ISO 14644 Series Audit-Readiness Rubric — Cleanrooms and Associated Controlled Environments
What this is: ISO 14644 is the international standard series governing cleanroom classification, monitoring, testing, and design for any facility with controlled air cleanliness — the technical backbone underneath EU GMP Annex 1 (sterile manufacturing), ISO 13485 §6.4 (medical device work-environment/contamination control), and USP <797>/<800> (pharmacy compounding). Relevant to Regscribe wherever a pharma/biotech customer manufactures sterile products, performs aseptic fill-finish, or operates any classified cleanroom/clean zone requiring qualification and ongoing monitoring evidence.
Sourcing note — read before using this in production scoring: the full ISO 14644 standard texts (Parts 1–4, 5, 13, 14) are copyrighted and sold by ISO (each part individually, ~CHF 100–200; iso.org's Online Browsing Platform was not fetched directly this session — no attempt was made to bypass its paywall). No verbatim clause text is used below. This document is built entirely from structure and paraphrase drawn from secondary sources: certification/consultancy explainer pages (Beckman Coulter, Particle Measuring Systems, ACH Engineering, GMP Insiders, Connect2Cleanrooms, IEST, ANSI Blog, Pharmout, ECA/GMP-Compliance Academy, IntuitionLabs) and industry standards-body summaries, cross-checked across multiple independent sources where possible. Where only one or two sources confirmed a specific number or clause boundary, that is flagged inline. Depth is uneven by design, per the task brief: Parts 1–4 got focused research (the parts most relevant to pharma cleanroom qualification/monitoring paperwork); Parts 5, 13, 14 are one-paragraph scope notes only, not full requirement tables — flagged explicitly rather than padded out with invented detail.
A structural note this rubric inherits from its siblings: unlike the MHRA-sourced GMP/GDP rubric, there is no named, quantified regulator deficiency database specific to ISO 14644 compliance the way MHRA publishes for GMP/GDP chapters. The "common failure pattern" column below is instead built from (a) FDA Form 483/Warning Letter language found via consultancy round-ups (not independently re-verified against FDA's own database this session), and (b) EU GMP Annex 1 (2022 revision) inspection-readiness commentary, since Annex 1 is the regulatory document that actually operationalizes ISO 14644-1 classification for pharma. This is a weaker evidentiary basis than the MHRA-cited rows in the GMP/GDP rubric and should be treated accordingly in any confidence scoring.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
PART 1 — ISO 14644-1: Classification of Air Cleanliness by Particle Concentration
What it does: defines the ISO Class 1–9 system for classifying cleanrooms/clean zones by maximum permitted airborne particle concentration at specified particle sizes, plus the sampling methodology (number/location of sample points, sample volume, statistical treatment) used to demonstrate a room meets its assigned class. Current edition is ISO 14644-1:2015 (a revision of the 1999 edition).
The ISO Class ↔ EU GMP Annex 1 Grade mapping (high-value for Regscribe's data model)
This mapping is commonly referenced but not a strict 1:1 equivalence — EU GMP Annex 1 grades carry their own at-rest/in-operation particle limits (a distinction ISO 14644-1 alone doesn't impose) plus microbial contamination limits that ISO 14644-1 does not address at all. Multiple independent sources converged on the same mapping:
| EU GMP Annex 1 Grade | At rest | In operation | Notes |
|---|---|---|---|
| Grade A | ISO Class 5 | ISO Class 5 | Critical zone (open vials, aseptic connections); same limit at rest and in operation |
| Grade B | ISO Class 5 | ISO Class 7 | Background to a Grade A zone (e.g. gowning room adjacent to the aseptic core) |
| Grade C | ISO Class 7 | ISO Class 8 | Less critical stages of sterile product manufacture |
| Grade D | ISO Class 8 | Not fixed — risk-based | In-operation limit for Grade D is set by the site's own risk assessment/routine data, not a fixed Annex 1 number |
Reference particle-count ceilings converged across sources (≥0.5 µm, particles/m³): ISO 5 ≈ 3,520; ISO 7 ≈ 352,000; ISO 8 ≈ 3,520,000. Flag: the 2022 Annex 1 revision added a ≥5 µm particle-count requirement specifically for Grade A/B classification (previously optional/informational) — Regscribe should treat "classification report shows only ≥0.5 µm counts, no ≥5 µm data, for a Grade A/B room" as a distinguishable gap from a pre-2022-revision baseline, not lump it in with general classification evidence.
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 1 | Each cleanroom/clean zone must be assigned a specific ISO Class (or, in pharma, an equivalent EU GMP Grade) based on measured airborne particle concentration at defined particle sizes — the class designation must be a formally recorded outcome, not an assumed/inherited label. | ISO 14644-1:2015, classification provisions (§4–5 range per secondary-source structural summaries — exact clause numbers not independently confirmed against primary text this session) | Formal classification report/certificate stating the ISO Class or GMP Grade achieved, dated, signed, referencing the specific room/zone ID | Classification certificates that are stale (room re-used or re-purposed after the certificate date) or that state a class inherited from a similar room elsewhere in the facility rather than measured for that specific zone |
| 2 | Classification testing requires a minimum number of sampling locations distributed across the room, determined from the room's area (ISO 14644-1:2015 replaced the older √Area formula with a defined lookup table; a separate formula applies above 1000 m²) — an inadequate number/placement of sample points invalidates the classification. | ISO 14644-1:2015, sampling-location provisions | Classification test report showing sample-point count and floor-plan locations, cross-checked against the room's measured area | Sample points clustered near the air supply diffusers (best-case bias) rather than distributed per the standard's location logic, especially at exhaust/return points and known dead-zones |
| 3 | Classification must specify (and the test report must record) the occupancy state under which it was performed — as-built (no equipment, no personnel), at-rest (equipment installed, not operating, no personnel), or operational/in-operation (fully functioning, personnel present performing normal work) — since particle counts differ materially by state. | ISO 14644-1:2015, occupancy-state definitions | Classification report explicitly stating the occupancy state tested, matched against the intended-use occupancy state required by the site's risk assessment/CCS | Grade A/B classification performed only at-rest and never re-verified in-operation (operational monitoring data substituted without an actual in-operation classification test), or occupancy state not stated on the certificate at all |
| 4 | Sample volume per location and minimum total sample volume must be sufficient for statistical validity at the target class — undersized air samples produce unreliable pass/fail determinations, especially at tighter classes (ISO 5 and cleaner). | ISO 14644-1:2015, sample-volume provisions | Test report stating sample volume per point and counting methodology (discrete particle counter, sample time/flow rate) | Sample volumes copied from a template/prior report rather than calculated for the specific target class and particle size being measured |
PART 2 — ISO 14644-2: Monitoring to Provide Evidence of Cleanroom Performance
What it does: the 2015 revision narrowed this part's scope specifically to the ongoing monitoring plan that provides continuing evidence a cleanroom remains in the state it was classified to — distinct from the one-time classification test in Part 1. It is explicitly risk-based: the standard removed the older fixed-frequency requalification table and now requires the facility to justify its own monitoring plan and frequency via risk assessment.
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 5 | A documented monitoring plan must exist, derived from a risk assessment of the room's intended use, defining what parameters are monitored (particle count at minimum; commonly also airflow, differential pressure, temperature/humidity), sampling locations, frequency, and alert/action levels. | ISO 14644-2:2015, monitoring-plan provisions | Written monitoring plan referencing the risk assessment that drove parameter/frequency selection, with alert and action levels defined per parameter per room | Monitoring plan copied across multiple rooms of different classes without room-specific risk justification; alert/action levels set generically rather than derived from that room's classification data |
| 6 | Airborne particle concentration monitoring must be performed at a risk-justified frequency; industry practice/secondary sources converge on a common reference point of 6-monthly for ISO Class 5 and cleaner, 12-monthly for ISO Class 6 and coarser as a starting baseline, but the standard itself no longer mandates a fixed table — the facility must document its own rationale. Flag: this 6-/12-month figure is secondary-source convergence, not a verified primary-text clause citation. | ISO 14644-2:2015, requalification-interval discussion (secondary-source summary; primary clause number not confirmed) | Monitoring/requalification schedule with a documented risk-based rationale for the chosen interval (not just "per the standard") | Requalification performed on a fixed calendar interval with no risk-assessment rationale on file — auditors flag this as compliance-by-habit rather than the risk-based justification the current standard requires |
| 7 | Where continuous/near-continuous monitoring data is available (e.g. Grade A zones with real-time particle counters), that trend data can itself justify extending or adjusting classification-testing intervals — but only if the trend data is actually reviewed and the extension decision documented. | ISO 14644-2:2015, continuous-monitoring provisions | Continuous monitoring trend reports; a documented decision record showing trend data was reviewed and used to set/confirm the testing interval | Continuous monitoring data collected and stored but never reviewed/trended to inform the monitoring plan — data exists but isn't used as evidence |
| 8 | The monitoring programme's scope is explicitly bounded — ISO 14644-2 covers particle-concentration-related monitoring only; it does not address engineering-system condition monitoring (e.g. fan/damper vibration, general HVAC maintenance) or particle populations outside its 0.1–5 µm working range. Those must be covered by separate procedures if relevant to the site's contamination control strategy. | ISO 14644-2:2015, scope exclusions | CCS/facility monitoring matrix showing engineering-system maintenance monitoring exists as a distinct programme, cross-referenced to (not conflated with) the ISO 14644-2 particle monitoring plan | Facilities that treat "the HVAC is on a PM schedule" as equivalent to a documented particle-concentration monitoring plan — the two are related but not interchangeable evidence |
PART 3 — ISO 14644-3: Test Methods
What it does: specifies the actual test procedures (principle, apparatus, and procedure) for the suite of tests used to verify cleanroom performance beyond basic particle-count classification — this is the part that defines how to run an airflow visualization study, a recovery test, an air-pressure-difference test, an airflow-velocity/volume test, an airflow-direction test, and several others (installed-filter leak test, containment leak test, etc., per the 2019 edition's expanded scope).
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 9 | Airflow visualization studies (smoke/fog studies) must be performed to demonstrate unidirectional airflow protects the critical zone and does not create turbulence or dead-legs that could carry contamination toward open product/containers — this is a qualitative but formally documented test with defined apparatus (ultra-fine fog generator) and recorded observations (photographs/video plus a written interpretation). | ISO 14644-3:2019, airflow visualization test | Airflow visualization study report with video/photographic evidence, written pass/fail interpretation against defined acceptance criteria (e.g. "no turbulence observed over open product path"), performed both at-rest and in dynamic/operational conditions | Airflow visualization performed once at commissioning and never repeated after equipment changes, line reconfiguration, or personnel-flow changes that could alter airflow patterns — a commonly cited FDA/inspection theme is smoke-study gaps used as evidence firms didn't re-verify unidirectional flow after a facility change |
| 10 | The recovery test must demonstrate how quickly a room returns to its target cleanliness class after a defined aerosol particle challenge — evaluating the room's ability to self-clean after a contamination event (e.g. a door opening, a spill, an intervention). The commonly referenced calculation method is the "100:1" recovery-time approach using particle-concentration decay data. | ISO 14644-3:2019, recovery test | Recovery test report stating the challenge method, decay curve/data, and calculated recovery time against an acceptance criterion | Recovery testing applied to ISO Class 8/9 (coarser) rooms where the standard's own guidance advises against it (challenge concentrations become impractically high) — a report claiming a recovery-test pass for a Grade D/ISO 8 room is a citable inconsistency Regscribe should flag; recovery testing is recommended for non-unidirectional-airflow rooms in the as-built/at-rest state, not typically performed in production |
| 11 | Air-pressure-difference testing must confirm the cascading pressure regime between adjacent rooms of different grades (e.g. Grade B corridor positive to Grade C, Grade C positive to Grade D/unclassified) is established and, per the monitoring plan, continuously or periodically confirmed. | ISO 14644-3:2019, air-pressure-difference test; cross-referenced to ISO 14644-2 monitoring | Pressure-differential test report/log showing the cascade across all adjacent room pairs, with defined minimum differential (commonly ≥10–15 Pa, though this figure is a commonly-cited industry convention, not independently verified as an ISO 14644-3 mandated number this session) | Pressure differential not maintained or not continuously monitored between manufacturing and storage/adjacent areas — cited directly in FDA warning-letter language found this session |
| 12 | HEPA/ULPA installed-filter leak testing (filter integrity testing) must be performed to confirm no bypass leakage around or through the installed filter — required at installation and, per most site programmes, on a defined re-test interval and explicitly after any filter replacement or upstream ductwork/system access, not solely on a calendar schedule. | ISO 14644-3:2019, filter leak test provisions | Filter integrity test reports (photometer or particle-counter scan method) per filter, referenced to filter serial/location ID, with retest triggered by any documented filter replacement or system intervention | The single most commonly cited HEPA-related gap in secondary-source FDA-483 round-ups this session: filter integrity testing performed on an annual calendar basis only, missing the event-triggered retest after filter replacement or ductwork access; also cited: visibly stained/degraded HEPA filters still in service at time of inspection |
PART 4 — ISO 14644-4: Design, Construction and Start-up
What it does: covers the cleanroom facility lifecycle from design through construction and initial start-up/qualification, for new, refurbished, or modified installations — intended for use by the full stakeholder chain (users, specifiers, designers, purchasers, suppliers, builders, and performance verifiers). Current edition ISO 14644-4:2022. Provides checklists of performance parameters to be addressed at each lifecycle stage and includes energy-management/energy-efficient design considerations alongside the core airborne-particle-concentration focus. Whole-lifecycle maintainability is treated as a design input, not an afterthought.
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 13 | A User Requirement Specification (URS) defining the intended cleanliness class, occupancy states, process/equipment layout, and performance parameters must be established before design proceeds — this is the documentary anchor the rest of the qualification package (DQ/IQ/OQ) traces back to. | ISO 14644-4:2022, design-input provisions (structural summary; not independently verified against primary clause numbering this session) | URS document predating design drawings, referenced by subsequent Design Qualification (DQ) records | URS retrofitted/backdated after design work has already started, or a URS that doesn't specify the target ISO class/GMP grade explicitly enough to drive later classification testing |
| 14 | Start-up (commissioning) activities must include a structured verification sequence — commonly aligned to IQ (Installation Qualification, confirming as-built matches design) → OQ (Operational Qualification, confirming systems function including at-rest/operational classification per Part 1) → readiness for PQ (Performance Qualification, typically owned by the GMP validation framework rather than ISO 14644-4 itself). | ISO 14644-4:2022, start-up/verification provisions | IQ/OQ protocols and reports for the cleanroom facility (HVAC, room finishes, pass-throughs, monitoring instrumentation) predating routine operational use | IQ/OQ documentation gaps where "qualification documents provided by equipment suppliers were not adopted into the company's own Pharmaceutical Quality System for review" — a pattern also cited in the sibling GMP/GDP rubric's Annex 15 findings, since cleanroom HVAC OQ is a frequent example of third-party-supplied qualification paperwork never actually reviewed in-house |
| 15 | Construction materials and finishes must be specified for cleanability (smooth, non-shedding, chemical-resistant to the site's disinfectants) as a design input, not a downstream operational fix. | ISO 14644-4:2022, construction-materials provisions | Materials specification referencing cleanability/disinfectant-compatibility criteria, cross-referenced in the URS/DQ package | Retrofitted cleanroom finishes (e.g. porous or damaged surfaces) identified only after operational monitoring shows recurring microbial/particle excursions traceable to a specific surface — points back to a design-stage gap not caught at DQ |
| 16 | Facility design must account for the full lifecycle, including maintainability (filter change access, instrument calibration access) — ISO 14644-4:2022 explicitly frames ongoing maintenance as a design consideration, not solely an operations-phase concern. | ISO 14644-4:2022, lifecycle/maintainability provisions | Design documentation showing maintenance-access provisions (e.g. filter change-out clearance, service corridors) reviewed at DQ stage | Filter replacement or calibration access requiring production shutdown or breach of a classified zone because access panels/clearances weren't designed in — an operational cost finding that traces to a design-stage gap |
Parts not researched in depth (scope notes only — flagged, not detailed)
Per the task brief, Parts 5, 13, and 14 received only a scope-level pass, not requirement-table-level research. Do not treat the paragraphs below as equivalent in rigor to Parts 1–4 above.
- ISO 14644-5 — Operations. Specifies requirements for establishing an "operations control programme" (OCP) — the deliberate programme (gowning, personnel behavior, material transfer, cleaning-in-operation practices) needed to actually achieve and maintain the cleanliness level a room was classified to, recognizing that operational/procedural discipline — not just the physical HVAC system — determines whether a room stays in its classified state during real use. Relevant evidence would likely include gowning qualification records and personnel monitoring, but this wasn't independently confirmed against Part 5's actual clause structure this session.
- ISO 14644-13 — Cleaning of surfaces to achieve defined levels of cleanliness. Provides guidance on assessing cleaning methods to achieve Surface Cleanliness by Particle concentration (SCP) and Surface Cleanliness by Chemical concentration (SCC) classes, and which cleaning techniques are appropriate to reach a given target level. Relevant evidence would likely include cleaning validation/qualification records tied to a stated SCP/SCC target class, but sub-clause detail was not researched.
- ISO 14644-14 — Assessment of suitability for use of equipment by airborne particle concentration. Provides a methodology for qualifying equipment/machinery/tools/instruments intended for use inside a classified cleanroom, assessing whether the equipment itself is a hidden particle source that could compromise the room's certified class. Note: search results this session surfaced both an ISO 14644-14:2016 listing and an ISO 14644-14:2026 listing — this suggests a newer edition may exist or be in progress; not confirmed which edition is current as of this rubric's date (29 July 2026) — flag as a follow-up rather than guessing which is authoritative.
Documents/evidence needed for an ISO 14644 cleanroom qualification/monitoring audit
Compiled from the requirement rows above, organized by lifecycle stage rather than by Part number (since a real audit package is typically organized this way):
Design/pre-construction: User Requirement Specification (URS) stating target ISO class/GMP grade per room; Design Qualification (DQ) records; materials/finishes specification with cleanability rationale; maintainability/lifecycle-access design review.
Installation/start-up: Installation Qualification (IQ) and Operational Qualification (OQ) protocols/reports for HVAC and room systems; in-house review records for any third-party-supplied qualification documentation (not just the vendor's own sign-off).
Classification: Classification test report(s) per room/zone stating ISO Class and/or GMP Grade, occupancy state tested (as-built/at-rest/in-operation), sample-point count and floor locations, sample volumes, and (post-2022 Annex 1) ≥5 µm particle data for Grade A/B rooms.
Ongoing monitoring: Documented risk-based monitoring plan; particle-count monitoring/requalification schedule and results with rationale for chosen interval; continuous-monitoring trend reports where applicable, with evidence of actual review.
Test-method evidence (ISO 14644-3): Airflow visualization study reports (video/photo + interpretation, at-rest and dynamic); recovery test reports (challenge method, decay data, calculated recovery time) — noting scope limits (not typically applied to ISO 8/9 or Grade D); air-pressure-differential logs across the full room cascade; HEPA/ULPA filter integrity (leak) test reports per filter, with evidence of event-triggered retesting after filter replacement/system access, not calendar-only.
Requalification records: Periodic re-classification records — cited industry alignment with EU GMP Annex 1's 2022 revision is Grade A/B every 6 months, Grade C/D annually, though this figure is drawn from Annex 1 commentary, not independently confirmed as an ISO 14644-2 primary-text requirement this session (ISO 14644-2:2015 itself removed the older fixed-interval table in favor of risk-based justification — see row 6 above).
Contamination Control Strategy (CCS) linkage: the site's overall CCS document, since EU GMP Annex 1 (2022) explicitly positions cleanroom classification/monitoring evidence as one input into a facility-wide CCS rather than a stand-alone qualification exercise — Regscribe should model classification/monitoring evidence as feeding into a CCS completeness check, not just a room-by-room pass/fail.
Common failure patterns (cross-cutting summary)
Drawn from the FDA 483/Warning Letter language and Annex 1 inspection-readiness commentary surfaced this session — qualitative, consultancy/secondary-sourced, not a named regulator deficiency database (see sourcing note at top):
- HEPA filter integrity testing on a calendar-only schedule, missing the event-triggered retest required after filter replacement or upstream ductwork/system access — the single most consistently cited HEPA-related gap found this session.
- Airflow visualization (smoke studies) not repeated after facility change — equipment reconfiguration, line changes, or personnel-flow changes that could alter unidirectional airflow patterns, with no re-verification on file.
- Environmental monitoring excursions not investigated in a timely manner — one cited FDA example involved an uninvestigated particle-count excursion discovered 7 months after the fact.
- Pressure-differential cascade not continuously monitored or not maintained between classified areas and adjacent lower-grade/storage areas.
- Classification/monitoring evidence disconnected from the site's Contamination Control Strategy — post-2022 Annex 1 inspectors are described as starting from the CCS and checking whether cleanroom classification, monitoring, and cleaning evidence actually connects back to it, rather than treating classification as a stand-alone paperwork exercise.
- Third-party-supplied HVAC/cleanroom qualification documentation never actually reviewed in-house — the same pattern independently cited in the sibling GMP/GDP rubric's Annex 15 findings, suggesting this is a cross-framework recurring theme worth a shared "vendor qualification review" evidence node in Regscribe's data model (see the Evidence Type layer proposed in
gmp-gdp-rubric.mdPart C). - Missing ≥5 µm particle data for Grade A/B classification post-dating the 2022 Annex 1 revision — a report that only shows ≥0.5 µm counts for a Grade A/B room should be flagged as potentially pre-dating (or non-compliant with) the current revision.
Gaps / follow-ups
- No verified primary-source clause numbering. Every citation above uses "ISO 14644-N:year" without a confirmed specific clause/sub-clause number, because the primary standard text was not accessed this session (paywalled, and not attempted via bypass per the sourcing constraints given). Anywhere a specific section number appears above, it is flagged inline as secondary-source-derived. Recommend a follow-up pass using a purchased or institutionally-licensed copy of ISO 14644-1/-2/-3/-4 before this rubric is used for clause-level customer-facing citations, the same caveat the GMP/GDP and ISO 13485 sibling rubrics carry for their own thin spots.
- Parts 5, 13, 14 are scope-only, not requirement tables — explicitly out of the depth requested for this pass, but a real gap if Regscribe customers need surface-cleanliness (Part 13) or equipment-suitability (Part 14) scoring specifically.
- ISO 14644-14 edition currency unclear — search results surfaced both a 2016 and what appears to be a 2026 listing; which is the current governing edition was not resolved this session.
- No named, quantified deficiency database located for ISO 14644 compliance specifically (unlike MHRA's GMP/GDP PDFs) — the failure-pattern summary above is qualitative and secondary-sourced. A follow-up pass against FDA's public Form 483/Warning Letter database (as suggested for the ISO 13485 rubric) filtered to sterile-manufacturing/cleanroom-related citations would strengthen this section.
- EU GMP Annex 1 (2022) requalification-interval figures (6-monthly Grade A/B, annual Grade C/D) are cited from Annex 1 commentary sources, not cross-verified against the Annex 1 primary text itself this session, and — importantly — are an Annex 1 requirement, not an ISO 14644-2 one; ISO 14644-2:2015 itself deliberately removed fixed intervals in favor of risk-based justification. Regscribe's data model should keep these as two distinct citations (Annex 1 vs. ISO 14644-2), not merge them, even though they cover the same underlying activity.
- Pressure-differential minimum values (commonly cited industry convention of ≥10–15 Pa) were not independently confirmed as an ISO 14644-3 mandated figure this session — flagged as likely industry-convention rather than standard-mandated, worth verifying before encoding as a hard pass/fail threshold.
- Suggested integration note (not implemented — flagging, not doing it unasked): consistent with the ISO 13485 rubric's own note, this document is not wired into
lib/rubrics.ts. If ISO 14644 is meant to become a selectable rubric (rather than a reference doc), add aniso14644entry to theRUBRICSregistry pointing at this file, plus whatever test coveragelib/__tests__/rubrics.test.tsexpects for a new rubric ID — not done here since it touches app code/tests and wasn't asked for.