ICH Q7 — GMP for Active Pharmaceutical Ingredients

The one idea

The sections before this one are about the result: is the shelf life real (Q1), can the measurement be trusted (Q2), is the impurity safe (Q3), is the limit on the list defensible (Q6). Q7 is about the system that produced the result. A correct number from an uncalibrated instrument, an untrained analyst, an unvalidated method, or a batch record written from memory a week later is not evidence of anything.

Guidance regarding good manufacturing practice (GMP) for the manufacturing of active pharmaceutical ingredients (APIs) under an appropriate system for managing quality — and to help ensure that APIs meet the requirements for quality and purity that they purport or are represented to possess.

The operative phrase is an appropriate system for managing quality. GMP status is not a certificate on the wall; it is the demonstrable, documented existence of every control in the numbered sections below, running every day, provable to an inspector reading the records cold years later. This page is the checklist of what that system contains.

Where GMP begins — and why it tightens

Q7 does not govern the whole synthetic route. It starts at a defined point and gets stricter toward the end.

API starting material — a raw material, intermediate, or API used in the production of an API that is incorporated as a significant structural fragment into the API. It is often an article of commerce. GMP under Q7 applies from the point the API starting material is introduced into the process.

The stringency of GMP increases as the process moves from early API steps to final isolation, purification, and packaging.

Early steps get appropriate, evolving controls. The final steps that fix the impurity profile, the physical form, and the label identity get the full weight of Q7. The rationale is purge capacity: an error early in the route can still be removed by later purification; an error in the final crystallization or the packaging line reaches the patient.

The quality unit — the keystone control

Every other section leans on this one. There must be a quality unit that is independent of production, and Q7 lists duties that may not be delegated to production:

• Release or reject every batch of API; release or reject intermediates used outside the company’s control.
• Review and approve the completed batch production record before the batch is released.
• Ensure that critical deviations are investigated and resolved.
• Approve all specifications and master production instructions, and any procedure that affects the quality of intermediates or APIs.
• Approve and audit contract manufacturers and contract laboratories.
• Approve changes that potentially affect quality (change control).
• Review and approve validation protocols and reports.
• Maintain effective systems for complaints and recalls and for stability monitoring.
• Conduct internal audits (self-inspection) and the product quality review.

Product quality review — at least annually, covering critical in-process and API test results, batches that failed specification, critical deviations and their investigations, changes, stability results, returns / complaints / recalls, and the adequacy of the corrective actions taken.

The controls, section by section

The complete checklist of what a facility must have in place and be able to prove:

Section 11 in detail — laboratory controls

This is where the course lives. Section 11 sets what a GMP QC laboratory must have.

General controls. Documented procedures for sampling, testing, and the approval or rejection of every material; specifications that are scientifically sound and consistent with the regulatory filing; scientifically sound sampling plans; primary records that include the raw data — charts, spectra, printouts — not just a transcribed result; all testing performed to procedure and documented at the time; deviations recorded and justified.

Testing and the impurity profile. Each batch is tested for conformance to its specification. And the requirement that ties Q7 back to Q3 and Q6:

The impurity profile should be compared at appropriate intervals against the profile in the regulatory submission, or against historical data, to detect changes resulting from modifications in raw materials, equipment operating parameters, or the production process.

The analyst is the early-warning system for a process drifting away from what was registered.

Out-of-specification (OOS) results. Q7 requires a written procedure covering data analysis, assessment of whether a real problem exists, assignment of corrective actions, and conclusions, with any resampling or retesting done only to a documented procedure. The widely applied practice (aligned with FDA’s OOS guidance) is a laboratory-assessment phase first — was the method followed, the instrument in calibration, the calculation correct? — and then, absent an assignable laboratory cause, a full investigation extending to the batch, other batches, and the process. Averaging away a failing result or retesting into compliance is not acceptable; the investigation and its conclusion become part of the batch record.

Certificate of analysis. An authentic CoA issued for each batch on request: product name and grade, batch number, each test with its acceptance limits and its actual numerical result, the date, and an authorised signature. It must carry the original manufacturer’s data; a CoA issued by an agent has to name the original manufacturer and be traceable to the original.

Stability monitoring. A documented ongoing programme: stability-indicating methods; containers that simulate the market package; the first three commercial batches, then at least one batch per year thereafter (if any is made); storage conditions matching the label.

Expiry and retest dating. Assigned from stability data; a retest-dated API may be used after its retest date provided a representative sample is retested and still conforms.

Reserve (retention) samples. Packaged as marketed (or more protectively), in at least twice the quantity needed for a full specification re-test, retained one year past the batch’s expiry, or three years past distribution for a retest-dated API — whichever is longer.

Section 12 in detail — validation

• Validation policy — documented; critical parameters and attributes identified from development or historical data; the ranges for reproducible operation defined.
• Qualification before validation — installation and operational qualification (IQ / OQ) of facilities and equipment, with design and performance qualification as applicable, precede process validation.
• Process validation — normally prospective for APIs; three consecutive successful production batches used as a guide; concurrent validation justified case by case; retrospective validation only for well-established legacy processes.
• Periodic review — validated systems reviewed to confirm they still operate validly; where nothing significant has changed, a documented review can substitute for revalidation.
• Cleaning validation — residue limits set from solubility, toxicity / pharmacological activity, and the minimum therapeutic dose; validated analytical methods sensitive enough to detect residues at those limits; clean-hold and dirty-hold times established.
• Analytical method validation — every method validated (unless it is a verified compendial method) for the characteristics appropriate to its purpose: accuracy, precision, specificity, detection and quantitation limit, linearity, range, robustness — the Q2 figures of merit — with revalidation to a degree that scales with any change.

Documentation and data integrity — ALCOA+

GMP status is proved by records, so the records themselves are a control. The ALCOA+ criteria — later codified in data-integrity guidance but built on the Section 6 requirements — say every GMP record must be:

The concrete Q7 requirements behind this: entries in indelible ink in the space provided, signed and dated at the time; corrections dated and signed, leaving the original legible; audit trails on computerised systems; controlled blank forms; defined retention periods; and quality-unit review of the complete batch record — production and laboratory — before any batch is released.

Reprocessing vs. reworking

A distinction Section 14 makes that students routinely blur:

Continuing a process step after an in-process control shows it is not finished is normal processing — not reprocessing.

Where the analyst sits

Q1, Q2, Q3, and Q6 tell you what the numbers must mean. Q7 is the reason anyone believes your numbers in the first place: the instrument was calibrated, the method was validated, the reference standard was qualified, the raw data still exists, and an independent quality unit — not your manager in production — signed the release. Every audit finding that begins “the result looked fine, but…” is a Q7 finding.

If the Q1 lesson is a shelf life is a hypothesis, the Q2 lesson is a measurement is a claim that must earn trust, and the Q6 lesson is a specification is a numbered promise, the Q7 lesson is: none of those promises count unless the system that produced them is itself under control — and that control is the thing you have to be able to show. That is the A in STEAM again: the analyst is where an abstract quality system becomes a signature on a page.

For discussion

• Q7 applies “from the point the API starting material is introduced into the process,” and stringency rises toward the final steps. Why is a deviation in the first synthetic step treated more leniently than the same deviation in the final crystallization?
• An analyst gets a failing assay result, repeats the injection, gets a passing result, and reports the mean. Which parts of Section 11 does that violate, and what should have happened?
• Your impurity profile for the last four batches shows a new peak at 0.06 % that was absent from the registration batches. It sits below the Q3A identification threshold. What does Section 11 oblige you to do anyway?
• A batch of API is out of specification for a single impurity. The site proposes recrystallising it with the normal process solvent under the normal conditions. Is that reprocessing or reworking, and what does the answer change?
• A contract laboratory runs your release testing. What must be in place before you can rely on their CoA, and what remains your responsibility?
• The quality unit is asked to release a batch to meet a shipping date before a deviation investigation is closed. On what basis can they refuse, and who outranks them?
• You are setting cleaning-validation residue limits for a high-potency API on shared equipment. Which three inputs set the limit, and why does the analytical method’s LOQ have to be checked against it?

Source note. ICH Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients reached Step 4 on 10 November 2000; a set of clarifying questions and answers was adopted in June 2015. In the ICH quality framework, Q7 is read alongside Q9 (quality risk management) and Q10 (pharmaceutical quality system), but it stands on its own as the GMP standard for APIs and is implemented regionally as FDA guidance, EU GMP Part II, and the PIC/S equivalent. Its laboratory requirements connect directly to Q2 (method validation), Q1 (stability-indicating methods and the stability programme), Q3 (the impurity profile), and Q6 (the specification the laboratory runs). (Instructor: Q7 dates from 2000 and the core guideline has not been revised; confirm the current status of the Q7 Q&A document and any ICH work-plan item before lecture, and cross-check the retention-period, stability-batch, and reserve-sample specifics against the current text.)

• ←Q6 · Specifications
• Q8–Q12 · Lifecycle→