ICH Q7 clause 11: Laboratory controls

The QU must have independent access to labs — either in-house or contracted. If using contract labs, the QU must qualify them through audits and ensure they use validated methods. Independence from production is critical: QU cannot report to production management. Auditors should verify organizational charts showing QU independence, contract lab qualification records, and sampling plan documentation.

Every analytical method used must be validated (for non-compendial methods) or verified (for compendial methods per clause 12.81). Validation must demonstrate fitness for purpose in the specific API matrix. Common validation parameters include accuracy, precision (repeatability and intermediate precision), specificity, linearity, range, detection limit, and quantitation limit per ICH Q2. Auditors should review method validation reports and verify that validation data supports the method's use at the specification limits.

Pharmacopeial methods carry regulatory presumption of suitability but must still be verified in the specific API matrix. Verification is less extensive than full validation but must demonstrate that the method works as intended for the specific product. Modified compendial methods require full validation since they are no longer considered compendial. Auditors should check whether the pharmacopeia edition referenced is current and whether verification data is product-specific.

Extends the GDP requirements of Section 6.15 specifically to laboratory activities. The clause mandates contemporaneous recording of all analytical data with full traceability. Every test record must include the nine listed elements. 'Raw data' means chromatograms, spectra, weighing tickets, instrument printouts — not just final results. The dual-signature requirement (analyst + reviewer) is mandatory. This clause is the laboratory counterpart of 6.52 (contemporaneous recording in production).

OOS investigation is one of the most scrutinized areas in API manufacturing inspections. The investigation must follow a written procedure and must be completed in a timely manner. Phase 1 (lab investigation) should be completed within a defined timeframe (typically 3-5 days). If a lab error is confirmed, retesting is acceptable with full documentation of the error. If no lab error is found, Phase 2 (manufacturing investigation) must be initiated. The original OOS result must NEVER be deleted or replaced — it remains part of the permanent record. 'Testing into compliance' (repeated retesting until a passing result is obtained) is a serious regulatory violation.

This clause mandates a formal, documented OOS procedure that goes beyond simply repeating the test. The procedure should define: who can initiate an investigation, investigation phases (typically Phase 1: lab assessment, Phase 2: manufacturing assessment), criteria for confirming laboratory error vs. manufacturing deviation, retest/resample criteria, documentation requirements, and reporting to management. The FDA's guidance on OOS (2006) provides additional expectations. Key audit focus: verify the SOP exists, is followed consistently, and that investigations are not routinely closed as 'lab error' without supporting evidence.

Reference standards form the measurement basis for all quantitative testing. The hierarchy is: recognized-source primary (USP, EP, WHO) > in-house primary (fully characterized) > secondary working standards (qualified against primary). Each level requires specific documentation. In-house primary standards must be characterized for identity and purity using multiple independent techniques. Secondary standards must be qualified against the primary standard before use. Auditors should review the reference standard inventory, characterization data, and usage/replacement logs.

When pharmacopeial primary standards are unavailable (common for novel APIs or proprietary intermediates), the manufacturer must create and fully characterize an in-house primary standard. Characterization typically requires: mass balance (assay + impurities + residual solvents + water = ~100%), multiple orthogonal identity techniques (NMR, IR, MS), and purity determination by at least two independent methods. The characterization data must be sufficient to establish fitness for purpose as the calibration anchor for all subsequent testing.

Secondary (working) standards are used in daily testing to preserve limited primary standard material. Each lot must be qualified against the primary before first use through comparison testing (typically assay comparison). Periodic requalification is required — the frequency should be risk-based but typically annually or when new primary standard lot is introduced. A written protocol must define qualification acceptance criteria, requalification frequency, and handling of out-of-specification qualification results.

Proper storage and handling preserve standard integrity. Storage conditions (temperature, humidity, light protection) should match supplier recommendations or be justified by stability data. Records must trace each standard from receipt through disposal. A current inventory with status (in qualification, approved, expired, quarantined) should be readily accessible. Auditors frequently request to see the reference standard storage area and inventory during inspections.

Complete release testing of every API batch is non-negotiable. The testing program must cover identity (confirming the material is what it claims to be), assay (quantitative potency), and purity (impurity profile including related substances, residual solvents per ICH Q3C, and water content). Additional tests depend on the API: particle size for inhalation APIs, polymorphic form for bioavailability-critical APIs, endotoxins for parenteral APIs. Skip testing or reduced testing requires explicit regulatory justification (typically via parametric release).

The impurity profile is the fingerprint of the manufacturing process. It documents all known and unknown impurities with their typical ranges from the validated process. This profile serves as the baseline for detecting process drift, contamination, or degradation. For each impurity, the profile should capture: identity (by name or relative retention time), typical range (from multiple batches), and classification. ICH Q3A/Q3B provide thresholds for reporting, identification, and qualification. Deviations from the established profile may indicate process problems or cross-contamination and must be investigated.

Active monitoring of impurity profiles is essential for detecting process drift. Each batch's impurity data should be compared against: (1) the regulatory submission profile (for registered APIs), (2) historical batch data from the validated process, and (3) process validation batch data. This comparison should use appropriate statistical or trending methods, not just specification compliance. A shift in impurity levels — even within specification — may indicate process changes that warrant investigation.

Microbiological testing requirements depend on the API's intended dosage form. APIs for non-sterile oral dosage forms need bioburden limits per pharmacopeia. APIs for sterile products (injectable, ophthalmic) require stringent bioburden and endotoxin testing. Environmental monitoring should reflect the process — open processing steps require more monitoring than closed systems. Auditors should verify that microbiological specifications align with the API's intended use and that environmental monitoring data supports the manufacturing environment's suitability.

Every batch shipped to customers must be accompanied by (or have available on request) an authentic Certificate of Analysis (CoA). 'Authentic' means the CoA reflects actual testing performed on that specific batch — not generic or copied data. The CoA must include product identification, batch number, release date, and expiry/retest date. For agents and brokers who re-issue CoAs, the chain of authenticity back to the original manufacturer must be maintained per Section 17.

This defines the mandatory content of a CoA. The key requirement is that actual numerical results must be reported — not just 'pass' or 'conforms.' Customers and regulators need the numerical data to evaluate trends and make informed decisions. If a contract lab performed any testing, that lab must be identified on the CoA. Auditors should compare CoA content against this checklist for a sample of recent batches.

Reinforces the numerical results requirement. There is an alternative allowed: referencing a compendial monograph by name and number, which implicitly defines the tests, methods, and limits. However, even with this shortcut, actual numerical results should still be provided for each test. Best practice includes both the compendial reference and the numerical results. Auditors should verify that the compendial edition referenced is current.

The CoA must bear the approval of an authorized QA person — confirming that QA reviewed the testing data and approved the batch for release. The signer must be identifiable (full name, not just initials). Electronic CoAs are acceptable if the electronic signature system is validated per clause 6.18 and 21 CFR Part 11 / EU Annex 11 requirements.

Full manufacturer identification ensures traceability in the supply chain. When intermediaries (brokers, traders, distributors) re-issue CoAs, the original manufacturer must still be identifiable. This prevents 'CoA laundering' where the actual source of the API becomes obscured. Re-issued CoAs must reference the original CoA. Auditors in the supply chain should verify that CoAs maintain the chain of identity back to the actual manufacturing site.

An ongoing stability program is mandatory for all commercial APIs. It must include long-term testing at the recommended storage conditions and typically accelerated testing at elevated conditions. Test intervals should align with ICH Q1A guidelines (e.g., 0, 3, 6, 9, 12, 18, 24, 36 months for long-term). Methods must be stability-indicating — capable of detecting degradation products and distinguishing them from the API. Results drive expiry/retest date assignments and can trigger re-evaluation of storage conditions.

Stability-indicating methods must be able to detect degradation and distinguish degradation products from the API peak and other impurities. Forced degradation (stress testing) under acid, base, oxidation, heat, light, and humidity conditions is the standard approach to demonstrate selectivity. Method validation for stability-indicating capability should show that the method resolves the API from all known and potential degradation products.

Stability data is only valid if the test samples are representative of what customers actually receive. Commercial-scale batches are preferred. Pilot batches are acceptable only if they are genuinely representative (same process, same equipment type, same impurity profile). The container-closure system must match or simulate marketed packaging — stability in glass does not predict stability in HDPE drums, for example.

The stability container must faithfully represent marketing conditions. If the commercial container is an HDPE drum with PE liner, stability samples should be in the same system. If a different container must be used (e.g., smaller scale for practical reasons), it must be demonstrated that the test container is at least as protective as the commercial one. More conservative means: more permeable to moisture/oxygen, less protective from light — ensuring stability data represents worst-case conditions.

The first three commercial-scale batches must go on stability to confirm the shelf life established during development. This is an ICH Q1A requirement applied to API manufacturing. The exception (fewer than three) requires documented evidence of stability from prior studies. At minimum, one batch per year should be added to the ongoing program (clause 11.55). This creates a growing stability database that supports continued marketing.

The ongoing stability obligation requires at least one batch per year added to the monitoring program. This maintains the stability database and can detect long-term trends or the impact of gradual process changes. Testing frequency should be annual at minimum but more frequent for APIs with known stability concerns. The program design must be capable of detecting physical, chemical, and microbiological changes — not just assay decline.

Reduced testing is permitted but requires formal justification based on accumulated stability data demonstrating consistent, predictable stability behavior. This is a risk-based approach: APIs with years of stable data may have fewer time points or fewer batches per year. The justification must be documented, QA-approved, and reviewed periodically. Any process or packaging change resets the justification and may require return to full testing.

Intermediates shipped externally must have either an expiry date (after which the material cannot be used) or a retest date (after which the material must be re-tested before use). Internal intermediates commonly use retest dates. The choice between expiry and retest should be risk-based — APIs with known instability should use expiry dates. Stability data must support whichever dating system is chosen.

The expiry or retest date must be supported by stability data — not arbitrarily assigned. Preliminary dates from pilot data are acceptable initially but must be confirmed with commercial-scale data. Retest date extension is allowed when long-term stability data supports it, but the extension must be formally documented. Transport conditions (temperature excursions during shipping) should be factored into the overall stability assessment, not just storage conditions.

For new APIs going commercial for the first time, pilot-scale stability data can support initial dating. The pilot process must be genuinely representative — same synthetic route, similar equipment type, comparable impurity profile. If the commercial process differs significantly (e.g., different crystallization conditions, different drying method), pilot stability data may not be predictive and additional commercial-scale stability data should be generated promptly.

Retest date extensions are a commercial benefit but must be supported by actual long-term stability data — not extrapolation alone. The data must be from a sufficient number of batches (typically at least 3) tested through the full proposed retest period. QA must review and approve each extension. If any batch shows out-of-trend results at the extended time points, the extension should be reconsidered. Storage conditions and packaging used to generate the extension data must match actual commercial conditions.

Reserve (retention) samples provide the manufacturer's ability to investigate future quality complaints or regulatory inquiries. They must be stored under the same conditions as the marketed product — if the API is stored at 2-8°C, the reserve samples must also be refrigerated. Retention begins from the date of manufacture completion. The reserve sample program should be documented in an SOP covering identification, storage, access, and tracking.

The 'two full analyses' requirement ensures that if one analysis yields an inconclusive result, a confirmatory analysis can be performed. 'Full analysis' means all tests in the specification or pharmacopeial monograph — not just a subset. For large-volume APIs this is straightforward, but for high-potency or expensive APIs where quantities are limited, the sample quantity must be carefully calculated based on the analytical methods' sample requirements. Container labeling must include the four mandatory elements.

Reserve sample retention follows the same dual-rule as batch records (clause 6.14): 1 year post-expiry OR 3 years post-complete distribution, whichever is longer. For retest-dated APIs, the 3-year-post-distribution rule applies. 'Completely distributed' means when the last portion of the batch leaves the manufacturer's control — this date must be tracked. Storage conditions must match the API specification (not just room temperature). Auditors should verify that reserve sample retention periods are properly calculated and that samples are actually retained per the requirement.