ICH Q7

This topic is part of the SG Systems Global regulatory & operations guide library.

Updated January 2026 • ICH Q7, API GMP, materials control, batch records, lab controls, cleaning validation, deviations, change control • Active Pharmaceutical Ingredients (APIs).

ICH Q7 is the global GMP playbook for active pharmaceutical ingredients (APIs). If you manufacture, process, package, test, store, or distribute APIs (or key intermediates that feed into API steps), Q7 is the standard that defines what “in control” looks like: controlled materials, controlled execution, controlled documentation, controlled laboratories, controlled changes, and controlled investigations.

Most organizations don’t fail Q7 because they “forgot to write a procedure.” They fail because the system behavior is weak under pressure: quarantine is bypassed, cleaning is assumed instead of proven, batch records are completed late, deviations are normalized, and changes quietly creep into the process until the validated state is gone. Q7 is designed to stop that drift by forcing a disciplined operating model: evidence-first, exception-governed, and traceable end-to-end.

ICH Q7 is the API truth test: can you prove, step by step, that only qualified inputs, qualified people, qualified equipment, and qualified decisions produced the batch?

1) What ICH Q7 is (and what it isn’t)

What it is: ICH Q7 is a GMP standard for APIs. It defines the system controls you must have to ensure API quality: qualified people, qualified equipment, controlled materials, controlled documentation, controlled labs, controlled changes, and controlled investigations.

What it isn’t: Q7 is not “a documentation template.” A perfectly formatted batch manufacturing record does not equal control if the underlying execution can be bypassed or reconstructed later. Q7 expects contemporaneous, attributable, defensible evidence.

Q7 also isn’t a promise that you’ll never have deviations. Deviations happen. The Q7 question is: do deviations trigger governed action—investigation, impact assessment, and recurrence prevention—or do they become background noise?

2) Scope: API steps, intermediates, and outsourced operations

Q7 is designed for API manufacturing, but it also affects upstream and downstream activities that can compromise API quality. In practice, the scope commonly includes:

• API synthesis and purification steps: where process controls, contamination control, and documentation must be strongest.
• Critical intermediates: especially where variability affects downstream quality or where the intermediate is shipped between sites.
• Packaging/repackaging and labeling of APIs: where mix-ups and identity failures have high impact.
• Storage and distribution: where conditions, status, and chain-of-custody must remain controlled (see GDP and chain of custody).
• Outsourced operations: contract manufacturing, contract labs, sampling locations, and logistics—governed through quality agreements and CMO management.

One of the most common Q7 breakdowns is a scope gap: organizations apply strong controls “inside the reactor building” but treat upstream raw material receiving, warehousing, sampling, and external labs as informal. Q7 expects the control chain to remain intact end-to-end.

3) How Q7 relates to GMP, Part 211, and computerized systems expectations

Most regulated operations operate under multiple overlapping expectations. Q7 typically sits alongside general GMP requirements and, depending on your market and systems, computerized system requirements.

In other words: Q7 is the “what” for API GMP. Your regulations and computerized system expectations define additional “how” and evidence requirements—especially for records, signatures, and audit trails.

4) Quality management system expectations in Q7

ICH Q7 assumes you operate a real quality system, not a binder. At minimum, your system should include:

• Document governance: controlled procedures, controlled revisions, controlled distribution (see document control and revision control).
• Deviation and investigation discipline: deviations are recorded, investigated, and trended (see deviation management and deviation investigation).
• CAPA: corrective and preventive actions are risk-based and verified (see CAPA and corrective action procedure).
• Change control: changes do not silently erode the validated state (see change control).
• Audit program: routine internal audits and supplier audits drive improvement (see internal audit and vendor qualification).
• Complaint handling: complaints are captured and trended (see complaint handling and complaint trending).

Many API sites strengthen Q7 execution by aligning broader PQS concepts from ICH Q10 (management review, monitoring systems) and risk-based decision-making from ICH Q9.

5) Personnel, training, hygiene, and role clarity

Q7 is explicit that people competence and behavior are part of the control system. Two patterns trigger findings repeatedly:

• Training exists but doesn’t control work. Training is recorded, yet unqualified individuals still perform critical tasks.
• Roles are unclear. The line between production decisions and quality decisions is fuzzy, so exceptions get “handled” informally.

Operationally, Q7-grade personnel control looks like:

• Role-based training and requalification (see training matrix).
• Clear quality decision authority, especially for release, deviation disposition, and change approval (see QA and QC).
• Documented handoffs and accountability for batch record completion and review (see batch record lifecycle).
• Hygiene and contamination controls appropriate to the hazards and product type.

In mature systems, training is not just a record—it’s a gate. If the system can’t block an untrained operator from performing a critical step (especially in labs and release activities), the control chain is brittle.

6) Facilities and equipment: design, qualification, maintenance

API manufacture often includes potent chemicals, solvents, dusts, and reactive processes. Q7 expects facilities and equipment to be fit-for-purpose and to stay fit-for-purpose through maintenance and change control.

Key expectations include:

• Equipment qualification appropriate to use and risk (see IQ/OQ/PQ).
• Calibration control for instruments tied to critical measurements (see calibration status).
• Maintenance and out-of-service tagging that prevents use of compromised equipment (see out-of-service tagging).
• Utilities qualification where utilities can impact quality (see UQ).
• Environmental and contamination controls appropriate to the API hazard profile (see cross-contamination control).

When equipment issues occur, Q7 expects them to be treated as quality-relevant events: investigated, impact-assessed, and linked to batches potentially affected (which is why strong traceability matters even for APIs).

7) Cleaning, contamination control, and campaign discipline

Cleaning is one of the fastest ways to lose API GMP control because it lives at the intersection of operations pressure and quality risk. Q7 expects cleaning to be defined, executed, verified, and—when required—validated.

In practical terms:

• Cleaning procedures must be controlled and specific enough to be repeatable.
• Cleaning verification must be performed as defined (see cleaning verification).
• Cleaning validation must demonstrate that residues and contaminants are removed to acceptable levels (see cleaning validation).
• Changeover controls must prevent product mix-ups and cross-contamination (see cross-contamination control).

For facilities using automated cleaning methods, controlled CIP/SIP cycles are often part of the evidence chain (see CIP and SIP).

8) Materials management: receipt, quarantine, sampling, and release

Materials control is where API GMP either becomes disciplined—or becomes performative. If your incoming material controls are weak, everything downstream is compromised and you won’t be able to “test your way out of it.”

Q7-grade materials management typically includes:

• Supplier qualification and risk-based monitoring (see supplier qualification, supplier risk management).
• Goods receipt with identity and integrity checks (see goods receipt).
• Quarantine by default until sampling/testing/review supports release (see quarantine/hold and material quarantine).
• Incoming inspection and identity confirmation where required (see incoming inspection and identity testing).
• Controlled sampling plans that match risk (see sampling plans).
• COA governance when relying on supplier testing (see COA and supplier verification of COAs).
• Release decisions captured and traceable (see component release).

When status controls are mature, a quarantined material cannot be consumed—period. If there are “workarounds” (manual issue, informal label changes, ERP transactions that bypass quality status), you will eventually ship a batch built on the wrong foundation.

9) Production controls: master records, execution evidence, and yields

Q7 expects production to be executed against approved instructions and captured in controlled records. That means production control is not only “what operators did,” but what the system can prove they did.

The documentation chain typically includes:

• Master manufacturing record as the approved blueprint (see MMR).
• Master batch record as the controlled template for execution (see MBR).
• Batch manufacturing record as the executed evidence set (see BMR).
• Batch record lifecycle controls (draft → in process → reviewed → approved → archived) (see batch record lifecycle).

Production control also depends on accurate yield and reconciliation practices. If yield variance is routinely “explained away” without real investigation, it becomes a hiding place for material loss, undocumented rework, or incorrect charge/dispense behaviors. Strong organizations implement:

• structured batch yield review
• defined mass balance expectations (where applicable)
• deviation triggers for abnormal losses (see yield variance)

10) Laboratory controls: testing, OOS/OOT, and data integrity

Laboratory controls are a major Q7 focus because labs generate release-critical evidence. If lab data integrity is weak, release decisions collapse under scrutiny—even if product quality is fine.

A Q7-grade lab control system includes:

• controlled test methods and method changes (see test method validation)
• governed sample handling, chain-of-custody, and data review (see chain of custody)
• proper handling of OOS and OOT results
• defined review and approval expectations for lab records (see tests/analyses review)

Data integrity is not optional. For labs, that means:

• Audit trails enabled, reviewed, and meaningful (see audit trail)
• Attributable access and controlled privileges (see role-based access and user access management)
• Electronic signature meaning is explicit (see electronic signatures and 21 CFR Part 11)
• Retention and archiving preserve evidence (see record retention and data archiving)

If you use lab information systems, ensure the validation approach is risk-based and documented (see LIMS, CSV, and GAMP 5).

11) Validation: process, cleaning, methods, and computerized systems

Validation is the mechanism that turns “we believe it works” into “we can prove it works.” In Q7, validation is not limited to process validation; it extends to cleaning, analytical methods, and computerized systems that generate or govern GMP records.

In practice, Q7-aligned validation programs commonly include:

• Process validation (see process validation and PPQ).
• Continued monitoring to ensure the process stays in control (see CPV).
• Cleaning validation for shared equipment and high-risk carryover scenarios (see cleaning validation).
• Method validation and method controls (see TMV).
• Computerized system validation for systems that create, modify, or store GMP records (see CSV).

Validation documentation should be organized as a system, not scattered artifacts. Many organizations anchor this through a Validation Master Plan (VMP) that defines scope, approach, and governance.

12) Deviations, investigations, and CAPA effectiveness

Deviations are where Q7 either protects you or exposes you. A deviation system that’s too permissive will normalize failure. A deviation system that’s too punitive will drive underreporting. Q7 expects a disciplined middle: capture deviations consistently, investigate proportionally to risk, and implement CAPA that actually prevents recurrence.

A Q7-aligned deviation/CAPA loop typically includes:

• clear definitions and workflow (see deviation management)
• structured investigation methods and evidence requirements (see deviation investigation)
• root cause rigor (see RCA)
• CAPA planning and tracking (see corrective action plan and CAPA)
• distinction between correction vs preventive action (see corrective vs preventive action)

Most CAPA systems look fine until you ask one question: “Show me recurrence rate by failure mode.” If the same issues keep returning (label mix-ups, status bypasses, cleaning misses, late documentation), your system is closing tasks—not preventing recurrence.

13) Change control and protecting the validated state

API processes evolve constantly: suppliers change, equipment is replaced, parameters are optimized, methods are improved. Q7 does not prohibit change—it demands that change is controlled so the validated state doesn’t drift into unknown territory.

A Q7-grade change system typically includes:

• formal change control with risk assessment and approvals
• operational MOC so the change is implemented as designed, not as improvised
• revision control so old procedures don’t remain in circulation
• explicit linkage to validation activities where impacts exist (see CSV and process validation)

Change control must also connect to master data and controlled system configuration. If the approved bill of materials, specs, sampling plans, or status rules are not synchronized across systems, you create “silent nonconformance” where production executes against the wrong truth (see master data control).

14) Packaging, labeling, storage, and distribution integrity

API quality can be lost after production if packaging, labeling, storage, or distribution is sloppy. Q7 expects you to control identity, status, and conditions through the supply chain.

Key controls include:

• Labeling control to prevent mix-ups (see labeling control).
• Hold and release discipline for finished API lots (see hold/release and release status).
• Controlled storage conditions where applicable (see temperature-controlled storage and temperature excursion).
• Chain of custody and shipment records that support traceability (see chain of custody and bill of lading).
• Traceability evidence that supports rapid scope action when issues arise (see global batch traceability and lot genealogy).

If you want operational resilience, your storage and distribution controls should be designed to make the correct path the easy path—status is visible, movement is recorded, and exceptions (like excursions) trigger governed workflows.

15) Suppliers, contractors, and quality agreements

API supply chains are global and multi-party. Q7 expects you to control outsourced work through clear responsibilities and verified performance—not trust.

High-performing Q7 organizations typically implement:

• Supplier onboarding and qualification (see supplier onboarding and supplier qualification).
• Supplier risk management and monitoring (see supplier risk management and supply chain risk).
• Quality agreements that define who owns what decisions (see quality agreements).
• CMO management routines (metrics, deviations, change approvals, audits) (see CMO management).
• Supplier CAPA linkage using SCAR when needed (see SCAR).

If you operate in multiple regulated domains, you may also map supplier governance to broader risk and PQS concepts (see ICH Q10 and QRM).

16) Metrics that prove Q7 is working

If Q7 is implemented well, you should see measurable outcomes: fewer repeats, faster investigations, fewer status errors, tighter traceability, and less “forensic archaeology” during audits.

Metrics only work if they drive decisions. If leadership sees recurring failures and doesn’t allocate resources or remove root causes, Q7 becomes compliance theater.

17) Implementation blueprint and audit-readiness checklist

Implementing Q7 (or upgrading to Q7-grade performance) works best as a system design project, not a “write more SOPs” project. Use this blueprint to get traction.

18) Common failure modes that trigger audit findings

• Status bypasses: quarantined/held materials can still be issued or “fixed” with paperwork (quarantine/hold).
• Late records: batch records completed after execution, missing contemporaneous evidence (BMR).
• Cleaning by assumption: cleaning verification/validation is incomplete or not tied to equipment use (cleaning validation).
• Weak investigations: deviations “closed” with retraining instead of cause elimination (investigations).
• CAPA without effectiveness: actions completed but recurrence remains high (CAPA).
• Change drift: uncontrolled process/equipment/method changes quietly erode validated state (change control).
• Lab data integrity gaps: audit trails not reviewed, shared logins, unclear e-signature meaning (audit trail, e-signatures).
• Supplier over-trust: COAs accepted without verification strategy (COA verification).

Most of these are not “technical” problems—they’re governance and system design problems. Fix the system behavior and the compliance outcomes follow.

19) Extended FAQ

Q1. What is ICH Q7?
ICH Q7 is a GMP guideline for APIs. It defines quality system, manufacturing, laboratory, documentation, validation, and change control expectations for API operations.

Q2. Does ICH Q7 apply only to API synthesis?
No. Q7 controls typically extend to supporting operations that can affect API quality: materials receipt/sampling, packaging/labeling, storage, distribution, and outsourced activities governed by quality agreements.

Q3. What is the single biggest Q7 risk area?
Materials and status control. If quarantined or incorrect materials can be used—or if you can’t prove exactly which lots were used—your batch evidence chain is fragile.

Q4. How should Q7 handle deviations?
Deviations must be captured, investigated proportionally to risk, and linked to CAPA that prevents recurrence (see deviation management and CAPA).

Q5. What does “Q7-ready” data integrity look like?
Records are attributable, contemporaneous, and auditable. Audit trails are enabled and reviewed, access is controlled, e-signatures have meaning, and retention/archiving preserves evidence (see data integrity, audit trails, and 21 CFR Part 11).

Related Reading
• Core ICH: ICH Q7 | ICH Q10 | ICH Q9
• GMP System Controls: GMP/cGMP | 21 CFR Part 211 | Change Control | Deviation Management | CAPA
• Lab & Integrity: OOS | OOT | Data Integrity | Audit Trail | 21 CFR Part 11 | Annex 11
• Validation: VMP | Process Validation | PPQ | CPV | Cleaning Validation
• Suppliers & Outsourcing: Supplier Qualification | Supplier Risk | Quality Agreements | CMO Management