ICH Q7 clause 17: Agents, brokers, traders, distributors, repackers, and relabellers
The 15 audit questions covering clause 17, each with the objective evidence to request, the nonconformities most often raised against it and what to sample. Part of the free ICH Q7 API GMP audit checklist, which holds 350 items across 18 clauses.
All 15 questions for clause 17
Open any row for its objective evidence, common nonconformities and auditor tips. You can check items off as you go. This browser remembers your progress across all 18 clauses of this checklist.
§17 Agents, brokers, traders, distributors, repackers, and relabellers
17.10 Do all parties in the API distribution chain operate under applicable GMP?
- Section 17 applicability documentation
- Supply chain mapping
- Intermediary quality system documentation
- GMP compliance verification for intermediaries
- Quality agreements with all supply chain parties
- Supply chain audit program
- Qualification of intermediaries
- Supply chain risk assessment
- Intermediaries not required to comply with GMP
- No supply chain mapping
- Quality agreements with some but not all parties
- Unregulated intermediaries in supply chain
- No audit of distribution chain
- Supply chain risk assessment does not cover geopolitical or regulatory risks in intermediary jurisdictions
The full supply chain from manufacturer to final user must comply with GMP. This prevents 'quality laundering' where materials of questionable origin are legitimized by intermediaries. Each party handling the API must maintain quality standards appropriate to their operations: simple distributors focus on storage, transport, and traceability; repackers and relabellers have more extensive obligations similar to manufacturers.
17.11 Are distribution-only activities controlled for storage and transport conditions?
- Storage condition records for distributors
- Transport condition records
- Distribution traceability records
- Complaint handling procedures
- Notification procedures to manufacturer
- Distributor qualification
- Distributor audits
- Quality agreements with distributors
- Storage conditions not controlled
- Transport conditions not monitored
- Traceability broken at distributor
- Complaints not forwarded to manufacturer
- No quality agreement with distributors
- Distributor temperature-controlled storage not verified during qualification audit
- Batch number traceability lost when intermediary consolidates shipments from multiple original batches
- Management review of intermediary quality performance not conducted at defined intervals
Distribution-only activities have focused GMP requirements: controlled storage (temperature, humidity, security), controlled transport (compatible vehicles, qualified carriers), traceability records (receiving, shipping, customer lists), complaint handling and notification back to manufacturer. Full manufacturing GMP (testing, validation, batch records) doesn't apply to pure distributors. Risk-based scaling of requirements is appropriate.
17.20 Is full traceability maintained from the original manufacturer to the customer?
- Supply chain traceability documentation
- Batch traceability through intermediaries
- Original manufacturer identification maintained
- Chain of custody records
- Traceability audit records
- Recall capability demonstration
- Supply chain mapping
- Re-packaging batch linkage records
- Traceability broken at intermediaries
- Original manufacturer identity lost
- Re-packaged material without batch linkage
- Incomplete supply chain records
- Unable to trace product path
- Batch number traceability lost when intermediary consolidates shipments from multiple original batches
Full traceability is critical for recall capability and quality investigation. Each party must retain: source information (previous party, date received, quantity, original manufacturer), destination information (next party, date shipped, quantity), batch information throughout. If an intermediary re-packages, the linkage from new batch number to original batch must be documented. Gaps in traceability are a serious quality system failure.
17.30 Do distribution-focused parties maintain a documented quality management system?
- Quality manual or equivalent documentation
- SOPs for key activities
- Personnel training records
- Records of operations
- Complaint handling procedures
- Change control procedures
- Deviation procedures
- Management review records
- No quality system at intermediaries
- Procedures missing or incomplete
- Personnel untrained
- No records of operations
- Complaints not handled systematically
- Management review of intermediary quality performance not conducted at defined intervals
Even distribution-focused parties need quality systems. Required elements: written procedures for key activities, training of personnel, documentation and records, complaint handling, change control, deviation management, management review. The system's scope should match the operations — a simple distributor has simpler requirements than a repacker performing more manipulation. Quality systems should be documented and periodically reviewed for effectiveness.
17.40 Is any repackaging and relabelling performed under appropriate GMP controls?
- Repackaging SOPs
- Repackaging facility documentation
- Environmental monitoring of repack facilities
- Pre-operation cleaning records
- Label reconciliation for repacking
- Training records for repacking personnel
- Repacking batch records
- Mix-up prevention controls
- Repackaging in uncontrolled environments
- No environmental controls
- Cross-contamination between products
- Labels not reconciled
- Repackaging without written procedures
- Line clearance records for repackaging operations incomplete or unsigned
Repackaging and relabelling create the same risks as manufacturing: contamination, mix-ups, identity errors. Controls must match these risks: clean facilities with environmental controls, written procedures, trained personnel, segregation of products, pre-operation cleaning, reconciliation of packaging/labels. Repacking operations for APIs intended for sterile drug products have additional requirements (aseptic controls).
17.41 Does repackaging preserve traceability to the original manufacturing batch?
- Repacking batch record template
- Cross-reference between original and repacker batch numbers
- Original manufacturer CoAs retained
- Repacking operation records
- Batch number assignment procedures
- Traceability audit verification
- Records accompanying repacked material
- Repack batch reconciliation
- Original batch number not maintained
- Repack batch numbering without traceability
- Original CoA not retained
- Unable to trace repack back to original
- Repack records incomplete
- Original manufacturer CoA not physically retained with repacker batch file
Repacker batch numbers must enable reverse traceability to the original manufacturing batch. Common approaches: include the original batch number in the repacker's batch number (e.g., 'REPACK-MFG123'), maintain a cross-reference database, or include the original batch number in records accompanying each repack. The original CoA must be retained and available — often a copy accompanies the repacker's CoA to the next recipient.
17.50 Are stability studies performed when material is repackaged into a different container type?
- Stability protocols for repacked material
- Stability data in new containers
- Container change justification
- Expiry/retest date assignments for repacks
- Comparison to original manufacturer's stability
- Extractables/leachables assessment
- Regulatory assessment of container change
- Repacker stability program
- Repacking in different container without stability data
- Using manufacturer's expiry for different container
- No stability program at repacker
- Container-specific extractables not assessed
- Expiry extension beyond stability data support
- Repacker stability protocol does not include all critical quality attributes tested by the original manufacturer
Changing the container can affect stability (different barrier properties, different extractables, different moisture transmission). The repacker must generate stability data in the new container to support dating — they cannot rely solely on the manufacturer's data which was generated in a different container. The studies should include all quality attributes, not just appearance. Expiry or retest dates may need to be shortened based on the new container's properties.
17.60 Is all relevant quality and regulatory information transferred along the supply chain?
- Information transfer procedures
- Records of information transferred
- Manufacturer change notifications received and forwarded
- Complaint information flows
- Regulatory communications forwarded
- Timeliness of information transfer
- Quality agreements specifying information transfer
- Information transfer audit records
- Manufacturer changes not forwarded to customers
- Customer complaints not sent to manufacturer
- Information filtered or summarized by intermediaries
- Delayed information transfer
- Critical information not transferred at all
- Manufacturer field safety notice forwarding delayed beyond the timeframe defined in the quality agreement
Intermediaries act as information conduits between manufacturers and customers. Information to transfer: CoAs with every shipment, change notifications from manufacturer, complaint information from customers back to manufacturer, regulatory updates, specifications, stability data. The transfer must be timely — delays can cause regulatory issues or quality incidents. Intermediaries should not filter, summarize, or selectively forward information.
17.61 Is the original manufacturer's name retained on certificates passed along the chain?
- Repacker CoA templates showing original manufacturer
- CoA content requirements in quality agreements
- Audit verification of CoA content
- Training on CoA preparation
- CoA review procedures
- Customer CoA documentation
- Regulatory submissions supporting CoA practices
- CoA archiving
- Original manufacturer not identified on intermediary CoAs
- Repacker presenting as original manufacturer
- CoA templates lacking original manufacturer information
- Supply chain with unknown origin
- Intermediary CoA format implies they performed testing when only forwarding original manufacturer data
- Original manufacturer contact information omitted from re-issued CoA
This is a specific implementation of traceability. When intermediaries issue their own CoAs (e.g., for convenience or after repackaging), the original manufacturer must still be identifiable. The CoA should state: 'Manufactured by: [Original Manufacturer Name and Address]'. Without this, the true source of the API becomes hidden. This clause supports regulatory traceability and quality investigations.
17.62 Do intermediaries provide information enabling regulatory compliance, including direct contact with authorities when needed?
- Regulatory cooperation procedures
- Regulator contact procedures
- Recall response procedures at intermediaries
- Training on regulatory interactions
- Document retrieval procedures for regulators
- Regulatory correspondence records
- Authority notification procedures
- Regulatory readiness audits
- No procedures for regulatory cooperation
- Regulator requests not handled timely
- Intermediaries unaware of regulatory obligations
- No recall response capability
- Document retrieval slow or incomplete
- Distribution records insufficient to identify all downstream recipients within recall timeframe requirements
Regulatory authorities may contact intermediaries during inspections or investigations. Intermediaries must cooperate and provide information directly to regulators or facilitate regulator access to manufacturer information. This includes recall situations where regulators need complete distribution information quickly. Intermediaries should have procedures for regulatory interactions and appropriate training for personnel who might encounter regulators.
17.63 Are the names and addresses of agents and brokers available to customers and authorities on request?
- Customer information request procedures
- Standard disclosure practices
- Records of customer inquiries and responses
- Transparency policies
- Information readily available
- Customer communication templates
- Audit verification of disclosure
- Periodic customer feedback on transparency
- Supply chain information hidden from customers
- Intermediary identity not disclosed
- Original manufacturer identity withheld
- Delays in responding to information requests
- Commercial barriers to disclosure
- Customer supply chain transparency requests require management approval causing response delays
Supply chain transparency supports customer due diligence. Customers (drug product manufacturers) are ultimately responsible for the quality of products they use, and they need to know where their APIs come from. Intermediaries should not hide their role or the identity of the original manufacturer. Information should be available on request, not just through commercial contracts.
17.70 Do intermediaries maintain complaint and recall records and forward them appropriately?
- Complaint records at intermediaries
- Complaint forwarding procedures and logs
- Recall participation records
- Customer lists for recall
- Recall communication records
- Trending of complaints through intermediaries
- Annual complaint summaries
- Integration with manufacturer's complaint system
- Complaints not recorded at intermediaries
- Complaints not forwarded to manufacturer
- No recall participation procedures
- Unable to identify customers for recalls
- Complaint trending not performed
- Complaint forwarding to original manufacturer not tracked with acknowledgement receipt
Intermediaries often receive complaints before the manufacturer does. They must maintain complete records and forward complaints to the manufacturer. For recalls, intermediaries must participate actively — providing their customer lists, facilitating product retrieval, communicating to their customers. Records must be complete enough to support recall effectiveness and regulatory reporting.
17.71 Are complaints investigated and the original manufacturer notified where relevant?
- Complaint investigation procedures at intermediaries
- Complaint forwarding procedures
- Intermediary investigation scope definitions
- Manufacturer notification timelines
- Follow-up procedures with manufacturer
- Complaint closure procedures
- Integration with manufacturer's investigation system
- Training on complaint handling
- Intermediaries attempting to investigate quality complaints in isolation
- Complaints not forwarded or delayed
- No clear boundary between intermediary and manufacturer investigation
- Customers not receiving follow-up
- Investigation closure without manufacturer input
- Intermediary investigation of storage-related complaints performed without calibrated temperature monitoring data
- Mock recall at intermediary does not test full retrieval logistics including weekend and holiday scenarios
Intermediaries can investigate complaints related to their own activities (e.g., transport damage, repack errors, storage issues). For complaints related to product quality (assay, impurities, efficacy), investigation must involve the original manufacturer who has access to batch records and manufacturing data. Prompt forwarding enables the manufacturer to investigate thoroughly and meet their regulatory obligations.
17.72 Do intermediaries have recall procedures that include notifying their customers?
- Intermediary recall SOPs
- Customer notification templates
- Product retrieval procedures
- Mock recall exercises
- Reporting to manufacturer procedures
- Recall team at intermediary
- Recall effectiveness tracking
- Post-recall reporting
- No recall procedures at intermediaries
- Delayed customer notifications
- Ineffective product retrieval
- No mock recall testing
- Poor communication with manufacturer during recalls
- Mock recall at intermediary does not test full retrieval logistics including weekend and holiday scenarios
Original manufacturers decide when to recall, but intermediaries execute critical recall steps for their portion of the supply chain. Intermediary responsibilities: notify their customers promptly, retrieve product efficiently, track recall effectiveness, report back to manufacturer with customer-level data. Procedures should be tested through mock recalls. Failure of intermediaries to execute recalls efficiently can make the entire recall ineffective.
17.80 Are returns at intermediaries handled, quarantined, and documented under equivalent controls?
- Return handling procedures at intermediaries
- Return quarantine procedures
- Return assessment records
- Manufacturer notification for quality returns
- Return disposition records
- Quality agreement provisions for returns
- Return trending
- Return integration with complaint system
- Returns reshelved without assessment
- Quality-related returns not forwarded to manufacturer
- No quarantine at intermediaries
- Return disposition not documented
- Returns not tracked as potential quality signals
- Returned materials held at intermediary without notifying the original manufacturer within defined timeframe
Return handling at intermediaries follows the same principles as at manufacturers (Section 14.5). Returns must be quarantined, assessed for quality impact, and dispositioned appropriately. Quality-related returns should be forwarded (physically or with information) to the manufacturer for investigation. Returns that may indicate quality issues should not be placed back in saleable inventory without manufacturer involvement.
Each item shows its evidence, common nonconformities and auditor tips. The clause index has the PDF of all 350 items, formatted for a clipboard.
The rest of the ICH Q7 API GMP audit checklist
350 items across 18 clauses. Back to the clause index.