Incoming Testing of an API: Why Every Container Matters

Here is the rule in one line. The identity of a complete batch of starting material can normally only be ensured if a sample is taken from every container and an identity test is performed on each one. You may sample only a proportion of the containers, but only where a validated procedure exists to show that no single container could have been labelled incorrectly.

That is the whole of Annex 8 on the subject, and the interesting part is not the rule. It is what the guideline says about who can earn the exemption. Under the conditions listed for a validated reduced-sampling procedure, exemption of container-by-container identity testing can be accepted for material coming from a single site, or coming directly from the maker in a sealed container with a history of reliability and regular audits. Then comes the sentence most buyers have never read: it is improbable that a procedure could be satisfactorily validated for material supplied by intermediaries such as brokers where the source of manufacture is unknown or unaudited.

Read that again, because it lands directly on how a great many bile acid purchases are actually structured.

The default is the expensive one

Container-by-container identity testing is not a formality. On a delivery of drums, it means opening and sampling every unit, running an identity test on each sample, and holding the whole batch in quarantine while that happens. For a small receiving lab without near-infrared capability, that is a working week and a meaningful slice of a testing budget.

Reduced sampling exists precisely because the default is wasteful when the supplier is well controlled. The guideline's own language is about confidence in the supply chain rather than about the material: the nature and status of the supplier, their understanding of pharmaceutical GMP, their quality system, the conditions under which the material is produced and controlled, and the nature of the material itself.

What the exemption actually requires

Four things have to be true, and three of them are about the supplier rather than the substance.

Two cases fall outside the exemption regardless of how good the paperwork looks. Material for parenteral use is one. The other is the intermediary case quoted above.

What can and cannot be outsourced

The responsibility for testing an API sits with the party that holds the marketing authorisation, and it stays there. The guidance allows that party to use partial or full test results from the approved maker of the starting material, with a floor underneath it: as a minimum, identification testing of each batch must still be performed by the buyer.

Reducing in-house testing further is permitted, and the conditions attached to it are worth reading as a checklist rather than a permission.

• A formal agreement covering responsibilities, including distribution conditions from the maker to you
• Audits at appropriate intervals at the site carrying out the testing, including sampling
• A certificate signed by a designated person with the relevant qualifications, confirming each batch was checked against the agreed specification
• Demonstrated experience with that supplier, including assessment of previously received batches and their compliance history
• Full analysis by you, or by a contract laboratory, at appropriate intervals, with results compared against the supplier's certificate

On the last point, the expectation in practice is that at least three full analyses are completed before an incoming result is accepted in place of your own. That is not a rule you can negotiate down by buying more material. It is a track record, and track records take time.

If any of that comparison testing turns up a discrepancy, the sequence is prescribed: investigate, take action, and stop accepting certificates from that supplier until the measures are complete. I find that the useful reading of this clause is that certificate acceptance is a privilege that can be withdrawn, not a status that can be assumed.

What the American framework adds

United States requirements reach the same place by a different route. Sampling has to be based on statistical criteria, each lot is withheld from use until sampled, tested or examined and released by quality control, and representative samples are taken from each shipment of a batch. The number of containers to sample and the amount taken from each have to be justified statistically and weighed against the supplier's quality history. A supplier with a strong history earns a lighter sampling plan; the same material from an unknown source earns a heavier one.

What this means if you buy through a partner

This is the part of Annex 8 that directly affects a supply chain built on partners rather than on direct factory purchases, and I would rather state it plainly than leave it to be discovered during an audit.

If your material arrives through an intermediary and the production site is either unknown to you or unaudited, the guideline's expectation is container-by-container identity testing, and that expectation is not ameliorated by excellent documentation from the intermediary. The route back to reduced sampling runs through disclosure and audit, not through nicer certificates.

That has two practical consequences worth planning for.

For the buyer, the audit trail you need is the identity of the production site plus a route to audit it. A partner who cannot or will not name the site is not offering a cheaper purchase; they are offering a purchase that costs more in your own laboratory. This is the same logic that makes the document set in our supplier verification guide worth working through before an order rather than after.

For the partner, the commercial consequence is straightforward. Where the production site is disclosed and auditable, the buyer can build the validated procedure that lets them stop opening every drum. Where it is not, they cannot, and the saving they thought they were making shows up as laboratory time. A partner who understands that will volunteer the site and the audit access before being asked, because it is one of the few things they can offer that a bare product listing cannot.

Five things to have before you reduce testing

1. Written sampling procedure and a documented sampling plan with statistical justification
2. The identity of the production site, and an audit report for it
3. Three completed full analyses with results compared against the supplier's certificates
4. A signed quality agreement covering distribution and change notification
5. A defined trigger for reverting to full container sampling, and for suspending certificate acceptance

The fifth item is the one that gets left out. Every reduced-sampling procedure should say what would make it stop, otherwise it is not a control, it is a habit.

Frequently asked questions

Does every container of an API have to be individually tested for identity?

The default under Annex 8 is that identity of a complete batch can normally only be ensured by sampling every container and testing each sample. A proportion of containers may be sampled only where a validated procedure exists to show that no container could have been mislabelled.

Can the exemption be validated for material bought through a broker?

Where the source of manufacture is unknown or not audited, the guideline states that it is improbable that a procedure could be satisfactorily validated. In that case container-by-container identity testing is the expectation.

If the supplier provides test results, does the buyer still have to test?

Yes. The buyer may use partial or full results from the approved maker of the starting material, but must, as a minimum, perform identification testing of each batch.

How many full analyses are expected before reducing in-house testing?

In practice, at least three full analyses are expected, with results compared against the supplier's certificates, before incoming results are accepted in place of the buyer's own testing.

What happens if comparison testing finds a discrepancy?

The discrepancy is investigated and appropriate measures taken, and acceptance of the supplier's certificates is discontinued until those measures are complete.

Are non-sterile APIs treated the same as parenteral ones?

No. The guideline specifically notes that a validated procedure exempting container-wise identity testing is improbable for starting materials intended for parenteral products. Non-sterile materials can qualify for the exemption where the conditions are met.

The question to put to whoever supplies you

Ask for the name and address of the site that produced the last batch. Not the distributor, not the trading company, not the group. The site. If the answer is quick and specific, reduced sampling is on the table and your laboratory just got cheaper. If the answer is vague, you have not been sold a discount; you have been sold a testing burden.

The primary texts behind this piece are EU GMP Annex 8 on sampling, EU GMP Part I Chapter 5 on production, and ICH Q7. Confirm the current wording of any clause before relying on it in a quality system.

What happens to the material after it arrives is covered in what a re-test date tells you, and adding a second supply route is set out in what a second source involves. What we ship against is on the ursodeoxycholic acid page, and specification questions for a specific quantity can be raised through a quotation request.

This article describes incoming-material testing and sampling rules for quality, regulatory and procurement professionals. It states no therapeutic use, dose or indication for any substance, and no order quantity or lead time. Confirm all regulatory references against the current published versions.