Calibration Intervals
and Out-of-Tolerance
Procedures

Interval as a Risk Decision

Every calibration interval in a pharmaceutical automation system should be traceable to a documented rationale. "We've always done it every 12 months" is not a rationale. The interval must be justified based on the GMP criticality of the measurement, the known drift characteristics of the instrument type and model, the process environment, and — once you have data — the historical as-found performance of that specific instrument.

The starting point for a new installation is the manufacturer's recommended calibration interval, adjusted upward or downward based on the risk classification. A conductivity sensor classified as Critical Primary Quality should start at a shorter interval than the manufacturer might recommend for an industrial application — because the GMP consequence of drift is significantly higher than in a non-regulated environment. Document this reasoning in the Control Philosophy, and commit to reviewing the interval after the first complete calibration cycle once you have real as-found data.

Risk Factors That Drive a Shorter Interval

Several factors should push you toward a shorter calibration interval than the baseline suggests:

• High consequence of drift: if the measurement drives a direct product quality decision — a conductivity reading used for batch release, a temperature reading for sterilisation efficacy — the consequence of undetected drift is higher, and the interval should be shorter to minimise the potential suspect data window.
• Harsh process environment: CIP/SIP cycling, high temperature, vibration, corrosive cleaning agents, and frequent mechanical contact all accelerate sensor drift. An instrument in a CIP loop may drift significantly faster than the same model in a stable ambient environment.
• Known drift-prone technology: thermocouples at high temperatures, electrochemical sensors (pH, DO) exposed to fouling, and sensors with moving parts tend to drift more rapidly than solid-state pressure or RTD temperature sensors. Adjust intervals accordingly.
• Tight process specification tolerance: if the process specification is ±0.5°C and the sensor accuracy specification is ±0.3°C, you have very little margin before drift creates a GMP record that may not reflect actual process conditions. Tighter specifications demand shorter intervals or tighter accuracy instruments.
• New installation without historical data: for a first validation, you have no site-specific drift data. Start conservatively and extend based on actual as-found evidence from the first cycle.

Using As-Found Data to Review Intervals

The as-found reading on a calibration certificate is the measurement of the instrument's current error before any adjustment is made. It is the single most valuable data point for calibration interval management — and it is systematically underused on most pharma projects.

After each calibration cycle, the as-found error for every GMP-critical instrument should be recorded in the calibration register (Engineering Lists, Calibration Register tab). Over two or three calibration cycles, a pattern emerges. An instrument that consistently returns as-found within 10% of its tolerance band has plenty of margin — the interval could potentially be extended. An instrument that returns at 80–90% of its tolerance band every cycle is close to OOT and needs either a shorter interval or replacement.

The interval review should be a formal documented action, not an informal judgment call. The recommended approach is to review the as-found data from the first two complete calibration cycles against the tolerance band, document the review in the calibration register or a calibration review report, and record any interval changes as a formal document revision to the Control Philosophy — which requires change control approval since the CP is a controlled GMP document. See the article on change control for validated systems for how interval changes are processed.

What Triggers an OOT Finding

An out-of-tolerance finding occurs when any as-found calibration point falls outside the specified tolerance band. This is a binary determination — the instrument either passed or it did not. There is no "close enough" in GMP calibration. An instrument that returns at 101% of its tolerance band is an OOT finding regardless of how close it is to the limit.

The tolerance band must be defined before calibration begins — in the Control Philosophy, the HDS instrument specification, or the calibration procedure. It cannot be defined after the fact to accommodate an inconvenient as-found result. A calibration certificate that states "tolerance: ±X%" when the original specification said "±Y%" is a data integrity problem, not a calibration record.

The OOT Response Procedure — Six Steps

The OOT response procedure must be defined in the Control Philosophy before the system goes live. When an OOT finding occurs, the procedure is followed without improvisation. The QLean Framework Control Philosophy (CP-SYS-001 Section 8.3) defines this procedure as follows:

• Step 1 — Remove from GMP service immediately. Do not use the instrument's readings for any quality decision while the OOT status is unresolved. If the instrument feeds an alarm or interlock, assess whether alternative means of monitoring are available and document the temporary arrangement.
• Step 2 — Establish the suspect data window. When did this instrument last pass calibration? The date of the last passed calibration certificate is the start of the suspect window. The current OOT finding date is the end. All GMP data produced between these two dates by this instrument is potentially unreliable.
• Step 3 — Conduct an impact assessment. What GMP records were produced using this instrument's data during the suspect window? Were any batch release decisions made? Were any process specifications verified against this instrument's output? Were any alarm setpoints defined using this measurement? The impact assessment must consider both the magnitude of the drift and its direction — whether the instrument was reading high or low relative to actual, and whether that direction creates risk for product quality or patient safety.
• Step 4 — Raise a deviation. Log the OOT finding in the Master Deviation Ledger. The deviation record must capture: instrument tag and description, the OOT finding date, the as-found error and magnitude, the suspect data window dates, and a summary of the impact assessment. Classify the deviation as Category A (Critical) if the impact assessment identifies a potential product quality risk; Category B (Minor) if the drift was in a direction that posed no quality risk and the impact assessment is closed out accordingly.
• Step 5 — Adjust and re-calibrate. Return the instrument to the calibration laboratory for adjustment and re-calibration. The new calibration certificate must record both the as-found reading (the OOT magnitude) and the as-left reading (the post-adjustment accuracy). The as-found reading from this certificate is the key data for the impact assessment and for the interval review.
• Step 6 — Return to service with documentation. Update the calibration register (Engineering Lists, Calibration Register tab) with the new certificate reference and next due date. Close the deviation with the impact assessment conclusion and QA approval. If the impact assessment identified a product quality risk, any additional investigations or batch disposition decisions must be completed and documented before the deviation is closed.

The Suspect Data Window — Practical Assessment

The impact assessment for the suspect data window is the step that most engineers underestimate. For a conductivity sensor that monitored WFI quality continuously for six months before being found 15% out of tolerance, the suspect window contains thousands of data records. The question is not "is all this data wrong?" — it is "does the magnitude and direction of the drift create a risk that the data misrepresented a process condition that would have triggered a quality decision or corrective action?"

Practical framework for the suspect window assessment:

• Determine drift direction first. Was the instrument reading high or low? For a conductivity sensor reading high (showing higher conductivity than actual), any records that showed values below the specification limit may actually have been even further below the limit — which is conservative and favourable. If the instrument was reading low (showing lower conductivity than actual), records near the specification limit may actually have been above it — which is the risk scenario that requires investigation.
• Quantify worst-case impact. Apply the maximum OOT error to the most critical readings in the suspect window. If the worst-case error would still leave the measurement within specification, the impact is low and the deviation can be closed with a documented assessment. If the worst-case error brings measurements out of specification, QA must assess whether any product decisions were based on those measurements.
• Cross-reference against independent measurements. If the system has redundant measurement (e.g., two conductivity sensors on the return line), compare the readings from both sensors during the suspect window. Significant divergence would have been visible in historian trending. If both sensors tracked closely throughout the period, the OOT finding may be a recent event rather than a long-standing problem.
• Review historian trend data. The historian records allow you to see whether the measurement was stable and consistent throughout the suspect window (suggesting the drift occurred near the end of the calibration interval) or whether anomalies are visible (suggesting drift started earlier). Document this review as part of the impact assessment.

Interval Changes Require Change Control

Calibration intervals are documented in the Control Philosophy — a controlled GMP document. Changing an interval, whether shortening it in response to repeated OOT findings or extending it based on consistently excellent as-found data, is a change to a controlled document. It requires a formal change control record.

This is not bureaucracy — it is the mechanism by which the change is reviewed, approved by QA, implemented consistently, and recorded so that the periodic review can account for it. An informal verbal decision to calibrate a sensor every three months instead of every six months, with no document update and no change control record, means the next person to manage calibration for that instrument will default to the documented 6-month interval and the informal change will be lost.

For a step-by-step guide to raising and closing change control records on a validated system, see the article on change control for validated systems.