviations Resolved

All deviations closed with corrective actions completed, verified, and approved.

✍

Approvals Collected

Summary Report approved with PIN-authenticated e-signatures from all designated approvers.

✍

Package Locked

All documents approved. Package finalized. True Copy PDFs generated. System released.

Scale Across Sites

Clone packages for multi-site deployment. Qualified one system? Clone the entire package for the next identical installation. Update system-specific tags and execute. Global Clone deploys across organizations for enterprise-wide standardization.

  • Standard clone copies all documents, content, settings, and stakeholder assignments
  • Clone with Data Capture additionally preserves table structures and test step definitions
  • Global Clone shares packages across organizations for multi-site qualification programs
  • Tag libraries for system metadata (location, serial number, model) update across all documents
  • Cloned packages start in Initiated status with new IDs — fully independent from the source

Multi-Site from One Master

WFI System — Master Qualification Package

VP + REQ + RA + CS + IQ + OQ + PQ + TMX + SR

WFI-002Building 3 · Indianapolis
WFI-003Building 7 · Dublin
WFI-004Building 12 · Singapore
Standard CloneClone w/ Data CaptureGlobal Clone
21 CFR Part 11EU Annex 11EU GMP Annex 15ISO 27001 Certified

End-to-end C&Q on one platform: define requirements, assess risk, execute IQ/OQ/PQ with structured data capture, manage deviations, and collect e-signatures. Aligned with ISPE Baseline®, EU GMP Annex 15, and ICH Q9. Traceability from quality attributes to test results; release with True Copy PDFs.

FAQ

Common questions

What is CQV software?

CQV (commissioning, qualification and validation) software replaces paper binders for C&Q programs. In Valkit you define requirements, assess risk, execute IQ/OQ/PQ protocols with structured data capture, manage deviations, collect e-signatures and release systems from one workspace.

Which guidance does Valkit C&Q align with?

Valkit supports science and risk-based C&Q aligned with the ISPE Baseline Guide, EU GMP Annex 15 and ICH Q9.

Does every system need a full IQ/OQ/PQ package?

No. Systems are classified by product quality impact (Direct, Indirect or None). High-impact systems get a full risk assessment and IQ/OQ/PQ, while support systems use reduced-scope packages.

How are deviations handled during qualification?

A failed test step automatically creates a deviation with cause determination and a corrective action workflow. A designated approver must sign off before the deviation can be closed, and re-test evidence stays in the same package.

What happens when a C&Q package is released?

Valkit checks that every requirement traces to a test result, every deviation is closed and every approval signature is collected. Completing the package locks all documents and generates True Copy PDFs with document ID, version and signatures.

CQV Software: Commissioning & Qualification | Valkit.ai