Buy a LIMS, install it, train the lab, ship samples. That’s the user’s mental model. Then an FDA inspector asks “show me the validation package” and the room goes quiet.
Validating a LIMS for the FDA isn’t one task — it’s a binder of evidence that the system was installed correctly, operates as designed, and does the specific job your lab needs it to do. Here’s what that binder actually contains, who’s responsible for which page, and the mistakes that turn a 3-month validation into a 9-month validation.
The three-layer pyramid
Validation answers three questions, in order. Each answer becomes a section of the binder.
IQ — Installation Qualification
“Is the system installed correctly?”
Hardware specs verified. Software versions captured. Network paths documented. User accounts created in the right way. The IQ is the foundation — it answers environmental questions before you ever click anything. Vendor-supplied for SaaS LIMS, run on-site for on-prem.
OQ — Operational Qualification
“Does the system operate as designed?”
Run the vendor’s standard test scripts against the installed system. Confirm login works, audit trails capture changes, e-signatures bind to records, reports generate, integrations transmit data. The OQ is largely scripted — the vendor usually provides 80% of the test cases.
PQ — Performance Qualification
“Does the system do what YOUR lab actually needs?”
This is the layer most validations underinvest in — and the one inspectors care about most. PQ tests business-specific workflows: your sample lifecycle, your approval chain, your COA template, your specific calibration schedule. The vendor can’t write your PQ scripts because they don’t know your SOPs.
Who is responsible for what?
Validation responsibility is a triangle between three parties. Misalignment here is the most common reason validations slip.
- Vendor (LIMS provider): IQ scripts + standard OQ scripts + vendor-side change-control documentation.
- QA team (yours): PQ scripts + approval workflows + final sign-off. The QA team owns the binder, even if engineering writes it.
- IT / IT validation specialist (yours or contracted): Execution of test scripts, evidence capture, traceability matrix maintenance.
The artifacts in the binder
An auditor opens the validation binder expecting to find, in order:
- Validation plan (VP) — approved before any scripts run
- User requirements specification (URS) — what the lab needs the system to do
- Functional specification (FS) — how the vendor implements it
- Design specification (DS) — for any custom code or integrations
- Risk assessment — graded by impact on patient safety and data integrity
- IQ scripts + executed results
- OQ scripts + executed results
- PQ scripts + executed results
- Traceability matrix — every requirement traced to a test
- Validation summary report (VSR) — final sign-off
Each script lists steps, expected results, actual results, pass/fail, and a tester signature with date. Screenshots where the result isn’t self-evident.
Mistakes that slow everything down
- Writing the URS after picking the vendor.Backwards. The URS drives which LIMS you should pick. Otherwise you’ll bend the requirement to the vendor’s features.
- Treating PQ as “more OQ.”If your PQ scripts look just like the vendor’s OQ, you skipped the actual job. Auditors notice.
- No risk assessment.Risk grading lets you justify what gets tested deeply and what gets a light touch. Skip it and you’ll either over-test everything (slow) or under-test critical paths (findings).
- Validation running parallel to configuration. Validation runs after configuration is frozen. Otherwise you’re re-running scripts every sprint.
How we approach this
We bundle validation deliverables with LIMS Pulse — IQ + OQ scripts ship pre-built, PQ templates configurable to your SOPs, and a validation lead works alongside your QA team. Typical timeline: 6–10 weeks end-to-end including dry-run inspections. For more on the underlying compliance controls, see our piece on 21 CFR Part 11 in plain English.
Takeaways
- Validation = IQ (installed) + OQ (operates) + PQ (does YOUR job).
- The binder is the answer, not the demo.
- Vendor + QA + IT each own pieces — misalignment is the slow-down.
- URS first, vendor second. Doing it backwards costs a quarter.
- PQ is the layer most labs underinvest in. Don’t.
