QMS for API and Excipient Manufacturers: ICH Q7 Explained

There is a version of ICH Q7 compliance that looks impressive on paper and accomplishes almost nothing in practice. Companies build binders full of SOPs, hire a quality manager, run an annual internal audit, and call it a QMS. Then an FDA inspection surfaces a deviation that was reported, documented, corrected on paper, and repeated six times in three years — and nobody can explain why.

That gap between documentation and actual quality is where most API and excipient manufacturers live. And in my view, it's not because the people are careless. It's because ICH Q7 is genuinely complex, and most organizations implement it as a compliance exercise rather than as a management system.

This article is about what the standard actually requires, how a real QMS holds those requirements together, and where organizations typically come apart.

What ICH Q7 Is — and Who It Applies To

ICH Q7 is the International Council for Harmonisation's Good Manufacturing Practice guide specifically for Active Pharmaceutical Ingredients. It was developed to bring a consistent GMP framework to API manufacturing, which historically lived in a regulatory gray zone compared to finished dosage form production.

The scope matters here. ICH Q7 applies to:

• Commercial API manufacturers (both chemical synthesis and biological/natural extraction routes)
• Contract manufacturers producing APIs under agreement
• Excipient manufacturers who are contractually subject to pharmaceutical-grade GMP requirements
• Organizations handling API starting materials that fall within the defined scope of the guide

Excipient manufacturers occupy an interesting middle position. ICH Q7 does not technically govern excipients — the relevant framework there is IPEC-PQG GMP or ISO 9001 with pharmaceutical adaptation. But in practice, many excipient suppliers operate under customer quality agreements that explicitly require ICH Q7 alignment, and FDA's drug supply chain expectations have pushed excipient GMP standards much closer to API standards over the last decade. So while the statutory picture is complicated, the operational reality for most excipient manufacturers is that ICH Q7 is the functional benchmark they're being audited against.

The Core Structure of ICH Q7

ICH Q7 has nineteen sections. Understanding how they relate to each other matters more than reading them sequentially.

Section 2 is the one most organizations underinvest in. It defines the quality management system itself — the quality policy, quality unit authority, product quality reviews, and the internal audit program. Everything else in ICH Q7 is a subsystem that feeds into Section 2. If Section 2 is weak, the other eighteen sections are just individual procedures floating without a connective structure.

What a Real QMS Holds Together

The phrase "quality management system" gets used loosely. In the ICH Q7 context, a QMS is not a set of documents. It is the organizational infrastructure that ensures quality-relevant information flows to the people who need to act on it, that actions are actually taken, and that results are reviewed to determine whether the system is working.

In practice, that means six interconnected functions:

1. Document Control Procedures need to be current, accessible, approved, and trained against. This sounds obvious. But in API manufacturing, where process knowledge is deep and specialized, it's common to find informal process knowledge living in individual chemists' heads rather than in controlled documents. ICH Q7 Section 6 requires that records be created contemporaneously, retained for defined periods (at least three years beyond the batch's retest date or expiry), and retrievable on demand. The failure mode is almost never deliberate — it's that the documentation system has too much friction, so people work around it.

2. Change Control Section 13 of ICH Q7 requires a formal system for evaluating and approving changes to starting materials, specifications, analytical methods, facilities, and manufacturing processes. Change control is where API manufacturers most frequently run into trouble during inspections. According to FDA's database of warning letters, inadequate change control is one of the top five cited deficiencies for API manufacturers over the past decade. The failure is usually not that changes are made secretly — it's that the organization's threshold for what constitutes a "significant" change requiring formal evaluation is set too low, and small process drifts accumulate unreported until they affect product quality.

3. Deviation and CAPA Management Every API facility runs deviations. The question is whether the deviation system produces learning or just paperwork. ICH Q7 requires that deviations from established procedures be recorded and explained, and that significant deviations receive a root cause investigation and corrective action. The word "significant" is doing a lot of work there — and organizations that draw that threshold too narrowly will find that minor deviations compound into major quality failures. A well-functioning CAPA system should be closing issues, reducing recurrence rates, and feeding data into the annual product quality review.

4. Laboratory Controls Section 11 is detailed and demanding. It covers method validation, system suitability, reference standards, stability programs, and out-of-specification (OOS) investigation procedures. API manufacturers frequently have strong analytical capabilities but weak OOS investigation procedures. When an OOS result appears, the sequence of steps — initial investigation, assignable cause determination, retesting criteria, final disposition — needs to be defined and followed without deviation. Improvised OOS handling is one of the most common inspection findings in API facilities.

5. Supplier and Contractor Management Section 16 requires that contract manufacturers and laboratories meet GMP standards equivalent to those applied to internal operations. For API manufacturers, this typically means qualifying suppliers of starting materials and reagents, maintaining quality agreements, and auditing critical suppliers on a defined schedule. In practice, supplier qualification programs are often more thorough on paper than in execution — audits get deferred, quality agreements sit unsigned, and supplier changes slip through without formal re-qualification.

6. Annual Product Quality Review (APQR) Section 2.5 of ICH Q7 requires a periodic review of each API — covering batch yield trends, analytical results, deviations, complaints, change control history, and validation status. The APQR is the mechanism by which the quality system looks at itself and asks whether the process is in control. Organizations that treat this as a documentation exercise rather than an analytical one miss its real value. A well-executed APQR should occasionally surface something uncomfortable — a trend that demands action, a process that has drifted, a control that is no longer working. If every APQR concludes that everything is fine, something is probably wrong with the review.

Where API Manufacturers Typically Fail Inspections

I want to be direct here because the pattern is consistent enough to be predictable.

Data integrity is the dominant inspection finding in API facilities globally. The WHO estimates that data integrity issues are identified in 30–40% of GMP inspections at API sites. This encompasses everything from audit trail gaps in laboratory systems to undocumented reprocessing to informal testing that doesn't make it into the official record. ICH Q7 does not use the phrase "data integrity" explicitly, but ALCOA principles (attributable, legible, contemporaneous, original, accurate) are embedded throughout its documentation requirements, and FDA applies them rigorously.

Process validation gaps are the second consistent finding. Section 12 requires that API manufacturing processes be validated to demonstrate they consistently produce material meeting specifications. In chemical synthesis, this typically means three or more conformance batches at commercial scale with process parameters characterized. Many manufacturers have validation on the books for their core processes, but fail to validate new synthetic routes, scale-up changes, or equipment substitutions with appropriate rigor.

Cleaning validation is a third recurring issue. API manufacturing facilities often produce multiple products on shared equipment, and the cleaning validation program must demonstrate that residues from one API don't contaminate the next. When equipment train configurations change, cleaning methods change, or new APIs are introduced, the cleaning validation program has to be updated. This often falls behind the pace of manufacturing change.

Excipient Manufacturers: A Different Risk Profile

For excipient manufacturers, the QMS challenge has a different shape. Excipients are not inherently pharmaceutical products — many are commodity chemicals or food-grade materials that pharmaceutical manufacturers source because of their functional properties. The pharmaceutical GMP layer gets added on top of an industrial production context.

The IPEC-PQG GMP Guide for Pharmaceutical Excipients, which aligns closely with ICH Q7 principles, identifies traceability and contamination control as the two most critical quality dimensions for excipient manufacturers. An excipient manufacturer needs to demonstrate that it knows where its material came from, what happened to it at every processing step, and that no contamination occurred during manufacturing or packaging.

What makes this operationally hard is that excipient facilities often run large volumes of product with thin margins and don't have the same quality infrastructure as branded pharmaceutical manufacturers. Implementing a document control system, a deviation management program, and a supplier qualification program in that environment requires a different kind of organizational commitment than it does in a purpose-built API facility.

The customer audit is usually the forcing function. A pharmaceutical manufacturer auditing an excipient supplier will apply ICH Q7-equivalent expectations, and an excipient supplier that can't demonstrate control of its process, its materials, and its quality records will lose that customer.

How Technology Is Changing QMS for API Manufacturers

A paper-based QMS was always a contradiction in terms — you're trying to manage a system using a medium that can't alert you to trends, can't automatically route documents for review, and can't tell you when a CAPA is overdue. Most API manufacturers who experienced regulatory trouble over the last decade had quality systems where the records existed but the system wasn't actually managing anything.

Electronic QMS platforms have materially changed this. The meaningful shift isn't just digitization — it's that a well-designed eQMS can surface connections between quality events that a paper system buries. A deviation in one batch, a supplier notification, and a change control from six months earlier might all be related. In a folder-based paper system, no one sees that connection. In a connected electronic system, it's visible.

AI-assisted QMS tools are beginning to take this further. Rather than just connecting records, they can identify patterns across quality data — flagging recurring deviation types before they escalate, scoring change control risk based on process parameters, or predicting which processes are statistically likely to drift based on historical batch data. This is still early, but the direction is real and the regulatory environment is receptive — FDA's Data Modernization Action Plan and ongoing guidance on computerized systems make clear that the agency views digital quality infrastructure as a compliance asset, not a compliance risk.

Nova QMS is built specifically for this environment — connecting the quality data that API and excipient manufacturers generate into a system that actually helps you manage it. You can learn more about how Nova QMS approaches compliance for regulated manufacturers.

Building a QMS That Holds Up Under Inspection

The organizations that fare well under FDA or customer audits tend to share a few things in common that have less to do with the thickness of their SOPs than with how their quality system actually functions day to day.

They have a quality unit with real authority. ICH Q7 Section 2.2 is explicit: the quality unit must have the authority to approve or reject all materials, intermediates, and APIs, and to review and approve critical documents. In practice, this means the quality unit can stop production, reject a batch, or refuse to release material — and does so when warranted, without being overridden by production or commercial pressure.

They close their CAPAs. The average time to close a corrective action in under-resourced quality organizations is often measured in months. Organizations that hold up under inspection tend to have a shorter, enforced CAPA cycle and a quality review meeting where open actions are regularly reviewed and accountability is named.

They treat their APQR as a real management review, not a compliance deliverable. The most useful APQRs I've seen conclude with a list of things that need to change — and then those things actually change.

And they've invested in quality infrastructure that matches the scale of their operation. A 200-person API manufacturer running eight commercial APIs on twenty pieces of equipment cannot manage quality effectively with a part-time quality manager and a shared drive. The mismatch between operational complexity and quality system capacity is the most common underlying cause of inspection failure.

A Note on ICH Q7 vs. ICH Q10

ICH Q10 is the pharmaceutical quality system guideline — it describes the broader quality management model that sits above product-specific guidance like ICH Q7. ICH Q7 is the what (what GMP requirements apply to API manufacturing); ICH Q10 is more about the how (how a quality management system is structured to enable continuous improvement and product lifecycle management).

For API manufacturers, ICH Q10 is not a separate compliance obligation — it's an architectural framework that makes ICH Q7 compliance more coherent. Organizations that have internalized ICH Q10 principles tend to have quality systems that are self-correcting rather than just defensive. The quality system improves the process, rather than just documenting it.

That distinction — between a quality system that is defensive and one that is actively improving — is probably the most important thing I can say about what separates organizations that struggle with compliance from those that don't.

FAQ: QMS for API and Excipient Manufacturers

Does ICH Q7 apply to excipient manufacturers?

ICH Q7 was written for API manufacturers, not excipients. However, many excipient manufacturers are contractually required by their pharmaceutical customers to comply with ICH Q7 or equivalent GMP standards. The IPEC-PQG GMP Guide is the specific framework for pharmaceutical excipients, but it aligns closely with ICH Q7 principles, and customer audit expectations often mirror ICH Q7 requirements.

What is the most common ICH Q7 inspection finding?

Data integrity failures are the most frequently cited category across FDA and international regulatory inspections of API facilities. WHO estimates these appear in 30–40% of API site GMP inspections. Change control deficiencies and inadequate OOS investigation procedures are consistently in the top five as well.

What is the difference between a deviation and a CAPA under ICH Q7?

A deviation is a departure from an approved procedure or specification — it's an event. A CAPA (Corrective and Preventive Action) is the system response to that event: identifying root cause, correcting the immediate problem, and implementing measures to prevent recurrence. ICH Q7 requires both to be documented, but the quality of the root cause investigation and the effectiveness of the corrective action are what regulators actually evaluate.

How often should an API manufacturer conduct internal audits under ICH Q7?

ICH Q7 Section 2.6 requires a self-inspection program but does not prescribe a fixed frequency. Industry practice and regulatory expectation is that all critical systems are audited at least annually, with higher-risk areas audited more frequently. The audit program should cover the full scope of the quality system on a defined cycle, and audit findings should feed into the CAPA system.

Can a small API manufacturer use a simple eQMS to meet ICH Q7 requirements?

Yes. ICH Q7 does not prescribe the format of the quality system — it prescribes the functions it must perform. A small manufacturer can meet ICH Q7 requirements with a well-configured electronic QMS that handles document control, deviation management, change control, CAPA, and audit management. The key is that the system actually supports daily quality operations rather than sitting idle between inspections. Platforms designed for regulated industries, like Nova QMS, can scale to the complexity of smaller API operations without requiring enterprise-level IT infrastructure.

Last updated: 2026-07-15