HVAC and Clean Utilities: 6 Risks to Close Before Your Next GMP Audit

HVAC and clean utilities sit behind more repeat GMP findings than most teams expect. They are the systems that keep a cleanroom clean, hold the pressure cascade, and deliver water, air, gases and steam that touch the product or its contact surfaces. When they drift, the whole contamination control story drifts with them. Inspectors know this, which is why clean utilities and air handling are among the first systems they probe on a facility walkdown. This article sets out six HVAC and clean utility risks that commonly surface in audits, and how to show inspectors you have real control rather than paperwork.

The pattern is rarely a single dramatic failure. It is usually a set of small gaps that, taken together, tell an inspector that the site is not managing its utilities as the contamination control systems they are. Closing them before an audit is far cheaper than explaining them during one.

Why HVAC and clean utilities keep showing up in GMP findings

Air and utilities are shared systems. A single air handling unit, water loop or gas header can serve many rooms and many products, so one uncontrolled parameter can affect a wide slice of the operation at once. That breadth is exactly what makes them attractive to an inspector and risky for a site.

They are also systems that degrade quietly. Filters load, seals age, loops foul, and set points drift long before anything alarms. Without disciplined qualification, monitoring and trending, a site can run for months believing a utility is in control when the data, if anyone looked, would say otherwise. EU GMP Annex 1 and the equivalent FDA expectations treat these systems as central to contamination control, not as background engineering.

The 6 clean utilities and HVAC risks to close before your next audit

The risks below are the ones that most often turn into observations. Work through them as a pre-audit checklist.

• HVAC not requalified after change: Air change rates, pressure cascades, recovery times and containment are qualified at handover and then left untouched through years of modifications. If you cannot show requalification after changes to layout, load or equipment, an inspector will question whether the current state is qualified at all.

• Water systems without a defensible microbial and endotoxin story: Purified water and water for injection loops need controlled sanitization, representative sampling, and alert and action limits that are actually trended. Missing points of use, stagnant sampling, or limits that are never reviewed are common findings.

• Compressed air and process gases untested at the point of use: Gases that contact product or surfaces need testing for particulates, water, oil and microbial content at the point of use, not just at the compressor. Sites often qualify the generation skid and forget the distribution.

• Clean steam quality left unproven: Where clean steam sterilizes or contacts surfaces, its quality needs testing for non-condensable gases, dryness and superheat. Assuming clean steam is fit because the generator is validated is a gap auditors look for.

• HEPA filter integrity and airflow visualization gaps: Overdue filter integrity tests, missing or outdated airflow visualization studies, and no evidence of recovery after an intervention all undermine the claim that the room protects the product.

• Monitoring and trending that goes nowhere: Data is collected but alert and action limits are not challenged, trends are not reviewed on a defined cadence, and excursions are not linked to batch disposition. An inspector reads this as monitoring for the file rather than for control.

How to prove control before the auditor arrives

The common thread across all six risks is evidence of an ongoing lifecycle, not a one-time qualification. Inspectors want to see that each clean utility was qualified, is monitored against justified limits, is trended, and is requalified when it changes.

Start by reconciling the current physical state of each system against its qualification package. Confirm that every change since handover was assessed and, where needed, requalified. Then check that sampling and testing plans cover every point of use that matters, that limits are justified and periodically reviewed, and that trend reviews are documented and feed into decisions. Where you rely on a contractor for testing or maintenance, make sure that oversight is visible in your own quality system. A structured approach such as Contamination Control by Design ties HVAC and clean utilities into a single contamination control story rather than a stack of separate reports, and a focused design, CQV and validation review can close qualification gaps before they become observations. If an audit is close, a GMP audit readiness review will pressure-test your utilities story the way an inspector would.

Closing these gaps early does more than avoid a finding. It gives your team a defensible, data-backed account of why the air, water, gases and steam feeding your process are under control.

Frequently asked questions

What counts as a clean utility in GMP?

Clean utilities are the systems that deliver controlled air, water, gases and steam to a GMP process, including HVAC, purified water and water for injection, compressed air and process gases, and clean or pure steam. They are treated as contamination control systems because their quality directly affects the product and its contact surfaces.

How often should HVAC and clean utilities be requalified?

There is no single fixed interval. Requalification is driven by risk and by change. Systems should be requalified on a periodic basis defined in your validation policy and, critically, after any change to layout, load, equipment or use that could affect performance. The key is a documented rationale, not a calendar date alone.

Which clean utility finding is most common in audits?

Monitoring and trending gaps are among the most frequent. Sites often collect data but cannot show that alert and action limits are justified, that trends are reviewed on a defined cadence, or that excursions are linked to batch disposition. The data exists but the control loop is incomplete.

Can we rely on our HVAC or water contractor for qualification evidence?

You can use contractors to perform testing and maintenance, but the responsibility for the evidence and its adequacy stays with you. Contractor work needs to be specified, reviewed and integrated into your own quality system, with clear oversight, so that you can defend it in an inspection.

Kieran Falvey is Founder and Managing Director of Pharmalliance Consulting Ltd and the creator of Contamination Control by Design (CCbD). He has more than 20 years designing, building and running pharmaceutical facilities worldwide, across FDA, EMA, TGA, PIC/S and Indian FDA (CDSCO) jurisdictions. Global expert in cGMP Compliance, Remediation and Contamination Control, helping Sterile, Non-Sterile, ATMP and Cosmetic companies navigate cGMP compliance issues.

Pharmalliance Consulting is a GMP compliance consultancy serving pharmaceutical, sterile, non-sterile, OSD, ATMP and cosmetic manufacturers in Ireland, the UK, the EU and the US. It helps sites identify and remediate GMP risks across facilities, quality systems and contamination control, aligned with HPRA, MHRA, EMA and FDA expectations, turning findings into defensible, inspection-ready practice.

If your next audit is approaching, Pharmalliance can review your HVAC and clean utilities against inspector expectations and close the gaps before they become findings. Talk to us about a clean utilities and contamination control review.