Can you rely on a supplier’s certificate of analysis instead of testing raw materials yourself?

1What the US allows.

Every component must be tested for identity and against its written specifications for purity, strength and quality. Section 211.84(d)(2) then allows one substitution: “In lieu of such testing by the manufacturer, a report of analysis may be accepted from the supplier of a component, provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals.”¹ Containers and closures follow the same pattern with a lighter check: a supplier’s certificate of testing, at least a visual identification by the manufacturer, and periodic validation of the supplier’s results.¹

FDA’s CGMP questions and answers spell out who does what for APIs. The API manufacturer tests the API against its release specifications. The finished product manufacturer ensures the API meets all its specifications, and if it accepts the API supplier’s results rather than testing, “the manufacturer must validate the API supplier’s reliability”, other than for identity, which it must always test itself. The validation procedure is the finished product manufacturer’s to set, consistent with CGMP and risk management.² Each batch of a USP-grade API must meet the monograph, though validated alternative methods that give equivalent or better results can show it.²

2What EU GMP allows.

Chapter 5 makes finished product manufacturers responsible for the testing of starting materials described in the marketing authorisation. They “can utilise partial or full test results from the approved starting material manufacturer but must, as a minimum, perform identification testing of each batch according to Annex 8”.³ Section 5.36 sets the conditions for outsourcing the rest, and the rationale has to be justified and documented.³

3What ICH Q7 asks of API manufacturers.

For materials used to make APIs, ICH Q7 asks for at least one identity test on each batch, and allows a supplier’s certificate “in place of performing other tests, provided that the manufacturer has a system in place to evaluate suppliers”. Supplier approval needs evidence, such as past quality history, that the supplier can consistently meet specifications. “Full analyses should be conducted on at least three batches before reducing in-house testing”, a full analysis is repeated at appropriate intervals and compared with the certificates, and the certificates’ reliability is checked regularly.⁴

Q7 exempts a short list of materials from in-house testing when the manufacturer’s certificate shows they meet specifications: processing aids, hazardous or highly toxic raw materials, other special materials and materials transferred within the company. Visual examination of containers, labels and batch numbers supports their identity, and the lack of on-site testing is justified and documented.⁴

For the certificates an API or intermediate manufacturer issues, Q7 also says what they should carry: the material’s name and grade, batch number, release date and expiry or retest date; “each test performed in accordance with compendial or customer requirements, including the acceptance limits, and the numerical results obtained”; the date and signature of authorised quality unit staff; and the original manufacturer’s name, address and telephone number. A certificate reissued by a repacker, agent or broker names the laboratory that did the analysis and attaches a copy of the original.⁴

4When a certificate is not enough.

FDA’s May 2023 guidance on diethylene glycol (DEG) and ethylene glycol (EG) describes poisonings from contaminated glycerin in which drug manufacturers did not perform full identity testing and relied on the supplier’s certificate. The origin of the material was not apparent from the certificate, which was often a copy on a distributor’s letterhead rather than the original manufacturer’s.⁵ Where a USP monograph’s identity test includes a DEG and EG limit test, the manufacturer must run it on representative samples of each shipment of each lot and find no more than 0.10% before use. FDA also recommends that manufacturers know the original manufacturer and every repacker and distributor in the supply chain for these components.⁵

EMA draws the same lessons. Its questions and answers note that manufacturers of contaminated products “relied on certificates of analysis (CoAs) provided by the supplier” and had not qualified the supply chain, and say competent authorities expect incoming glycerol, propylene glycol and low-molecular-weight macrogols to be tested against their European Pharmacopoeia monographs, which include a DEG and EG limit test.⁶

5How it runs in Seal.

Neil, Seal’s AI agent, reads each supplier certificate at goods receipt and compares every result in code with your specification rather than the range the supplier printed, checks the lot and expiry against the ERP, and looks for results walking towards a limit across lots, as the CoA review blueprint shows. It proposes release or hold, with the question to the supplier drafted; quality releases, holds or rejects the lot, and your sampling plan stays as it is. When checking a certificate, Neil also flags required tests the certificate doesn’t report, because an omitted result is not a pass.

In supplier quality, orders, shipments, lots and certificates stay connected to sampling, inspection and internal verification against the specification, and the qualification’s scope of site, material and specification is checked at receipt, so a new site or revised specification shows up as a difference before the material is used. Enhanced inspection or additional testing for a supplier takes effect by date, with its approvals.