What Level 2 Production & Process Controls Maturity Looks Like in Medical Device Organizations

You completed IQ/OQ/PQ. Batch records are reviewed before release. In-process inspection catches defects. So why is your scrap rate climbing, why do the same nonconformances recur, and why did the last customer audit find that your process validation doesn't reflect the current equipment configuration?

Level 2 is the plateau where most medical device manufacturers get stuck. The organization has done real work to establish production controls. Validation protocols have been executed. Work instructions are at the workstations. Batch records get reviewed before product ships. Environmental monitoring happens on a schedule. From a distance, the manufacturing operation looks controlled. Up close, the controls are eroding — not because anyone is neglecting them, but because the manufacturing process has changed since they were established, and the mechanisms to keep controls current are missing or broken.

This is validation decay. It is the signature failure mode of Level 2, and it is far more dangerous than the obvious gaps at Level 1 because it looks like compliance.

The Mechanics of Validation Decay

The original IQ/OQ/PQ was completed twenty-two months ago. Since then, the welding horn was replaced with one from a different supplier. The fixture was modified to accommodate a design revision. The adhesive formulation changed when the supplier discontinued the original product. The cleanroom was rebalanced after the HVAC system was serviced. Each of these changes went through some form of change control — a change order was written, engineering reviewed it, and the change was implemented. But in none of these cases did the change control process trigger a revalidation assessment. The validation documentation still describes the original horn, the original fixture, the original adhesive, and the original airflow pattern. The validated state on paper and the actual manufacturing state have diverged.

This is not a hypothetical scenario. It is the single most common finding when auditors examine Level 2 production operations. The organization has a revalidation procedure. It may even reference 21 CFR 820.75(b), which requires that changes to validated processes be evaluated for revalidation. But the procedure is not linked to the change control system in a way that forces the evaluation to happen. Changes flow through engineering change orders. Revalidation assessments sit in a separate quality procedure. Nobody connects the two, and so changes accumulate without triggering the revalidation they require.

Level 2 Tells

Certain patterns reliably indicate that an organization has plateaued at Level 2. Process capability data exists for some parameters on some products, but it is a snapshot taken during validation rather than an ongoing measurement. Nobody can tell you today's Cpk for any critical process — only what it was when the PQ was executed. In-process inspection catches defects, but the same defect types recur quarter after quarter because inspection is finding problems, not preventing them. The inspection data goes into the batch record, gets reviewed during release, and is never aggregated or trended to identify systemic patterns.

Equipment maintenance follows a calendar schedule derived from manufacturer recommendations. The schedule has not been adjusted based on actual equipment performance, because nobody is tracking performance in a way that would inform the adjustment. Preventive maintenance gets done on time, but unplanned downtime remains stubbornly high because the PM tasks are not aligned with the actual failure modes the equipment experiences.

Environmental monitoring data is collected on schedule and recorded in a structured format. Alert and action limits exist for some parameters but not all. When an excursion occurs, the response depends on who discovers it. One quality engineer investigates thoroughly and documents the impact assessment. Another notes the excursion and moves on. The inconsistency is not a personnel problem — it is the absence of a defined response protocol that removes individual judgment from the equation.

Supplier changes are managed through incoming inspection rather than supplier process control. When a material lot arrives with properties near the edge of the specification, it passes incoming inspection and enters production, where it causes the process to behave differently than expected. The resulting yield loss or nonconformance is attributed to a production issue rather than traced back to the incoming material variation that caused it, because the data systems are not connected.

Why the Plateau Persists

Level 2 organizations often remain at Level 2 for years, not because they lack the technical capability to advance, but because the plateau is comfortable. The quality system passes audits. Products ship. Customer complaints are manageable. The regulatory posture is defensible. The scrap rate is higher than it should be and the same NCRs keep recurring, but these are treated as operational costs rather than symptoms of a maturity gap.

The breakthrough to Level 3 requires a philosophical shift that is harder than any technical implementation. It requires the organization to stop treating quality as something verified through inspection and start treating it as something built through process control. It requires investing in statistical process control not as a compliance tool but as an operational nervous system that tells the manufacturing floor what is happening in real time. It requires connecting the change control system to the validation system so that no process change can escape revalidation assessment.

Breaking Through

The concrete actions that move an organization from Level 2 to Level 3 are well defined. Build a process validation master plan that inventories every production process, documents its current validation status, and identifies every change that has occurred since the last validation. This exercise alone typically reveals a startling number of processes operating outside their validated state. Deploy SPC on all critical-to-quality parameters, starting with measurement system analysis to ensure the data is trustworthy. Standardize the environmental monitoring response protocol so that every excursion triggers the same investigation and impact assessment process regardless of who discovers it. Most importantly, wire the change control system to the revalidation procedure so that the connection is automatic and auditable.

These are not small projects. But the alternative is indefinite residence on the Level 2 plateau — passing audits while scrap climbs, the same NCRs recur, and the gap between the validated state and the actual manufacturing state grows wider with every change that does not trigger revalidation.

The MedTechCMM production controls assessment pinpoints exactly where your Level 2 controls are decaying and which specific actions will break through the plateau. Take the assessment at /assessments/production-controls.