The Gap Between Engineering and GMP
On a standard automation project an IO list is a working document. It gets built during engineering, updated when the client changes their mind about tag names, and filed somewhere on SharePoint once commissioning is done. Nobody reads it after handover.
On a pharma project that same document becomes evidence. It needs to prove — to a QA reviewer, an auditor, and the IQ protocol — that every signal entering or leaving the PLC has been identified, categorised, installed as specified, and verified. That is a fundamentally different standard, and the gap between what most engineers produce and what a pharma IQ requires is where projects get into trouble at the qualification stage.
The good news is you do not need to rebuild your IO documentation from scratch. You need to add the right fields, tie them to the right evidence, and understand what each phase of the qualification lifecycle expects from the document.
What the IQ Actually Checks Against Your IO List
When you understand what the IQ protocol is trying to verify, the documentation requirements make more sense. The IQ phase is not about testing whether the system works — that is the OQ. The IQ is about proving the system was installed as designed. Every physical signal needs a paper trail from design intent to installed hardware.
In the IQ protocol, the hardware verification section works through your IO modules slot by slot — confirming order codes and rack positions against the HDS Bill of Materials. The calibration section then cross-references every GMP-critical analogue instrument against the calibration register. These are two separate verification activities, both traceable back to the same IO documentation. In practice the IQ reviewer needs to answer four questions for every signal:
- Identity — does the installed tag match the tag in the design documents?
- Signal type — is the correct module type used at the correct address?
- Calibration status — for GMP-critical analogue signals, is there a valid site calibration certificate?
- Physical presence — is the instrument physically installed at the location stated in the design?
If the IO list does not contain all of this information in a reviewable format, the IQ protocol cannot be executed against it. The review stalls, or the reviewer populates the gaps themselves — which creates rework and a risk that the documentation does not reflect what was actually installed.
Minimum Fields for a GMP-Ready IO List
An IO list that will survive a pharma IQ needs the following columns as a minimum. The fields above the line are engineering fields populated during design. The verification status field is completed during IQ execution and becomes part of the IQ evidence pack.
| Field | Content | Why IQ Needs It |
|---|---|---|
| PLC Address | Hardware address in the PLC rack — e.g. IW64.0, %I0.4 | IQ verifies module installed at the specified address and slot |
| Tag Name | Engineering tag matching the instrument list — e.g. AT-101, TT-205 | Cross-references to instrument list and calibration register |
| Description | Plain-language signal description | Human-readable identity confirmation during field walkdown |
| Signal Type | DI / DO / AI / AO and sub-type — 4-20 mA, 24V DC, PT100, etc. | IQ verifies correct module type at correct slot |
| Engineering Range | Physical measurement range — e.g. 0–2000 µS/cm | Required for calibration certificate cross-check |
| Process Location | P&ID reference or installation location description | IQ field walkdown: verify instrument is physically where the design says |
| GMP-Critical Flag | YES / NO — does this signal affect a GMP-critical parameter? | Drives calibration requirements and OQ test coverage |
| Calibration Cert Ref | Certificate reference number in the evidence pack (GMP-critical AI / AO only) | IQ calibration section cross-references cert to instrument |
| IQ Verification Status | PASS / FAIL / DEVIATION — completed during IQ execution | IQ reviewer signs off each line; failures raised as deviations to MDL-SYS-001 |
The GMP-Critical Flag — Why It Carries More Weight Than You Think
Not all IO points are equal in a pharma context. A digital input monitoring a utility cabinet door is not the same as an analogue input reading conductivity at a point-of-use in a water system. The GMP-critical flag is how you formalise that distinction in a document that travels through the entire qualification lifecycle.
The flag does three things. First, it tells the calibration engineer which instruments require site calibration certificates before IQ — you do not need to calibrate every digital input, but every GMP-critical analogue signal must have a valid, traceable certificate on file before the IQ can pass that instrument. Second, it drives test depth in the OQ: GMP-critical signals get boundary tests and negative tests; lower-risk signals get simpler functional checks. Third, it makes audit responses straightforward. When an auditor asks how you decided what to qualify, you point to the flag column and the risk assessment that defined the criteria.
Define the criteria upfront and document them. A workable definition for most systems: a signal is GMP-critical if its failure or incorrect reading could directly impact product quality, patient safety, or data integrity. Conductivity, temperature, TOC, level in a critical vessel — yes. Cabinet door switch — no. Pump running feedback — depends on whether the pump movement affects a critical process parameter; if it does, yes.
Keeping the IO List, Instrument List, and Calibration Register Aligned
This is where most engineering IO documentation falls apart in a pharma context: three documents created at different times by different people, with tag names that have drifted out of sync between them.
For IQ, the IO list, instrument list, and calibration register must tell the same story. The tag in the IO list must match the tag in the instrument list. The instrument list must show the same engineering range as the IO list. The calibration register must reference the same tag with a calibration date prior to IQ execution and a certificate reference number that corresponds to the physical document in the evidence pack.
If these three documents are inconsistent, the IQ generates deviations — not because the system is wrong, but because the documentation does not hang together. Reconciling tag drift at the IQ stage takes days and creates unnecessary deviations on the project record. Keeping the documents in sync throughout engineering is an engineering discipline, not a last-minute documentation task.
The Engineering Lists workbook (EL-SYS-001) holds all the inter-linked registers in a single file: the Instrument List (tag, description, type, range, process location), the IO List (PLC address, tag, signal type, range), the Calibration Register (instrument tag, certificate reference, calibration date, next due date, calibration standard), and the Alarm List. Keeping them in one workbook enforces tag-name consistency — a rename propagates across every sheet. The IQ protocol (IQ-SYS-001) references EL-SYS-001 directly: Section 4 prerequisite PRE-004 requires the current revision of EL-SYS-001 to be available before IQ execution begins, and Section 7 (Calibration Certificate Verification) cross-references the Calibration Register for each of the 13 named GMP-critical instruments. Section 6.2 verifies I/O module order codes and rack positions against the HDS Bill of Materials, which the IO List feeds into.
IQ vs SAT — What Each Phase Verifies for I/O
A persistent confusion on pharma projects is that the IQ has already verified the IO so the SAT does not need to. That is wrong. They verify different things and the distinction is important for understanding what documentation each phase requires from you.
At IQ, you are verifying the documentation: that the installed hardware matches the design. The IQ reviewer checks the IO list against the hardware in the panel — correct order code at correct slot, correct tag in the drawing — and checks that calibration certificates exist and are valid. No process signal needs to be live. This is what the IQ template means by "static verification."
At the SAT, you are verifying the signal chain: inject a live or simulated process signal at the field instrument and confirm the PLC reads the correct engineering-unit value at the correct PLC tag. That is the loop check. The SAT explicitly cross-references EL-SYS-001 for each instrument — verify the SCADA tag matches the correct PLC address, inject the signal, confirm the reading is within ±1% of the injected value, and record the site calibration certificate reference as evidence. The IQ paper check creates the foundation; the SAT loop check proves the wiring is correct end to end.
Digital I/O vs Analogue I/O — Different Documentation Requirements
Digital and analogue signals carry different evidence requirements and conflating them creates unnecessary work.
Digital I/O (DI / DO)
For digital signals, the IQ focuses on identity and wiring: the signal is wired to the correct PLC address, the module is the correct type, and the description in the documentation matches reality. Digital signals do not require calibration certificates. The IQ check for a DI is: confirm address, confirm module type, confirm tag name, pass. The live signal check happens at the SAT where the field device is physically operated and the PLC response is confirmed.
Analogue I/O (AI / AO)
Analogue signals carry GMP weight. For every GMP-critical analogue input, the IQ requires address verification, module type confirmation, and a valid site calibration certificate. "Site calibration" is important — the SAT prerequisite checklist explicitly requires instruments to be re-calibrated after installation at site, not just transported with a factory certificate. The certificate must cover the full engineering range defined in the IO list and carry a calibration date prior to IQ execution. If an instrument arrives at IQ without a valid site certificate, that IO point is a failed IQ item and a deviation in the MDL.
The Five IO Documentation Gaps That Turn Up in Audits
The same gaps appear repeatedly across water system, EMS, and fill-and-finish projects:
- No GMP-critical flag. The IO list was built by an engineer who did not know the distinction mattered. Result: calibration certificates collected for everything, or nothing. Neither is the right answer — and with no flag column, there is no documented basis for the decision either way.
- Tag name drift. The instrument list was created during FEED with one naming convention. The IO list was built in detail design with a slightly different one. The calibration register uses the original tags. None of them match at IQ and reconciling the three documents takes days.
- Missing PLC address column. The IO list has tag names but no hardware addresses. The IQ reviewer cannot verify the module-to-signal mapping. Fixable in an afternoon, but it should never reach IQ in that state.
- Calibration certificate not cross-referenced. The certificates exist — somewhere — but they are not referenced by certificate number in the IO list. The IQ reviewer cannot close the loop between the instrument in the table and the paper in the evidence pack.
- Engineering range discrepancy. The IO list says 0–500 µS/cm. The calibration certificate covers 0–2000 µS/cm. The QA reviewer raises a discrepancy query. The answer may be obvious to the engineer but if it is not documented it is a deviation in the record.
Document Control and Version Freeze
Your IO list needs to be a controlled document before it can be referenced in an IQ protocol. That means a document number, a version number, and an approval signature. The IQ protocol references a specific revision of EL-SYS-001 — if the IO list changes after the protocol is approved, you need a change record and a protocol amendment. This is standard change control, but it surprises engineers who treat IO lists as perpetually living working documents.
Freeze the IO list early enough for it to be reviewed and approved as part of the pre-IQ documentation readiness check. If you are heading into an IQ with an unapproved IO list, you have a phase gate problem. The IQ protocol should not be approved while EL-SYS-001 is still showing a draft revision.
Before the IQ execution kick-off: EL-SYS-001 is at an approved revision and referenced in the IQ protocol · Every signal has PLC address, tag name, signal type, engineering range, and process location · GMP-critical flag populated for all signals based on documented criteria · Every GMP-critical analogue signal has a site calibration certificate reference · Certificates are in the evidence pack, accessible to the IQ reviewer · Tag names are consistent across IO list, instrument list, and calibration register · Engineering ranges in IO list match the ranges on the calibration certificates · NTP synchronisation verified and PLC system clock correct before execution starts · IO list version frozen — any post-approval changes go through change control.
One final point on NTP: when your IQ team records field verification results, those records carry timestamps. If the PLC system clock is not synchronised the timestamps in your IQ paperwork will not match the timestamps in the audit trail for the same events. Verify that NTP synchronisation is configured and active before IQ execution begins — the IQ protocol includes an explicit NTP source verification step (IQ-CYB-005) for exactly this reason. It is a prerequisite, not an afterthought.