Guide to Qualifying New Suppliers in Malaysia for Manufacturing Success
Malaysia is a premier manufacturing hub in Southeast Asia. According to the Malaysian Investment Development Authority (MIDA), “Malaysia, with its extensive trade....
By AMREP | Posted on September 29, 2026
Calibration, verification, and validation answer three different questions. Calibration asks whether a measuring instrument reads correctly compared with a traceable reference. Verification asks whether a product, part, or process meets its specified requirements. Validation asks whether those requirements, once met, actually deliver what the user or intended application needs.
Put simply, calibration makes your measurements trustworthy, verification uses those measurements to confirm you built it right, and validation confirms you built the right thing or that a process will keep producing it correctly.
This guide covers formal definitions, a side-by-side comparison, the ISO and FDA clauses that require each activity, how the three connect in practice, a worked manufacturing example, common mistakes auditors find, and how to decide which one a situation calls for.
The confusion between these terms often starts because everyday usage differs from the formal definitions. Quality systems should use the standard definitions.
ISO 9000:2015 clause 3.8.12 defines verification as confirmation, through objective evidence, that specified requirements have been fulfilled. Clause 3.8.13 defines validation as confirmation, through objective evidence, that the requirements for a specific intended use or application have been fulfilled.
Calibration comes from metrology. The International Vocabulary of Metrology (JCGM 200:2012, known as the VIM) defines it as an operation that establishes the relationship between the values provided by measurement standards, with their uncertainties, and the corresponding indications of the instrument being calibrated.
One detail catches many teams out. The word "verification" has two meanings in quality work:
Both fit the ISO 9000 definition, but they sit in different parts of the quality system. Your procedures should state which one they mean.
Once the definitions are clear, it is easier to see how the three activities differ in practice. The table below compares their purpose, their scope, and the evidence each one produces.
| Attribute | Calibration | Verification | Validation |
|---|---|---|---|
| Core question | Does the instrument read correctly? | Did we meet the specification? | Does it work for the intended use? |
| Applies to | Measuring and test equipment | Parts, products, design outputs, processes, instruments | Designs, processes, software, test methods |
| Compared against | A traceable reference standard | Drawings, specifications, design inputs | User needs, intended use, production conditions |
| Typical output | Calibration certificate with as-found and as-left data and uncertainty | Inspection report, test report, FAI or PPAP records | Validation protocol and report, IQ/OQ/PQ records, clinical or field data |
| Typical frequency | At defined intervals | Every lot, sample, or design stage | Once, then on revalidation triggers |
| Main ISO 9001:2015 clause | 7.1.5.2 | 8.3.4, 8.6 | 8.3.4, 8.5.1 f |
| Failure consequence | Every measurement since the last good calibration is suspect | Nonconforming product reaches the customer | A conforming product still fails in use |
ISO 9001:2015 clause 7.1.5.2 requires measuring equipment to be calibrated, verified, or both at specified intervals or before use, against standards traceable to international or national measurement standards. Where no such standard exists, the basis used must be retained as documented information. Equipment must be identified to show its status and safeguarded against adjustments that would invalidate results.
The same clause contains the requirement teams most often miss. When equipment is found unfit for its purpose, the organization must determine whether previous measurement results were adversely affected and take action as necessary.
IATF 16949:2016 adds clause 7.1.5.2.1, which specifies the content of calibration records, including as-found readings when equipment is out of specification. Clause 7.1.5.3 requires external calibration laboratories to be accredited to ISO/IEC 17025 or otherwise acceptable to the customer. ISO 13485:2016 covers the same ground in clause 7.6, and the FDA's Quality Management System Regulation, effective February 2, 2026, now incorporates ISO 13485 by reference for medical device makers.
A certificate that simply says "pass" is weak evidence. Look for:
As-found data matters most. It tells you whether the instrument drifted out of tolerance while in use, which triggers the impact assessment ISO 9001 requires.
Intervals should reflect usage, drift history, and risk, not only the manufacturer's default of twelve months. ILAC-G24 / OIML D 10 provides methods for setting and adjusting recalibration intervals. A gauge that is consistently found in tolerance can have its interval extended with documented justification. A gauge that is repeatedly found out of tolerance needs a shorter interval or replacement.
A calibrated gauge can still be unsuitable for the job. Calibration confirms accuracy against a reference under laboratory conditions. It says nothing about repeatability across operators, parts, and shop floor conditions. That is the role of measurement system analysis (MSA), required by IATF 16949 clause 7.1.5.1.1 for measurement systems in the control plan.
Under AIAG MSA reference manual guidance, a gauge R&R below 10 percent of tolerance is generally acceptable, 10 to 30 percent may be acceptable depending on the application, and above 30 percent is unacceptable. Many labs also target a test uncertainty ratio of at least 4:1 between the calibration standard and the instrument being calibrated.
Verification is the most frequent of the three activities because it happens at every stage of production:
These activities are usually planned in an inspection and test plan for manufacturing, which defines what gets checked, where, how often, and against which acceptance criteria.
Verification can use measurement, testing, inspection, analysis, demonstration, or comparison with a proven design. For production parts, it usually means dimensional inspection, functional testing, and material certification review. For a new part, first article inspections are the most complete form of verification because every characteristic on the drawing is measured and recorded.
Every verification result is only as reliable as the instrument that produced it. If a CMM probe or torque analyzer was out of tolerance, the verification record looks valid but proves nothing. This is why audits trace a sample of inspection records back to the calibration status of the equipment used on that date.
Design validation confirms the finished product meets user needs under actual or simulated use conditions. ISO 13485 clause 7.3.7 requires it for medical devices, including clinical evaluation or performance evaluation where applicable. Validation should use production-equivalent units, because prototypes built by engineers often behave differently from parts made on the production line.
Process validation applies when the output of a process cannot be fully verified by later inspection or testing. ISO 9001:2015 clause 8.5.1 f requires validation and periodic revalidation of these processes. ISO 13485 clause 7.5.6 carries the same requirement with more detail, and clause 7.5.7 addresses sterilization specifically.
Typical processes that need validation include:
The common framework, described in GHTF SG3/N99-10:2004 for medical devices, divides process validation into three stages:
| Stage | Question answered | Typical evidence |
|---|---|---|
| Installation Qualification (IQ) | Is the equipment installed correctly and to specification? | Utilities, calibration status, software versions, safety checks |
| Operational Qualification (OQ) | Does the process produce acceptable output across its operating window? | Parameter challenges at upper and lower limits, often using designed experiments |
| Performance Qualification (PQ) | Does the process produce acceptable output consistently under normal production conditions? | Multiple consecutive runs with production operators, materials, and shifts |
For drug manufacturing, the FDA's 2011 guidance, Process Validation: General Principles and Practices, uses a lifecycle model of process design, process qualification, and continued process verification.
Acceptance at the equipment supplier and at your site is often the first evidence toward IQ and OQ. The FAT vs SAT process explains how those acceptance tests are structured.
Validation also applies to test methods, such as a custom leak test or a vision inspection system, and to software used in production or the quality system. ISO 13485 clause 4.1.6 requires validation of software used in the QMS, proportionate to risk.
Validation is not permanent. Define triggers in your procedures, such as:
The three activities form a chain of trust. Calibration supports verification, and verification supports validation.
A process cannot be validated with measurements from uncalibrated equipment, because the validation data itself would be unreliable. A product cannot be released on verification alone if the process that made it was never validated and its critical features cannot be inspected after manufacturing.
The V-model used in product development shows this clearly. On the left side, the user needs to flow into design inputs and then detailed specifications. On the right side, each level is checked. Specifications are verified against design outputs, and the complete product is validated against user needs. Calibration sits underneath the whole model, supporting every measurement.
A shorthand often attributed to software engineer Barry Boehm summarizes the difference: verification asks whether you are building the product right, and validation asks whether you are building the right product.
The following is an illustrative example drawn from common supplier situations. It is not a single client case.
A maker of industrial pressure sensors outsources a two-piece polycarbonate housing to a contract manufacturer. The halves are joined by ultrasonic welding, and the housing must pass a leak test and survive a drop test in the field.
The contract manufacturer calibrates:
When the leak tester's transducer is found out of tolerance at its annual calibration, the as-found data shows it had been reading low. The supplier traces every lot tested since the previous calibration and retests retained samples. This is the impact assessment ISO 9001 clause 7.1.5.2 requires.
Weld strength cannot be confirmed on every part without destroying it, so the ultrasonic welding process needs validation:
The OEM validates the finished sensor against user needs, including drop testing, thermal cycling, and ingress protection testing on units built at the production site. A housing that passes every dimensional and leak check could still crack when dropped from the specified height. Only design validation reveals that.
Suppose the supplier later changes to a different polycarbonate grade to cut cost. Dimensional verification still passes. Leak testing still passes. But the new resin welds differently at the existing parameters, and weld strength falls. Without a revalidation trigger for material changes in the supplier quality agreement and the validation procedure, the problem shows up as field failures rather than on the production floor.
These gaps often appear together at the same supplier. A structured review of calibration, verification, and validation records is a core part of supplier audits, and the clause structure behind each requirement is explained in ISO 9001:2015 clauses explained.
Yes, in some cases. ISO 9001 clause 7.1.5.2 allows calibration, verification, or both. Simple fixed gauges such as go/no-go pin gauges are often verified by measurement against calibrated equipment. Instruments with adjustable readings, such as pressure transducers or torque analyzers, generally need calibration with uncertainty stated.
Not necessarily. The sticker shows the instrument met its own accuracy specification on the calibration date. Whether that accuracy is adequate depends on your tolerance. An instrument with a resolution close to the part tolerance will produce unreliable accept and reject decisions even when calibrated.
It depends on your sector and customers. IATF 16949 requires external labs to hold ISO/IEC 17025 accreditation or be accepted by the customer. ISO 9001 requires traceability but not accreditation. Many aerospace and medical customers specify accredited calibration in their purchase requirements.
You can use it, but you remain responsible for the result. Review the validation protocol and report, confirm acceptance criteria were set before testing, and check that the validated conditions match current production. Medical device companies should confirm this is covered in their supplier controls under ISO 13485 clause 7.4.
Only when the inspection can fully detect every relevant defect without destroying the part. For characteristics such as weld strength, internal porosity, sterility, or heat treatment depth, 100 percent nondestructive inspection is usually not possible, so validation is required.
AMREP Supplier Management Services has more than 35 years of experience checking whether suppliers' calibration, verification, and validation practices hold up on the production floor. Our quality engineers review calibration traceability, witness IQ/OQ/PQ runs, and verify inspection results at supplier sites across Mexico, China, Vietnam, India, Thailand, Malaysia, the Philippines, Indonesia, Poland, and the United States. To put an experienced engineer at your supplier during launches or process changes, explore our supplier quality engineering services or contact the AMREP team.
Contact Us To See What We Can Do
Call Us
Mon - Sat 9.00 - 18.00
Sunday Closed
12 - May 2025
12
May
2025
Malaysia is a premier manufacturing hub in Southeast Asia. According to the Malaysian Investment Development Authority (MIDA), “Malaysia, with its extensive trade....
22 - April 2025
22
April
2025
Healthcare is rapidly evolving, ensuring consistent and high-quality patient care. Total Quality Management (TQM) in healthcare is more than just a buzzword—it is a powerful....
16 - April 2025
16
April
2025
Total Quality Management (TQM) is a mindset that involves everyone in the organization working toward a common goal: achieving excellence through quality. From....