Validation Master Plan (VMP): Contents and Example Outline

In short: A validation master plan (VMP) is the site-level document that says what will be qualified and validated, how, by whom and when. This article explains what regulators expect of a VMP, gives an example outline with a short note on each section, and links to the related validation topics. It is for QA, validation and production staff. The outline is illustrative; adapt it under your own quality system.

What a VMP is

A VMP is the top document of a site’s qualification and validation programme. It does not contain test data. It sets the policy and strategy, lists what must be qualified or validated, assigns responsibility, and points to the SOPs, protocols and reports that do the detailed work.

EU GMP Annex 15 (Qualification and Validation, European Commission, 30 March 2015, in operation from 1 October 2015) says in section 1.4 that the key elements of the site’s qualification and validation programme should be clearly defined and documented in a VMP or an equivalent document. Section 1.5 says the VMP should define the system and include or reference at least:

1. the qualification and validation policy;
2. the organisational structure, with roles and responsibilities;
3. a summary of facilities, equipment, systems and processes on site, with their qualification and validation status;
4. change control and deviation management for qualification and validation;
5. guidance on developing acceptance criteria;
6. references to existing documents; and
7. the qualification and validation strategy, including requalification where applicable.

Section 1.6 adds that for large and complex projects separate validation plans may make things clearer, and section 1.7 expects a quality risk management approach, with risk assessments repeated as knowledge grows.

PIC/S has a companion document, PI 006, “Recommendations on Qualification and Validation”. The current version is PI 006-4 (published July 2026, in force from 1 October 2026), which replaces PI 006-3 (2007, “Recommendations on validation master plan, installation and operational qualification, non-sterile process validation, cleaning validation”). Its section 3 on the VMP says the plan should be risk-based and scientifically sound, present an overview of the whole programme, and include an inventory of facilities, utilities, equipment, systems and processes with a schedule for completion and for lifecycle review. It also says a VMP helps the team understand their tasks and helps inspectors see how activities are planned and managed.

Why the VMP matters

• It shows an inspector in one document how validation is organised on the site.
• It keeps equipment, utilities, processes, cleaning and methods from being missed or validated twice.
• It gives a schedule and a status list, so overdue requalifications are visible.
• It makes sure the same acceptance-criteria logic, protocol format and deviation rules are used by everyone.

Example VMP outline

The sections below follow the Annex 15 minimum list and common industry practice. Treat the order as a template, not a requirement.

1. Title page and approval

Document number, version, effective date and signatures of the authors, reviewers (production, engineering, QC) and QA approver. The VMP is a controlled document, so its version history belongs here.

2. Table of contents, abbreviations and glossary

Define terms such as IQ, OQ, PQ, URS, CPP, CQA and revalidation once, so that all protocols use the same meaning.

3. Validation policy

A short statement of management intent: what is validated, that it follows a lifecycle approach, and that products and processes are not released from a state of control without it.

4. Philosophy and approach

How validation is carried out on this site: risk-based, linked to the product lifecycle, with the level of effort matched to the risk. This section is where you describe qualification stages (URS, design, IQ, OQ, PQ) and the use of vendor documents.

5. Roles and responsibilities

Who writes, reviews, executes and approves protocols and reports (production, QC, engineering, QA, external contractors). Annex 15 expects quality oversight across the whole validation lifecycle.

6. Resources and training

Staff, equipment and time needed to complete the plan, and how personnel are trained in the procedures they follow.

7. Outsourced services

How contractors, calibration or validation vendors are selected, qualified and managed. Annex 15 section 2.6 expects site personnel to confirm that third-party protocols suit the site and meet internal procedures before approval.

8. Site and facility description

A summary of the facility, with layout drawings and flow diagrams as annexures, so a reader understands the scope.

9. Scope and inventory

The core of the VMP: a list of premises, utilities, equipment, systems, processes, cleaning procedures, analytical methods and computerised systems that need qualification or validation, with the present status of each. Group similar equipment where justified.

10. Qualification and validation activities

A short subsection, with the approach and a reference to the controlling SOP, for each area:

• premises and HVAC qualification;
• utilities (purified water, compressed air, steam, nitrogen); see high purity water systems;
• equipment qualification (IQ, OQ, PQ); see qualification stages;
• process validation;
• cleaning validation; see principles of cleaning validation, cleaning validation protocol format and cleaning validation tips and best practice;
• analytical method validation and analyst qualification;
• computerised system validation.

11. Documentation

The documents needed in each activity (URS, protocol, report, certificates, drawings, SOPs) and how they connect. Annex 15 section 2.3 asks that the relationships between documents in complex projects be clearly defined. Include a protocol and report template or reference, and describe how they are prepared, reviewed and approved.

12. Acceptance criteria

Guidance on how acceptance criteria are set, based on product and process knowledge, and who can approve them. Changes to criteria after approval need scientific justification (Annex 15 section 2.9).

13. Change control and deviation management

How changes to qualified systems are assessed for revalidation, and how deviations during execution (for example failures against acceptance criteria) are recorded and investigated. Annex 15 sections 2.7 and 2.8 cover this for validation protocols.

14. Quality risk management

How risk assessments are used to decide scope and depth, and how they are revisited when new information emerges (Annex 15 section 1.7).

15. Lifecycle management, requalification and revalidation

The strategy for keeping systems in a validated state: periodic review, requalification triggers (changes, trends, failures) and the policy for retiring equipment. Do not write fixed frequencies unless your own risk assessment supports them.

16. Validation matrix and schedule

A table that shows each system against its URS, IQ, OQ, PQ or validation status and due date. Many sites keep this as a live annexure or spreadsheet that is updated without reissuing the whole VMP.

17. Relationship with other quality system elements

Link to the quality manual, document control, training, calibration, preventive maintenance, change control, CAPA and annual product quality review.

18. VMP review and revision

The VMP should be reviewed at defined intervals and updated when the site, the products or the GMP expectations change. Many sites choose an annual review; the interval is your decision, and changes should go through document change control.

19. References and annexures

Applicable guidelines, SOP list, facility drawings, equipment list and the validation matrix.

Common mistakes

• Treating the VMP as a one-time document written for an audit.
• Listing equipment but not the status or the schedule.
• Copying a template that mentions items the site does not have (for example, sterile areas) or omits ones it does.
• No link between the VMP and change control, so changed equipment is never requalified.
• Missing signatures and uncontrolled versions.

Frequently asked questions

Is a VMP mandatory?

EU GMP Annex 15 expects the key elements to be defined in a VMP “or equivalent document”. The format is flexible; the content is not. Check the requirements of your regulator and customers as well.

Does one site need one VMP or several?

One site-level VMP is common. Annex 15 section 1.6 notes that for large and complex projects, separate validation plans can add clarity, and PIC/S PI 006 mentions using a VMP-style master plan for projects such as a new facility.

What is the difference between a VMP and a validation protocol?

The VMP describes the overall approach and inventory. A protocol covers one activity: what will be tested, how, and with what acceptance criteria.

How often should the VMP be updated?

Whenever the facility, products, processes or regulations change, and at a set review interval defined in your procedure. The interval is not fixed by Annex 15.

References

1. European Commission, EudraLex Volume 4, EU Guidelines for GMP, Annex 15: Qualification and Validation, Brussels, 30 March 2015 (deadline for coming into operation 1 October 2015), sections 1 and 2.
2. PIC/S, PI 006-4, Recommendations on Qualification and Validation, 1 October 2026, section 3 (Validation Master Plan); supersedes PI 006-3 (25 September 2007). In force from 1 October 2026.