Regulated LC-MS workflows: Part 1 of a 3-part compliance blog series

Series premise: Compliance is not completed at installation. It begins with intended use and system selection, continues through qualification and controlled operation, and remains essential through software transitions and retirement.

Whether supporting pharmaceutical quality control, bioanalysis, clinical research, environmental testing, or food safety applications, regulated laboratories share a common responsibility: ensuring reliable data, maintaining audit readiness, and controlling systems throughout their lifecycle. Yet when compliance discussions arise, attention often moves quickly to audits, documentation, electronic records, and standard operating procedures. These elements are essential, but they depend on a more fundamental question: Can the analytical system consistently produce reliable results?

For LC-MS laboratories, compliance begins before the first sample is run. A defensible program starts with clear intended use, defined requirements, risk-based planning, supplier assessment, and a qualification strategy that considers the complete system. FDA software validation guidance recommends validation and verification throughout the software lifecycle. USP General Chapter <1058> provides a risk-based, integrated framework for demonstrating that analytical instruments and systems are fit for intended use. EU GMP Annex 11 requires the application to be validated and the IT infrastructure to be qualified, with risk management applied throughout the computerized system lifecycle. [1, 4, 5]

Compliance is a lifecycle, not a milestone

Many laboratories experience compliance as major events: qualification projects, validation exercises, software upgrades, audits, or inspections. In practice, compliance is a continuous process that spans the analytical system lifecycle. Installation and setup, instrument qualification, routine operation, preventive maintenance, performance monitoring, change management, software validation, and requalification all contribute to the same goal: maintaining confidence that the system remains fit for its intended purpose.

The challenge for laboratory leaders is to keep compliance from fading into the background once an instrument enters routine operation. A system that was qualified on day one must continue to perform months and years later. That ongoing state of control is especially important in digital LC-MS workflows, where the instrument, software, interfaces, records, and supporting infrastructure all influence data quality and integrity.

Confidence starts with support from the right vendor

A vendor should contribute more than hardware and an installation date. For a regulated laboratory, supplier capability should be evaluated for product documentation, development and testing evidence, implementation support, defect handling, qualification support, training, and long-term service. When software comes from another developer, FDA guidance states that the regulated party should assess the adequacy of the developer’s activities and determine what additional evidence is needed for the intended use. [1]

That assessment matters because time to operation and compliance readiness are connected. Early planning can prevent qualification gaps from becoming schedule risks. It can also help the laboratory determine which records, protocols, testing evidence, service documentation, and support activities will be needed to defend the system during internal review or regulatory scrutiny.

Qualify the complete LC-MS workflow

Integrated LC-MS performance depends on each critical component being correctly installed and operating as specified. The qualification strategy should address the LC, mass spectrometer, acquisition and processing software, instrument control connections, and any peripheral, interface, security, storage, or network component that supports the regulated workflow. Component qualification builds confidence in each element. Integrated testing then demonstrates that the complete LC-MS workflow performs as intended.

• Liquid chromatography system and critical modules
• Mass spectrometer
• Acquisition, processing, review, and reporting software
• Instrument-to-software and LC to MS communication
• User access, roles, audit trails, and electronic record controls

Installation qualification: establish the controlled baseline

Installation qualification, or IQ, provides documented evidence that the system and its components were received, installed, and configured according to approved requirements in a suitable environment. IQ establishes the baseline for future maintenance, investigations, and changes.

Necessary IQ activities:

• Verify manufacturer, model, serial number, asset identifier, and physical condition for each component.
• Confirm that purchased hardware, software, accessories, manuals, and required certificates were received.
• Record software, firmware, driver, operating system, and relevant interface versions.
• Verify laboratory utilities and environmental prerequisites, including power, location, temperature, humidity, network, and storage requirements where applicable.
• Document installation of hardware, software, cables, fluidic connections, peripherals, and instrument control connections.
• Verify basic startup, self-tests, and communication between connected components.
• Record deviations, corrective actions, approvals, and the final IQ disposition.

Operational qualification: demonstrate operation against specifications

Operational qualification, or OQ, provides documented evidence that the installed system operates according to predetermined operational and functional specifications in the laboratory’s selected environment. OQ should test critical functions and controls.

Necessary OQ activities:

• Test defined LC functions and performance characteristics relevant to intended use, such as flow, gradient, injector, temperature, pressure, or detector performance as applicable.
• Test defined MS functions and performance characteristics relevant to intended use, such as calibration, mass accuracy, resolution, sensitivity, stability, or other platform-appropriate specifications.
• Verify software functions used for acquisition, processing, review, calculation, reporting, and record management.
• Challenge security and data integrity controls, including authorized access, roles, audit trails, electronic signatures, record protection, and relevant backup or retrieval functions.
• Test interfaces and communication under representative conditions.
• Record expected results, actual results, objective evidence, deviations, reviewer conclusions, and final approval.

Software validation: the often-forgotten foundation of data integrity

Qualification programs often focus on pumps, autosamplers, detectors, and mass spectrometers while treating software as an installation detail. In a digital laboratory, that approach leaves a significant gap. Software controls instrument operation, data acquisition, processing, calculations, review, reporting, user access, audit trails, electronic signatures, and electronic records. If those functions are relied upon for regulated work, the software should be validated for its intended use. FDA guidance recommends lifecycle validation and verification activities, while EU GMP Annex 11 states that the application should be validated and the IT infrastructure qualified. [1, 5]

Why software validation cannot be an afterthought

FDA defines data integrity as the completeness, consistency, and accuracy of data and states that data integrity is critical throughout the GxP data lifecycle. Software validation provides evidence that the functions used to create, modify, process, maintain, archive, retrieve, transmit, and protect regulated data work as intended. [3]

Software validation should address:

• Documented intended use and approved user requirements for critical software functions
• Risk assessment that considers product quality, patient safety, data integrity, system complexity, and the degree of automation
• Installation and configuration evidence for the application, operating environment, interfaces, versions, security settings, and relevant infrastructure
• Testing of instrument control, acquisition, processing, calculations, review, reporting, record retrieval, and other functions relied upon for regulated use
• Testing of data integrity controls such as authorized access, roles, audit trails, electronic signatures, record protection, backup, restore, and archival where applicable
• Traceability from requirements and risks to test cases, expected results, actual results, objective evidence, deviations, and approval
• Predetermined, objective pass/fail criteria that allow an independent reviewer to determine whether each test met its acceptance requirements
• A validation summary and release decision confirming whether the software is fit for its intended use

Lifecycle control after initial validation

Software validation does not end at go-live. Changes such as patches, upgrades, configuration changes, new interfaces, operating system changes, database or infrastructure changes, and migrations should be assessed through change control. FDA guidance addresses validation after change. EU GMP Annex 11 calls for lifecycle risk management. EU GMP Annex 15 requires planned changes that may affect quality to be formally documented and their effect on validated status assessed. [1, 5, 6]

In today’s digital laboratory, instrument qualification and software validation are complementary controls. Hardware qualification establishes confidence in the physical analytical system. Software validation establishes confidence in the digital functions that generate, evaluate, manage, and protect the resulting records. Both are needed before the integrated LC-MS workflow can be considered ready for regulated use.

Add an integrated LC-MS test

Passing component IQ and OQ does not by itself demonstrate that the complete workflow works together. After component qualification, an integrated LC-MS test should verify instrument control, sequence execution, LC-to-MS communication, acquisition, processing, review, reporting, record creation, and retention under conditions representative of the intended use.

Qualification documentation must be auditable

A protocol should be approved before execution and should identify the system, scope, responsibilities, prerequisites, test method, expected result, acceptance criteria, required evidence, and deviation process. Documentation should allow an independent reviewer or auditor to reconstruct what was planned, what was performed, what occurred, who performed and reviewed the work, and why the system was accepted or rejected.

• Use unique requirement and test identifiers to support traceability
• Define clear, objective pass/fail criteria before testing. Avoid subjective statements such as “looks acceptable” or “works properly”
• Record actual results, not only a checked box or conclusion
• Retain attributable evidence such as instrument outputs, reports, logs, screenshots where appropriate, raw data, and calibration records
• Document deviations, investigations, corrective actions, retesting, and impact assessments
• Include tester and reviewer names, signatures or approved electronic signatures, and dates
• Issue an approved summary or qualification report that states whether acceptance criteria were met

Service helps preserve the qualified state

Even the most robust analytical instruments change over time. Pumps experience mechanical wear, sources accumulate contamination, consumable components age, and performance characteristics can evolve under routine use. None of these changes necessarily indicates failure. However, they can gradually influence system performance, increase investigation risk, and affect confidence in analytical results.

Service is often viewed through the lens of uptime and productivity. Those outcomes matter, but service also supports compliance objectives by helping laboratories maintain instrument reliability, preserve traceability, reduce compliance risk, and demonstrate ongoing control. Preventive maintenance reports, service records, calibration documentation, performance verification reports, and related evidence contribute to the documented history that inspectors, auditors, and internal reviewers may need to understand how an instrument was maintained throughout its operational life.

Build compliance into daily operations

Maintaining compliance does not require separate quality and service programs. The most effective organizations integrate responsibilities, schedules, records, and performance review into one operational framework. Clear ownership helps ensure that qualification activities, maintenance scheduling, documentation management, performance monitoring, and change control do not fall between teams.

Standardized maintenance practices should reflect instrument criticality, utilization, regulatory requirements, and manufacturer recommendations. Regular reviews of indicators such as sensitivity trends, calibration performance, system suitability results, and utilization of metrics can help laboratories identify issues before they affect data quality. Accessible documentation is equally important. During an inspection, the ability to retrieve qualification, service, and performance records quickly often reflects the maturity of the laboratory’s quality system.

Nine questions every regulated laboratory should ask

• Can the service provider supply specifications and qualification support for each critical component?
• Are IQ and OQ protocols based on clear pass/fail criteria in the installed environment?
• How are software, firmware, configuration, security, and interfaces documented?
• What integrated LC-MS testing is available to identify gaps between components?
• Are acceptance criteria objective, measurable, and established before execution?
• Can a reviewer trace each requirement to a test, result, evidence, deviation, and approval?
• What changes require partial or full requalification?
• How will the supplier support the system beyond its initial qualified or validated state, including ongoing maintenance, software updates and upgrades, lifecycle management, change control activities, and future migrations?
• Does the qualification package provide comprehensive, audit-ready documentation that can withstand technical review and regulatory scrutiny?

If any of these questions are difficult to answer, there may be an opportunity to strengthen the connection between service, quality, and compliance. A qualified system should be supported by complete, traceable, reviewable evidence that clearly shows a pass or fail against predetermined criteria.

Conclusion

Regulatory compliance is often discussed in terms of documentation, procedures, and inspections. Yet any of those activities ultimately depend on confidence in the systems generating laboratory data.

• Qualification establishes the foundation
• Software validation helps protect the digital functions that create and manage regulated records
• Service, maintenance, and performance monitoring help preserve confidence throughout the instrument lifecycle.

For regulated LC-MS laboratories, compliance is not a single event or annual exercise. It is the continuous demonstration that instruments, software, records, and supporting processes remain capable of producing reliable, defensible results. When qualification service and quality practices work together, laboratories are better positioned to support data integrity, maintain operational efficiency, and remain inspection-ready every day.

Call to action

Explore how SCIEX service, qualification, and support solutions can help your laboratory maintain instrument confidence, strengthen compliance readiness, and support consistent analytical performance throughout the instrument lifecycle. Start the conversation today with your local SCIEX service expert.

Reference table