Guides / Quality and Compliance

IQ, OQ and PQ for Machined Medical Parts: What Suppliers Actually Run

October 16, 2026

Buyers hear IQ, OQ and PQ on the first supplier call and often nod along without knowing which of their parts it applies to. This guide explains what each stage proves, which processes on a machined medical part usually need it, and what a supplier should be able to hand you.

What the three letters mean

Process validation is the written proof that a process produces a result that meets its requirements, again and again. It is usually split into three qualifications that run in order.

• IQ, installation qualification. The equipment is installed as specified. Records cover the model, the utilities, the software version, the calibration of gauges and sensors and the maintenance plan.
• OQ, operational qualification. The equipment is run across its working range, including the low and high ends of each parameter, to show that it makes acceptable product anywhere inside that range.
• PQ, performance qualification. The process runs under normal production conditions, with the real material, operators and tooling, to show it stays in control over a representative run or runs.

The quality system standard for medical devices, ISO 13485 clause 7.5.6, asks for validation of processes whose output cannot be verified by later monitoring or measurement. That sentence is the whole trigger. Everything else is detail.

Which machining steps need it

Ordinary CNC cutting is usually verified, not validated. If every diameter is measured on a sample plan or on every part, the output has been verified and a validation adds paperwork without adding assurance. The processes around the cutting are different, because you cannot see their result by measuring a dimension.

Process	Why verification falls short	Usually validated
Passivation	Surface chemistry is not visible	Yes
Cleaning	Residue levels need test methods	Yes
Laser marking	Mark must survive later steps	Yes
Heat treatment	Core properties need destructive tests	Yes
Welding	Internal soundness is hidden	Yes
Turning or milling to a measured size	Result is measured on the part	Often not

The device company decides this in its own risk file. A supplier cannot make that call for you, and a supplier who volunteers to validate everything may be pricing it into the quote. Read what the documentation line costs to see how that happens.

What good OQ looks like

OQ is where weak protocols show. A good one challenges the process on purpose.

1. Parameters are named and ranged. Spindle speed, feed, coolant concentration, bath temperature, laser power, whatever the process uses.
2. The extremes are run. Low, nominal and high settings, each producing parts that are measured.
3. Worst-case parts are included. The longest, thinnest or most complex part in the family.
4. Acceptance criteria exist before the run. Written in advance, not adjusted after.
5. Failures are recorded. A protocol where every run passes at every setting should raise a question about whether the challenge was real.

What good PQ looks like

PQ runs with production conditions. Real operators, real lots of the real material, normal tooling and the normal inspection plan. The supplier should be able to show capability on the critical dimensions, commonly as a process capability index. Many device companies ask for a Cpk of 1.33 or higher on critical features, with a higher target for the most safety-relevant ones, but the figure comes from your own file and the number itself is not a standard.

PQ also needs a statement of what makes a re-validation necessary. Typical triggers include a new machine, a change in cutting fluid or bath chemistry, a change of sub-tier processor, a software change that affects the process or a run of out-of-control results. If the supplier cannot name its triggers, put them in the quality agreement.

What a supplier should hand over

Ask for the following before the first production lot, not after.

• The validation master plan or a summary of what is validated and why.
• The signed IQ, OQ and PQ reports for each validated process on your part.
• Calibration records for the gauges and sensors used during the runs.
• The list of change triggers and the re-validation procedure.
• Evidence that operators were trained on the validated procedure.

If the process is run by a sub-tier vendor, such as a passivation or marking shop, the same package should exist for that vendor. The buyer’s contract is with the machining shop, so the machining shop has to hold that evidence. Our guide to passivation and electropolish covers one of those sub-tier steps in detail.

A worked example: a laser mark on an implant

Take a laser mark carrying a UDI and a lot number on a titanium screw head. The mark has to survive passivation, cleaning and sterilization, and you cannot see the damage a later step might do to the mark’s corrosion resistance without testing.

IQ records the laser model, the software version, the lens and the calibration of the power meter used to check output.

OQ runs the laser at low, nominal and high power and at the slowest and fastest marking speeds the procedure allows. Each combination marks parts that are then read with the scanner the end user will use, checked for legibility and put through the downstream steps.

PQ marks production lots with real operators and real parts and shows the result holds across the run, including a check that the marked area still passes the corrosion test the device company has chosen.

The same three-step shape applies to a cleaning line, with bath concentration, temperature and time as the parameters instead of laser power. Our guide to UDI laser marking on machined parts covers what the mark itself has to survive.

Where protocols go wrong

Four weak spots turn up repeatedly in validation packages.

1. No worst case. The protocol runs the easiest part in the family and then claims to cover all of them.
2. Acceptance criteria written afterward. The limits match whatever the runs produced.
3. No link to the drawing. The protocol validates a process, but nobody ties it to the part number and revision that depends on it.
4. No owner for change. A new batch of cleaning chemistry arrives and nobody asks whether it triggers re-validation.

A supplier who can talk through these without defensiveness has usually been through an audit. How to read an ISO 13485 certificate shows how to check that the validated process sits inside the certificate scope.

Cost and timing

Validation is one of the larger one-off costs on a new medical part, and it should be priced as a line item, not folded into the piece price. A rough shape: a single special process on a single part family can take weeks to protocol, run and report, plus the cost of parts consumed in testing. Treat that as typical only. If a quote shows no validation line while your file requires one, the number is either missing or hidden somewhere else.

Questions to put to a supplier

1. Which processes on this part do you validate, and which do you verify?
2. Can I see a recent OQ report from a comparable part with identifying data removed?
3. What are your re-validation triggers?
4. Who writes the protocol and who approves it?
5. How do you handle a sub-tier process that sits outside your own floor?

We match buyers with machining suppliers and the buyer pays us nothing. We do not run validations, we do not audit a supplier and we do not qualify one for you, because that stays in your own quality system. To send a drawing, request a quote and we reply within 24 business hours.

Sources

• ISO 13485:2016, medical devices, quality management systems (clause 7.5.6, validation of processes)

Standards and regulations change. Check the current text at the source before you rely on it in a submission.

Frequently asked questions

Keep reading

• Supplier Change Notification: What a Machining Shop Must Tell You and What You Do With It
• ISO 10993 and Cutting Fluids: How Machining Residue Enters the Biological Evaluation