ICH Q7 clause 2: Quality management

This is the foundational quality management principle for API manufacturing. Auditors should verify that senior management visibly participates in quality governance — not merely delegates it. Look for management attendance at quality review meetings, signed quality policies, and resource allocation decisions that demonstrate genuine commitment. The quality system must be comprehensive, covering organisational structure, written procedures, defined processes, adequate resources, and all activities that affect API quality and purity. A common FDA 483 observation is quality systems that exist on paper but lack evidence of active management participation or resource commitment.

Independence of the quality unit from production is a critical GMP principle. Auditors should trace the reporting lines to confirm the quality unit does not report to the head of production or manufacturing. In small organisations a single individual may fulfil QA and QC roles, but that person must still have independent authority to reject batches without production override. Verify that quality decisions (batch release, deviation closure, CAPA approval) cannot be overruled by production management. FDA warning letters frequently cite situations where QU independence is compromised by organisational structure or informal pressure.

Auditors should request the list of authorised signatories for batch release, material acceptance, and rejection decisions. Verify that each person on the list has documented qualifications and formal delegation of authority. Cross- check actual batch records and rejection reports to confirm only authorised persons signed off. This clause also covers incoming raw materials — someone must be formally authorised to accept or reject them. Look for traceability: every disposition decision should link to a named individual, the date of decision, and the quality data that supported it. Unsigned or undated disposition records are a significant finding.

This clause addresses two interrelated concepts: contemporaneous recording and timeliness. Auditors should verify that quality records are created at the time of the activity (not retrospectively filled in), and that deviations, investigations, and quality decisions are completed within defined timeframes. Look for SOP-defined timelines for deviation initiation, investigation completion, and CAPA implementation. A backlog of open deviations or investigations pending for months is a red flag. Also check for evidence of predated or post-dated entries in batch records or logbooks. Timeliness protects data integrity — delayed recording increases the risk of inaccurate information.

This clause establishes the quality unit as the final authority for all batch disposition decisions. Auditors should verify that no API batch can be released without explicit QU approval, and that QU also controls intermediate disposition. Beyond batch release, the QU must approve master batch records, specifications, sampling plans, and test methods before they are used. Check that this authority is not informally delegated — for example, a production supervisor should not be able to release APIs even temporarily. Also verify QU reviews and approves any changes to specifications or test methods. This is one of the most frequently cited areas in FDA warning letters for API manufacturers.

Auditors should verify a complete set of written procedures covering the full material lifecycle from receipt through final API release. Check that procedures exist for each step: receiving and identification, quarantine controls, storage conditions, handling precautions, sampling techniques, analytical testing, and formal disposition. Beyond having procedures, the clause requires systems that actively prevent deviations (process controls, interlocks, verification steps) and that deviations which do occur are promptly detected, properly investigated, and corrected with preventive measures. Verify that CAPA actions from deviation investigations are implemented and verified for effectiveness. The absence of a comprehensive deviation prevention programme is a common GMP shortcoming.

This clause establishes the principle that quality evaluation must precede material use. Auditors should verify that physical or system-based quarantine controls prevent materials from entering production before QU release. If a quarantine release system (using materials before full evaluation is complete) is used, it must be formally approved with documented controls and risk assessment. Check warehouse management systems or physical segregation practices. Verify that labels or status indicators clearly distinguish quarantined from released materials. The most common finding is inadequate physical segregation allowing unreleased materials to be inadvertently used in production.

Auditors should verify that formal escalation and notification procedures exist and have been tested or used. Check for documented escalation paths with named roles (not just titles) and defined timelines — for example, notification of a regulatory inspection within 24 hours, or immediate notification for product safety issues. The procedure should cover multiple scenarios: announced and unannounced inspections, critical GMP findings from internal audits, field complaints indicating product defects, and recalls. Verify that the procedure reaches senior management who can authorise resource deployment for responses. A common gap is having a notification procedure that has never been tested via simulation or drill.

Auditors should verify that the organisation has clear procedures for regulatory notifications — not just internal escalation but external reporting to health authorities. Check that the procedure defines triggering criteria (what constitutes a reportable event), reporting timelines per jurisdiction, responsible persons, and documentation requirements. For API manufacturers supplying globally, verify that procedures account for multiple regulatory authorities (FDA, EMA, PMDA, etc.) and different reporting timelines. Cross-reference with actual events to confirm notifications were made. A common gap is having domestic notification procedures but not covering international markets where the API is distributed.

Auditors should verify the breadth of QU involvement across all quality-related activities — not just batch release and testing. Check that the QU participates in process design, validation protocols, change control reviews, and technology transfers. Look at meeting attendance records, document approval workflows, and project team rosters. The QU should also be involved in supplier qualification, stability programmes, and out-of-specification investigations. A common gap is QU involvement limited to end-stage testing and release, without participation in upstream process decisions that fundamentally affect API quality. The clause uses "all quality-related matters" — this is broad and intentional.

Auditors should request a comprehensive list of documents subject to QU review and approval and verify it covers all categories listed in this clause. Spot-check actual documents to confirm QU review signatures are present and timely. Check that the review is substantive — not merely a rubber stamp — by looking for evidence of QU comments, corrections, or rejections during reviews. The timeframe for review should be defined in procedures and tracked. A backlog of documents awaiting QU review suggests inadequate QU resources. Also verify that QU reviews are completed before the document is used (not retroactively approved).

This is the most detailed clause in Section 2 and represents the core duties of the quality unit. Auditors should verify that each of the 15 listed duties is explicitly assigned to the QU, documented in writing, and actively performed with supporting evidence. Create a matrix mapping each duty to the responsible QU personnel, the governing SOP, and evidence of execution. Any duty that lacks a governing procedure or evidence of execution within the audit period is a potential finding. Note the clause states these duties should not be delegated outside the QU — verify there are no informal delegations. This clause is the single most important reference for QU compliance in API manufacturing under ICH Q7.

Auditors should verify that each of the 10 listed production responsibilities is formally assigned, documented in SOPs, and actively performed with supporting evidence. Create a matrix similar to the QU duties in clause 2.22. Check that production management's responsibilities complement but do not overlap with QU responsibilities — the two should be clearly delineated. Look for evidence of production personnel performing each duty: production instructions prepared and distributed, batch records reviewed and signed, deviations reported to QU, facility cleaning logs, calibration records, maintenance logs, validation involvement, change evaluation participation, and equipment qualification records. Production and quality should have clear handoff points defined.

Auditors should review the internal audit programme schedule to verify it covers all GMP areas per ICH Q7. Check that audits are performed by personnel who did not work in the area being audited (independence). Review audit reports for completeness — they should identify observations, classify them by severity, and include agreed corrective actions with responsible persons and due dates. Verify that corrective actions are tracked to completion and their effectiveness verified. The audit schedule should be risk-based — higher-risk areas (e.g., aseptic processing, water systems, data integrity) should be audited more frequently. A common finding is internal audits that are superficial or never identify any observations, suggesting lack of rigour.

Auditors should review the CAPA tracking system for internal audit findings. Check that each audit observation has an assigned corrective action with a responsible person, target completion date, and root cause analysis. Verify that completed actions include effectiveness verification — evidence that the root cause was actually eliminated. Calculate the on-time closure rate: if a significant proportion of CAPAs are overdue, this indicates a systemic issue. Also check that management is informed of overdue actions and that resources are allocated for completion. Common gaps include corrective actions that address symptoms rather than root causes, leading to recurring findings in subsequent audit cycles.

The product quality review (PQR), sometimes called annual product review (APR), is a critical retrospective analysis of process consistency. Auditors should verify that PQRs are conducted at least annually for each API and include all seven specified review elements. Check that the review includes statistical trending (not just listing) of in-process controls and test results. Verify that failed batches, deviations, changes, stability data, complaints, and CAPA effectiveness are all evaluated. The review should conclude with an assessment of whether the process remains in a validated state of control. Recommendations for corrective action or revalidation should be documented and tracked. Common gaps include PQRs that compile data without analysis, or reviews that are overdue by months or years.

This clause extends clause 2.50 by requiring that PQR findings lead to actionable outcomes. Auditors should verify that PQR conclusions include a documented assessment of whether corrective action or revalidation is needed, with supporting rationale. Where corrective actions are identified, verify they are tracked and completed in a timely manner. Check that the PQR specifically evaluates whether specifications, test methods, process controls, or manufacturing procedures need updating based on the trends observed. The PQR should identify process drift before it results in out-of-specification results. Also verify the PQR feeds into the broader continuous improvement programme — it should not be an isolated annual exercise but a driver of quality system improvements.