No. Nothing in 21 CFR Part 211 requires three batches for performance qualification. The three-run convention is an industry practice that hardened into an assumption, and the FDA’s own process validation guidance moved away from it deliberately.
This matters commercially in both directions. Three runs on a highly variable process produces a validation report that will not survive its first out-of-specification result. Insisting on three runs for a well-characterized process on qualified equipment is an expensive ritual. Either position is defensible if the protocol argues it; neither is defensible if the protocol merely assumes it.
What the regulation actually says
| Citation | What it requires | What it does NOT say |
|---|---|---|
| 21 CFR 211.100(a) | Written procedures for production and process control, designed to assure identity, strength, quality and purity | Any number of qualification runs |
| 21 CFR 211.110(a) | In-process control procedures to monitor and validate performance | Any number of batches |
| 21 CFR 211.110(b) | In-process specifications consistent with drug product final specifications, derived from prior acceptable process average and variability | That “prior” means exactly three |
| 21 CFR 211.180(e) | Annual review of records for each product | That validation ends when the report is signed |
The phrase doing the work is in 211.110(b): specifications derived from process average and variability. That is a statistical statement, and how many runs it takes to characterize variability depends on how variable the process is. A number fixed in advance cannot answer a question about variability that has not been measured yet.
Where the number should come from instead
- Stage 1 knowledge. If process design established the sources of variability and their magnitude, fewer confirmatory runs are needed – the understanding already exists.
- Measured variability. A process with wide batch-to-batch variation needs more runs to make any statistical claim, not fewer.
- Risk to the patient. Higher-consequence products justify more evidence.
- Detectability. Where a failure would be caught reliably downstream, less front-loaded evidence is required than where it would not.
Write the justification into the protocol. An investigator asking “why three?” is entitled to an answer better than “that is what everyone does” – and a protocol that argues its number from variability is stronger evidence of process understanding than one that runs five without explaining why.
Where the convention came from
Three has no regulatory origin. It reflects an older validation model in which qualification was a discrete event to be passed rather than a lifecycle to be maintained, and three is the smallest number from which any trend can be inferred. The 2011 lifecycle guidance replaced that model with continued process verification – 211.180(e) makes the ongoing part binding, which is the half most programs still under-resource. A validation effort that stops when the report is signed has satisfied a convention and left a regulation unaddressed.
Fuller treatment in what is process validation and IQ/OQ/PQ requirements.
Get a single-source quote
Standards referenced: 21 CFR 211 · FDA process validation guidance · ASME BPE
Related questions
Is the three-batch rule for PQ required by the FDA?
No. It appears nowhere in 21 CFR Part 211, and FDA process validation guidance explicitly moved away from a fixed number toward a justification based on understanding of process variability. Three batches remains extremely common practice, and it is defensible – but only when the protocol argues why three is sufficient for that particular process rather than treating it as a given.
How many PQ runs do I actually need?
Enough to support a statistical claim about the process, which depends on its measured variability, the knowledge carried forward from process design, the risk to the patient and how detectable a failure would be downstream. A well-characterized process on qualified equipment may justify fewer runs; a variable process may need more. The number belongs in the protocol with its reasoning attached.
Does validation end when the PQ report is signed?
No, and this is the more consequential misunderstanding. 21 CFR 211.180(e) requires an annual review of records for each product to determine whether specifications or procedures need changing, and the FDA lifecycle model treats continued process verification as an ongoing stage. A program that stops at the report has satisfied an industry convention while leaving a binding requirement unaddressed.
Where does the three-batch convention come from?
From an older validation model that treated qualification as a discrete event to be passed rather than a lifecycle to be maintained, in which three is simply the smallest number of points from which any trend can be inferred. It has no regulatory origin and never did. It persists because it is familiar and because nobody is penalized for over-testing.
Qualification support
We write and execute qualification protocols against acceptance criteria your quality unit approves, and produce the raw data and objective evidence behind them. On the three-batch question specifically, the useful support is helping justify the number of runs from process understanding and variability rather than defaulting to three, since current FDA process validation guidance expects a science and risk-based rationale rather than a fixed count. Protocol approval and product release remain yours.
What does 21 CFR 211 actually say about the number of validation batches?
It does not specify a number. Part 211 requires that processes be validated and that procedures be capable of consistently producing product meeting its specifications, but it sets no batch count. The three-run figure is an industry convention, not a regulatory text.
What does the FDA process validation guidance say instead?
It frames validation as a lifecycle of process design, process qualification and continued process verification, and it expects the number of runs to be justified by the variability and understanding of the process. That deliberately replaces a fixed count with a risk and statistics based justification.
How should the number of PQ runs be justified?
From the known variability of the process, the criticality of the attributes being controlled, the level of process understanding from development, and the confidence level the justification needs to support. The output is a documented rationale, not a number chosen first and defended afterwards.
Can fewer than three PQ runs ever be acceptable?
Where the process is well characterised, the variability is small and understood, and the reasoning is documented, a smaller number can be defensible. What is not defensible is choosing a smaller number to save schedule and writing the rationale to fit it.
When are more than three runs needed?
When the process has meaningful variability, when the product is high risk, when multiple lots of a variable raw material have to be covered, or when a single run cannot exercise the full operating range. A highly variable process validated on three runs produces a report that will not survive its first out-of-specification result.
Does the three-batch convention apply to equipment qualification too?
No. Installation and operational qualification verify that equipment was installed correctly and functions across its operating range. The batch-count question belongs to performance qualification and process performance qualification, where product is actually made under commercial conditions.
What is the difference between PQ and process performance qualification?
Performance qualification in the equipment sense demonstrates that a system performs reliably under normal operating conditions. Process performance qualification demonstrates that the commercial manufacturing process reproducibly delivers the product. The terms are used loosely in practice, which is a frequent source of confusion in protocols.
What is continued process verification?
It is the ongoing stage after qualification, where data from routine production is monitored to confirm the process remains in a state of control. It is the reason a fixed batch count at qualification matters less than it used to, because the evidence keeps accumulating after the report is signed.
What is a validation master plan?
A document setting out the scope, approach, responsibilities and schedule for validation across a facility or project, with the individual protocols sitting underneath it. It is where the rationale for the overall approach lives.
How does a bracketing or matrixing approach reduce run count?
By validating the extremes of a range of similar products or strengths and inferring the intermediate cases, with the rationale documented. It is an accepted way to reduce total runs without reducing the evidence for any individual case.
Does a customer or contract still requiring three batches change the answer?
Contractually, yes. If a client specification or quality agreement requires three runs, that is the binding requirement regardless of what the regulation says. The point of understanding the regulatory position is knowing when to negotiate the specification rather than assuming it is fixed.
Do international regulators take the same position?
EU GMP Annex 15 similarly expects the number of batches to be justified rather than fixed, and its guidance on process validation reflects the same lifecycle thinking. The practical effect is that a justified number travels better across jurisdictions than an unexplained three.
How does the three-run question apply to cleaning validation?
The same logic applies. The number of cleaning runs should reflect the difficulty of the soil, the variability of the process and the detection capability of the analytical method, and it should be justified. Cleaning validation also carries its own ongoing monitoring expectation.
What does a PQ run need to demonstrate?
That the process, operated by trained personnel using the approved procedure on qualified equipment, produces product meeting its critical quality attributes, with the critical process parameters staying inside their proven ranges. Sampling has to be sufficient to support that conclusion statistically.
How much sampling does a PQ run need?
More than routine production. The sampling plan is set to give confidence about within-batch and between-batch variability, which usually means more sample points and more locations than commercial release testing requires. The plan is justified in the protocol.
What happens if a PQ run fails?
It is investigated as a deviation, the root cause is determined, and the impact on the validation approach is assessed. A failed run is not simply discarded and replaced. Where the failure reveals a process understanding gap, the answer is usually to go back to process design rather than to run another batch.
Does a change to the process require full revalidation?
It requires an impact assessment under change control. Some changes need nothing beyond documentation, some need targeted requalification of the affected attribute, and some need a full process performance qualification. The assessment is what decides, and it is documented.
How does equipment qualification connect to the batch count question?
Installation and operational qualification have to be complete and current before performance runs begin, because a performance run on unqualified equipment proves nothing. Where the equipment qualification is weak, teams often compensate by adding batches, which is the wrong lever.
Who writes the justification for the number of runs?
Quality and the process owner, drawing on development data, prior knowledge and risk assessment. The engineering contractor supports it by providing the qualification evidence for the equipment and systems underneath it. Paul Industries provides that installation and qualification support on the systems it builds.
What does a defensible validation package look like?
A documented rationale for the approach and the number of runs, complete installation and operational qualification for the equipment involved, protocols approved before execution, raw data, deviations investigated and closed, and a plan for continued process verification. The number of batches is one line inside that.
What statistical confidence should a qualification approach target?
Whatever the risk of the product and process justifies, stated explicitly in the protocol rather than implied. Naming the confidence level is what turns a chosen number of runs into a defensible one.