Verification checks that you built the thing right: objective evidence that specified requirements were met, such as a dimension inside tolerance or a test passed against a written specification. Validation checks that you built the right thing: objective evidence that the product or process does what the user needs in its intended use. Verification compares output to input requirements; validation compares the result to real use. In manufacturing the same pair applies to processes: you verify a part by inspecting it, and you validate a process when its result cannot be fully checked afterward, such as welding or sterilization.
| Verification | Validation | |
|---|---|---|
| Question | Did we build it right? | Did we build the right thing? |
| Compared against | Specified requirements: drawing, specification, design inputs | User needs and intended use |
| Typical methods | Inspection, measurement, test, analysis, design review | Clinical or field evaluation, simulated use, usability testing, process qualification |
| Who does it | Engineering, quality, inspection | Often users or people representing them, under real or simulated conditions |
| When | Throughout design and production, at each output | On the finished design, or before releasing a process for production |
| Units tested | Can be prototypes or production parts | Production-equivalent units made by the intended process |
| Example | Housing wall measures 2.0 mm against a 2.0 ± 0.1 mm requirement | Nurses open the housing one-handed with gloves in a simulated ward |
In design control, each design input (a requirement) should map to a design output (a drawing, specification or software item), and verification proves the output meets the input. Validation then tests the finished design against user needs, under actual or simulated use. A product can pass every verification and still fail validation if a requirement was missing or wrong. That is the point of doing both.
ISO 9001 clause 8.3.4 asks for both kinds of control on design and development. ISO 13485 gives each its own clause and asks that validation be done on production-equivalent units. The design controls under QMSR article and the design history file guide show where the records go, and the FDA QMSR transition guide is the pillar for this cluster.
On the production side, verification usually means inspecting or testing the output: first article inspection, in-process checks, final inspection. When the result cannot be fully verified by later inspection without destroying the part, or when inspection alone cannot give enough confidence, the process must be validated instead. Welding, soldering, heat treatment, sterilization, sealing and adhesive bonding are typical examples. ISO 9001 calls these processes whose output cannot be verified by subsequent monitoring or measurement.
Process validation is often run in three stages:
Validation and verification both rely on statistics and measurement. Choose sample sizes from a stated confidence and reliability, not from habit. The sample size calculator gives the number for a target margin of error. The gauges used must be capable of seeing the difference, which a gauge R&R study shows. An inspection plan template is a practical way to record what is verified, how, and how often.
A simple plan makes the difference between the two visible on paper. Start with a trace matrix: one row per requirement, with columns for the source (user need or design input), the design output that meets it, the verification method and result, and, for user needs, the validation method and result. Any user need with no validation row, or any design input with no verification row, is a gap.
For each activity, write the acceptance criteria before running it, name the sample size and how it was chosen, and identify the equipment and its calibration status. Use production-equivalent units for validation and record their build configuration. When a test fails, record it, investigate it and decide whether the requirement or the design changes; do not quietly rerun the test until it passes. The same discipline applies to process validation: define the operating window, the qualification runs and the acceptance criteria in a protocol, then report results against that protocol. The ISO 9001 vs ISO 13485 comparison covers where these records sit in a device quality system.
Keep the plan under document control and update it when requirements change. A change to a user need or design input should trigger a check of every verification and validation row that traces to it, so you know which tests must be repeated and which results still stand. Recording that decision, even when the answer is that nothing needs retesting, is what lets an auditor follow the logic later.
Example: Success-run sample size for a fictional seal validation
Result: Example result: 59 pouches with zero failures demonstrates 95% reliability at 95% confidence; 99% reliability needs 299. This is part of PQ. The design validation (can a clinician open the pouch aseptically?) is a separate study. All targets are example values; set yours from the risk of the failure.
Verification usually comes first, output by output during design. Validation follows on the finished design, though planning for both starts at the beginning.
Either. A test against a written specification is verification. A test of whether the product meets the user’s need in real or simulated use is validation.
Installation, operational and performance qualification: the three common stages of process validation. They show the equipment is installed right, that the process works across its window, and that it works consistently at normal settings.
Yes, for design outputs under clause 8.3.4 where design applies, and for production processes whose output cannot be verified afterward under clause 8.5.1.
Evidence that software used in production or in the quality system does what you rely on it to do. ISO 13485 requires it; the effort should scale with the risk of the software failing.
COPLAIN AI PLATFORM
Coplain turns validated process parameters into work instructions operators can follow, so the process you qualified is the process you run.
Generate yours automatically with Coplain →