Why Testing the Finished Lot Proves Nothing

Sterility is not a property that can be measured on a finished device. It is a probability statement about the whole lot, and the arithmetic does not work at the scale a laboratory can sample. A sterility test on twenty units tells you almost nothing about whether one organism in ten thousand survived.

Worse, the test has a meaningful false-positive rate — on the order of one in a hundred under typical conditions — so a positive result is as likely to be a handling artefact as a genuine process failure. A method that cannot confirm a pass and cannot reliably confirm a fail is not a release criterion. The sampling arithmetic is worked through in SAL 10-6 versus sterility testing.

That is the reason ethylene oxide is classified as a special process. The outcome depends on a chain of parameters — gas concentration, humidity, temperature, dwell time, load configuration — none of which is visible on the finished product. Control has to be designed in and then demonstrated, because it cannot be inspected out.

What Validation Actually Delivers

EO sterilization validation is not a certificate. It is a defined experimental sequence that produces three things a manufacturer cannot operate without.

• Evidence that the target SAL is achievable. The half-cycle, short-cycle and full-cycle runs defined in ISO 11135 demonstrate that the process, as configured for this specific load, reaches the sterility assurance level you claim on the label.
• The routine cycle parameters. The validated window becomes the working recipe — the setpoints that every subsequent production load must run inside.
• The controlled documentation. A validation report that describes the covered product family, the load pattern, the packaging, the raw data and the analysis. This document is what an auditor or a notified body will ask for.

The sequence itself — how many half-cycles, how a short cycle ranks resistance, what a full cycle is meant to stress — is set out in the three cycles of EO validation.

Who Owns the Responsibility

Providing a compliant device is the duty of the company whose name goes on the label — the legal manufacturer, not the sterilization subcontractor. Regulators can only designate the manufacturer as the responsible party, so that is where the obligation sits regardless of who physically turns the valve.

A manufacturer can transfer work to a sterilization provider by contract. It can transfer tasks, and it can transfer operational control of the chamber. What it cannot transfer is the liability. If the process is not validated, the manufacturer carries the consequence, not the supplier.

This matters commercially as well as legally. When a recall or a field action is traced back to a sterilization non-conformance, the question asked is not “who ran the cycle” but “who was supposed to have proven the cycle”.

Why “My Product Is Similar” Fails

The most expensive misconception about EO sterilization validation is that a device resembling something already validated can simply join that load. It cannot, for a reason that has nothing to do with the device design.

Microbial challenge is a property of the manufacturing environment, not of the product drawing. Two factories making the same catheter will carry different bioburden — different counts and different species — because the cleanroom, the water system, the equipment and the operators differ. A cycle validated against one plant’s bioburden may be inadequate against another’s.

Similarity of form is not similarity of challenge. Validation is always site-specific and product-specific, which is why every customer gets its own protocol and its own report rather than a shared family document.

Why a Borrowed Report Is Unusable

Four independent reasons stop a manufacturer from adopting another company’s EO sterilization validation report, and any one of them is sufficient.

1. Confidentiality. The report describes a specific customer’s product, packaging and drawings. It is contractually bound to that customer and cannot be released to a third party.
2. No raw data. A report is an analysis of measurements. If the cycle never ran for your load, the measurements do not exist, so the analysis cannot be reproduced.
3. Audit exposure. Even a reconstructed report without supporting raw data will not survive an audit. Timestamped cycle records and laboratory results are what an inspector asks to see, and they cannot be backfilled.
4. Different bioburden. As above, your site’s microbial load is not the other site’s, so the demonstrated SAL does not transfer.

The practical consequence is that skipping validation does not save the validation time — it removes the only document that authorises routine sterilization. Without a report built on your own raw data, there is no basis for a production cycle.

Bioburden: The Input You Must Supply

EO sterilization validation cannot start without knowing what it is fighting. Any sterile medical device should have its bioburden monitored on a routine schedule, and the validation load must come with a bioburden report generated from product made under normal production conditions.

This is a common stumbling block. Samples prepared specially for validation — cleaner, faster, handled differently — produce a bioburden number that does not represent production, and the cycle validated against it will be under-designed. The samples used for bioburden determination must come off the ordinary line, by the ordinary route, with the ordinary hold times.

The same rule applies to every physical, chemical and biological test sample in the protocol. They should all be indistinguishable from a routine production unit apart from the test they are destined for.

Frequently Asked Questions

Reference: ISO 11135:2014, Clauses 4–11 · ISO 10993-7:2026. Regulatory duties vary by market; confirm against your registration standard.