How often should a cleanroom be certified?

The baseline schedule

ISO 14644-1:2015 sets the baseline, and the wording it uses is worth reading closely. Clause 5.1 says that at-rest or operational classification "may be performed periodically based upon risk assessment of the application, typically on an annual basis". That is a may and a typically, not a shall. The standard asks you to justify your own frequency and then tells you where most rooms land.

So where does the shorter figure come from? Not from the classification standard. There is no single standard that says certify every six months; USP 797, EU GMP Annex 1 and FDA guidance each set their own, inside their own jurisdiction. Compounding pharmacies work to USP 797, which asks for certification by a qualified independent party before use and at least every six months after that. EU GMP Annex 1 sets six months for Grade A and Grade B, and twelve months for Grade C and D. FDA's aseptic processing guidance, which is explicitly a nonbinding recommendation rather than a regulation, says leak testing should be performed twice a year for the aseptic processing room.

The figure a lot of SOPs cite has an older source than any of those. The 2000 edition of ISO 14644-2 carried a schedule keyed on class. The 2015 revision struck it out, along with the terms clause that defined the frequencies, and handed the frequency question back to the classification standard at clause 5.1. Both of the annexes that survive are informative. So an SOP that names ISO 14644-2 as its authority for how often the room gets tested is citing an edition withdrawn more than a decade ago.

Read the right-hand column rather than the middle one. Two rooms of the same ISO class in two different industries can sit on different schedules, and neither of them is wrong, because the thing setting the schedule is the regulatory environment the room operates in and not the class on the door.

What forces a re-certification early

The calendar is one trigger. Change control is the other, and it is the one that actually protects product. ISO 14644-2:2015 asks for the monitoring plan to be reviewed and revised, and says in as many words that it may be necessary to revise the plan when significant changes are made to the installation or process requirements. FDA's guidance names its own triggers for additional leak testing: air quality found to be unacceptable, facility renovations that might disturb ceiling or wall structures, or an investigation into a media fill or sterility failure.

Re-certify after any of these, before the room goes back to work:

• HEPA or ULPA filter replacement. The seal between filter and grid is remade, and the certificate on the wall describes the old seal
• Any HVAC modification, including the air handler, a fan, a drive, ductwork, a damper, the controls, or a rebalance
• Construction or renovation inside the clean zone
• Construction in adjacent space that shares air handling or a wall. A pressure cascade is a relationship between rooms, not a property of one room
• Room repurposing or a process change. New tools, moved benches and added personnel all alter airflow and particle load
• A failed parameter, a monitoring excursion, or a trend drifting toward its action level
• A contamination event, or an investigation into a sterility failure
• An extended shutdown or idle period, where the air has been still and the state of the room on restart is unknown

The rule of thumb: if the air path changed, the certificate no longer describes the room.

What each test actually measures, and what commonly makes a room fail one, is a separate question with a separate article behind it: why cleanrooms fail certification covers the failure modes and what to do about each of them.

As-built, at-rest, or operational

Every certificate names the occupancy state it was tested in, and ISO 14644-1:2015 clause 4.1 requires that: the class shall be defined in one or more of three states. They are not interchangeable.

Which state you certify in is set by your compliance requirement rather than by convenience. cGMP and USP work generally calls for operational-state data, because FDA guidance puts the emphasis on conditions with personnel present, equipment in place and operations ongoing. New construction proves as-built first, then at-rest as the tools land.

The state also decides when the work can happen. At-rest testing needs the room empty of people with the equipment running, so it lands in nights, weekends or planned downtime. Operational testing needs the process actually running, so it happens during production. A firm that only works business hours cannot certify an operational-state requirement at all.

A room can pass at-rest and fail operational, and that is not a contradiction. People are the dominant particle source in most rooms, which is exactly why the standard defines three states instead of one.

Why a documented history pays for itself

Certification on a cycle builds a baseline, and the baseline is worth more than any single certificate. Filters loading up, a pressure cascade decaying, counts creeping upward: each of those shows up as a trend long before it costs yield, and none of them shows up in one report read on its own.

A documented history also shortens an audit. An inspector reviewing a certification report looks first at who signed it and against what. ISO 14644-1:2015 clause 5.4 already requires the report to identify the instrument and its current calibration certificate, so instrument identifiers and current calibration certificates on the page are not a marketing addition. They are the standard, done where somebody can see it, under credentialed independent supervision.

Regulated customers generally expect certification from an independent party, and an in-house report invites more questions than it answers. That is the honest version of the argument, and it is narrower than the version the trade usually makes. It is not that a self-signed report proves nothing. It is that it costs you time in the one room where your time is most expensive.