A validation master plan is a strategy, not a protocol

A document neither standard requires by name

Search ISO 13485:2016 or 21 CFR 820 (now the QMSR) for the term ‘validation master plan’ and neither one uses it. ISO 13485's Clause 7.5.6 requires validating processes for production and service provision where the resulting output can't be verified by subsequent monitoring or measurement, and documenting the arrangements for that validation — a planning duty, but one the clause leaves the organization free to satisfy however it structures its own documents. FDA's 2011 guidance, Process Validation: General Principles and Practices, builds its own three-stage lifecycle — process design, process qualification, continued process verification — without ever requiring a single named plan to sit above all three. A site can be fully compliant with both without a document called a VMP existing anywhere in its system.

Inspectors ask for it anyway

None of that stops a VMP from being one of the first documents an FDA investigator or a notified body auditor asks to see on arrival, because without one there's no single place that shows the site's validation program is actually a program — a defined, risk-ranked list of what needs validating, rather than a pile of individual protocols assembled reactively whenever a new process shows up. A site with twelve immaculate IQ/OQ/PQ protocols and no VMP has demonstrated twelve validations. It hasn't demonstrated that it knows what its thirteenth one is, or when it's due.

The EU makes the expectation explicit

EU GMP Annex 15, Qualification and Validation, states the requirement plainly where ISO 13485 only implies it: qualification and validation activities have to be planned and documented, taking a lifecycle approach, with a validation master plan or equivalent document as the standard way that planning gets shown. PIC/S Recommendation PI 006 goes further and lays out what a VMP is actually expected to contain — the site's validation policy, an organizational chart of who approves what, and the list of facilities, systems, equipment, and processes to be validated. A manufacturer selling into both FDA- and EU-inspected markets ends up building the document EU guidance names, then using that same document for an inspector FDA's own guidance never explicitly required one for — because the alternative is running two separate validation programs to satisfy two different readers.

What a VMP decides that a protocol doesn't

An individual protocol answers one narrow question: does this process, this equipment, this cycle, perform the way it's supposed to. A VMP answers questions no single protocol can: which of the site's processes are validation-worthy at all, in what order they get validated relative to each other, who has authority to approve a validation and who can waive or defer one, and what triggers a revalidation when a process, material, or piece of equipment changes. A site that revalidates on a case-by-case feel, one piece of equipment at a time, is making exactly these decisions — just without writing them down anywhere a second person could check against.

Where this meets the file

A validation master plan built around PIC/S PI 006's own structure — policy, scope, organization, the prioritized list of what's validated and on what schedule, and the revalidation triggers that keep the list current — is previewed in the launch catalog alongside the individual IQ/OQ/PQ and cleaning validation protocols it's meant to govern. If your site structures this plan differently, the shelf takes that correction directly.