Audit-Ready from Day One: The IQ/OQ and GxP Questions Regulated Laboratories Should Ask

Buying a spectrophotometer for a regulated laboratory is a different exercise from buying one for a teaching lab or a discovery group. The instrument has to perform, but it also has to be demonstrably fit for purpose in a way that survives inspection. Installation Qualification (IQ) and Operational Qualification (OQ) are the documents that carry that burden, and GxP software options determine whether the data the instrument produces can stand up to a data-integrity review. Too often, labs select an instrument on optical specifications and only later discover that the qualification package, the audit trail, or the service model does not match their quality system. The questions below are the ones worth asking before the purchase order is raised — not after the instrument is bolted to the bench.

What IQ/OQ Documentation Must Cover — and the Questions Most Laboratories Forget to Ask

Installation Qualification is a documented demonstration that the instrument has been received, installed, and configured as intended. It typically captures site conditions, power and environmental requirements, serial numbers, firmware and software versions, accessory inventory, and the training records of the operators. Operational Qualification goes further: it is a set of tests, run against pre-defined acceptance criteria, that demonstrates the instrument performs within specification across the range you intend to use. For a UV/Vis spectrophotometer, that usually means wavelength accuracy and reproducibility, photometric accuracy and linearity, stray light, baseline flatness, resolution or bandwidth, and noise.

The first question to ask is who executes the protocol and who signs off. Some vendors deliver a factory IQ/OQ package executed by a service engineer; others provide template protocols that your own quality unit executes and approves. Neither is inherently better, but the model has to match your SOPs and your supplier qualification process. The second question is whether the protocol actually covers both measurement modes. Many microvolume instruments are sold as dual-mode devices, and an OQ that only qualifies the cuvette path leaves half the instrument unqualified. Ask explicitly how the microvolume path lengths and their dilution factors are verified, and how the cuvette compartment — including any temperature control — is qualified. On a NanoPhotometer® NP80, for example, the published specifications that would anchor acceptance criteria include wavelength accuracy of ± 0.75 nm, wavelength reproducibility of ± 0.2 nm, bandwidth of better than 1.5 nm, absorbance accuracy of less than 1.75% at 0.7 A at 280 nm, and stray light below 0.5% at 240 nm using NaI. The microvolume path lengths are 0.67 mm and 0.07 mm with dilution factors of 15 and 140, while the cuvette mode lists a Z-height of 8.5 mm and heating at 37 °C ± 0.5 °C. Each of these is a candidate acceptance criterion — the question is whether your OQ protocol states a limit for it and whether that limit is tight enough for your method.

Ask, too, about traceability of the reference standards used during qualification. Holmium oxide or holmium perchlorate filters, neutral density or potassium dichromate solutions, and certified stray-light standards all have to be traceable and within their calibration validity on the day of execution. Finally, ask what happens after a firmware update. If a software upgrade changes the operating system or the measurement algorithms, your validated state may need re-verification, and the vendor should be able to tell you in advance what that entails.

GxP Software Options and 21 CFR Part 11: Data Integrity Questions Before You Sign

The single most common misunderstanding in regulated laboratories is assuming that an instrument is 21 CFR Part 11 compliant because a vendor mentions Part 11 on a brochure page. In practice, electronic records and electronic signatures are usually delivered by an optional software module, not by the base instrument. Get this clear at the quoting stage: which functions are native, which require a licence, and which require an additional validation package.

Once that is settled, the questions become quite specific. Is the audit trail always on, and can any user — including an administrator — disable it? A compliant audit trail is computer-generated, time-stamped, and cannot be switched off. How is user management structured? You need role-based access control, enforced password policies, and a defined process for leavers and role changes. How are electronic signatures bound to records? A signature that can be copied onto a different record is not a signature. What happens to data during a power interruption? And how are records exported, archived and restored — in a format that remains readable and attributable years later?

Instrument-level design matters here as much as software. An operating system that does not permit internet browsing, such as the proprietary NPOS environment described for the NanoPhotometer® NP80, reduces the attack surface and simplifies your cybersecurity risk assessment — but you should still document it as a control rather than an assumption. The availability of file-server access, PDF and Excel output, full-page report printing, and 1D/2D barcode readers for sample identification all feed into your records architecture and should be mapped against your data-integrity requirements before validation begins. It is also fair to ask the vendor whether IQ/OQ templates exist for the compliance software itself, not just for the optics, and whether the optional CFR21 module is documented in the same qualification package. Ambiguity here is what turns a three-week validation into a three-month investigation.

Method Transfer, Design Claims, and Support: Questions That Shape Your Long-Term Validation Strategy

Some instrument designs make claims that regulated laboratories must handle carefully. Implen states that its True Path Technology™ uses two fixed anchor points that remain unchanged over the lifetime of the instrument and that no recalibration is necessary; the product page also describes a robust design without the need for routine calibration checks, and the company guarantees lifetime accuracy as its own claim. None of that removes your obligation to verify performance periodically. The right question is not “can we skip OQ?” but “what documentation supports the claim, and how does the manufacturer expect a GxP laboratory to verify it at each scheduled interval?” Ask for the design rationale, the recommended verification frequency, and any field data the vendor is willing to share. That conversation, held before purchase, tells you a great deal about how the supplier behaves during an audit.

The same applies to data-quality features. Sample Control™, which the manufacturer describes as automatic detection of air bubbles, impurities, turbidity, lint residue and potential contamination, and Blank Control™, aimed at high-background blanks and carryover, are genuinely useful for routine work — but your validation should demonstrate that they behave acceptably for your sample matrices and that operators understand when to override them. Method transfer raises parallel questions. Preprogrammed methods for nucleic acids with 260/280 and 260/230 ratios, protein UV, dye-labelled nucleic acids and proteins, OD600, Bradford, BCA and Biuret assays, kinetics and wavescan still require laboratory-specific verification, even when the algorithm is supplied by the vendor and cannot be edited. Ask what the vendor provides in the way of method documentation and reference materials to support that work, and whether the cuvette option — described as spectral resolution below 1.5 nm and optimised for OD600 and protein assays — is qualified alongside the microvolume mode. The DiluCell™ 10, which the page says extends the cuvette photometric range to 26 OD through automatic 1/10 dilution, is another feature that may warrant its own verification step.

When you are comparing UV-Vis Spectrophotometers for a GxP environment, the decisive factor is rarely the headline specification — a scan range of 200 – 900 nm and a minimum sample volume from 0.3 µl are useful, but they will not carry your validation. What carries it is the quality of the qualification documentation, the transparency of the compliance software, and the responsiveness of the support organisation. Ask who performs on-site qualification, how application support is delivered (Implen describes live application support 24/5 as a company claim), what training is included for operators and reviewers, and how service interventions are documented so that the instrument’s validated state is preserved. Those answers, more than any specification table, determine whether your spectrophotometer is an asset or a recurring finding.