Supplier Quality × Excipients
ICH Q7 governs APIs and deliberately stops there — excipients sit outside binding GMP. Supplier quality for excipients means qualifying materials from an industry that does not answer to pharma, using a risk assessment the user owns.
What this page does not claim
An intersection covers what happens only where two axes overlap. It does not restate what either parent page says, and it is not a substitute for reading them.
WHAT ONLY EXISTS IN THE OVERLAP
- The governing standard is defined by an absence: ICH Q7 states its scope as active pharmaceutical ingredients and stops there. Excipients sit outside binding GMP in most jurisdictions, so the assurance a user needs is not mandated for the supplier — the IPEC-PQG guide exists to fill a gap regulators left deliberately.
- The leverage inverts. An excipient maker is typically a chemical company for which pharmaceutical customers are a minor share of the order book — the buyer cannot impose its quality system by contract weight, so assurance must be engineered from assessment, agreement, and monitoring rather than command.
- The GMP determination belongs to the user, not the supplier. EU rules require the medicine manufacturer to ascertain, through a formalised risk assessment, what level of GMP each excipient warrants — an obligation with no analogue in API sourcing, where the floor is set by law.
- The same chemical ships as many grades from one reactor. "Pharmaceutical grade" is a claim about testing, handling, segregation, and change control downstream of synthesis — which is exactly the part a certificate of analysis does not show.
- Excipient history carries the industry's worst supply-chain failures: diethylene glycol sold as glycerin has killed patients repeatedly across decades, and every such lot passed the identity testing of its era. The standing lesson is specific — test for the adulterant, and know who actually made the material.
The gap ICH left on purpose
ICH Q7 opens by defining its own boundary: it applies to the manufacture of active pharmaceutical ingredients. Excipients — the bulk of most formulations by mass — are outside it, and the exclusion was a decision, not an oversight. Excipient manufacture is the chemical, mineral, and food-processing industry: the same plants make material for cosmetics, food, and industrial use in volumes that dwarf pharmaceutical demand, and imposing API-grade GMP across that base was never a workable proposition. The result is a structural oddity unique to this corner of the supply chain: the materials are in the product, but no binding international GMP reaches the sites that make them, and in most jurisdictions no medicines authority routinely inspects them.
Into that gap the industry built its own floor. The Joint IPEC-PQG GMP Guide for Pharmaceutical Excipients — currently in its fifth edition, 2022 — is the consensus standard: a quality-system framework deliberately structured so a supplier can be audited against it, calibrated to what excipient manufacture can realistically sustain, including the pragmatic question API rules never face — the point in a long chemical process at which excipient GMP begins to apply. Third-party certification schemes such as EXCiPACT extend the guide's reach by letting one accredited audit serve many customers. But none of this is law, which defines the intersection's character: the user's own qualification programme is not verifying compliance with a mandate — for most excipients, it is the only assurance mechanism that exists at all.
Qualification without leverage
Supplier-quality practice quietly assumes the buyer matters to the supplier. For excipients this is routinely false: a pharmaceutical company buying a commodity polymer or mineral may represent a fraction of a percent of the producer's volume, and the producer will not redesign its change control, grant weeks of audit access, or run bespoke testing for that fraction. Assurance must therefore be assembled from instruments that do not depend on leverage: questionnaires read for what they are, audits where they can be obtained, shared and third-party audit programmes that pool the industry's leverage where no single buyer has any, certification against the IPEC-PQG guide, and — carrying more weight here than in any other supplier relationship — the user's own incoming-testing and trending programme as the standing check on what actually arrives.
Risk proportionality, in the sense of ICH Q9(R1), decides how the portfolio is deployed per material and per supplier. The variables are concrete: the excipient's function and criticality in the formulation, the route of administration — a parenteral-grade excipient and an oral tablet filler do not warrant the same programme — the fraction of the formulation it represents, the supply chain's shape, and the supplier's demonstrated history. Chain shape deserves particular weight, because excipients move through traders, brokers, and repackers more than any other GxP material, and every intermediate hand is a place where identity, provenance, and storage conditions can silently change while the paperwork stays clean. A qualification that assessed the manufacturer but not the route has assessed half the risk.
The determination the user owns
The EU made the inversion explicit. Under the falsified-medicines amendments to the medicines directive, manufacturers must ascertain that excipients are suitable through a formalised risk assessment — the 2015 guidelines set out the exercise — determining the appropriate GMP for each excipient based on its source, its use, and the risk it presents, then confirming the supplier meets that determination. Read against API practice the structure is inverted: for an active, the law sets the GMP floor and the user verifies compliance with it; for an excipient, the user's own documented judgement sets the floor. That makes the risk assessment a load-bearing regulatory document — auditable, revisable, and owned — rather than an internal formality, and it means two manufacturers can legitimately hold the same supplier to different standards because their uses differ.
The determination also has to survive the grade problem. A single reactor campaign may ship as industrial, food, and pharmaceutical grades — distinguished not by synthesis but by what happens afterward: the testing applied, the packaging line, the segregation, the traceability, the change control on the pharmaceutical stream. "Pharmaceutical grade" is thus a claim about the supplier's downstream quality system, precisely the part a certificate of analysis does not reveal. And compendial conformity is a floor with a known weakness: a lot can meet the monograph and still fail in use, because functionality-related characteristics — particle size, viscosity grade, polymorphic form — sit outside many monographs while governing how the material performs in the process. The user's specification, not the compendium, is where suitability actually lives.
Adulteration, silent change, and the limits of the CoA
The excipient chapter of pharmaceutical history is written in diethylene glycol. From the 1937 sulfanilamide elixir deaths that produced the modern FD&C Act, through mass poisonings in Haiti in the 1990s and Panama in 2006, to the contaminated cough syrups that killed children in several countries in 2022, the pattern repeats: DEG or ethylene glycol enters the chain sold as glycerin or another polyol, and every lot passes the identity testing of its era — because the adulterant mimics what the test measures. The regulatory response is correspondingly specific: identity testing on each lot of at-risk materials using methods that detect the adulterant itself, performed on the material received rather than inherited from a certificate, together with provenance work that answers the only question that ultimately matters — who actually manufactured this lot, and through how many hands did it pass?
The quieter risk is uncommunicated change. A chemical producer optimises continuously — a new catalyst, a different feedstock, a debottlenecked step, new packaging — and changes that are invisible to industrial customers can shift an impurity profile or a functionality characteristic that only a pharmaceutical process would ever notice. IPEC's significant-change framework and notification clauses in the quality agreement are the formal repair, defining which changes the supplier must disclose; incoming-result trending is the detector of last resort, since a drift in a functionality parameter is often the user's first notice that something upstream moved. ICH Q10's outsourced-activities principle closes the frame: the user's pharmaceutical quality system extends over the material's provenance even where no binding GMP follows it — which is the entire discipline of this intersection in one sentence.
Derived from the 4 standards SPEQ maps to this intersection, across 2 regulatory bodies: ICH, IPEC.
FREQUENTLY ASKED
Does ICH Q7 apply to excipient manufacture?
No — Q7 defines its scope as the manufacture of active pharmaceutical ingredients, and excipients are outside it by design, not omission. That absence is the organising fact of excipient supplier quality: there is no binding international GMP for excipient makers, most of whom are chemical or food-industry producers never inspected by a medicines authority. The consensus reference that fills the gap is the Joint IPEC-PQG GMP Guide for Pharmaceutical Excipients, written to be auditable and calibrated to what excipient manufacture can sustain. Q7's principles — traceability, change control, contamination control — still inform what a user should look for; they simply arrive by the user's risk assessment rather than by regulation.
Can a certificate of analysis substitute for qualifying an excipient supplier?
No — a CoA is a claim by the supplier, and relying on it is itself a decision that has to be qualified. The defensible pattern is sequenced: full testing of initial lots to verify the certificate tells the truth, a documented reliability history before any reduced-testing decision, periodic full re-verification thereafter, and identity testing on every lot regardless — with adulterant-specific methods for at-risk materials such as glycerin and related polyols, where history shows the certificate and the conventional identity test can both pass while the material kills. A CoA from a broker or repacker deserves extra scepticism, since it may be reissued paperwork several hands removed from the site that actually made the lot.
What GMP standard should an excipient supplier actually be held to?
The one the user's own formalised risk assessment determines — that is the structural answer, and in the EU it is the legal one: the medicine manufacturer must ascertain appropriate excipient GMP based on source, use, and risk, and confirm the supplier meets it. In practice the reference frame is the IPEC-PQG guide, with the depth of conformity expected scaled by criticality: a parenteral-grade excipient at high formulation fraction warrants audits, change-notification agreements, and tight specifications; a well-characterised commodity in an oral solid may justifiably carry a lighter programme. The essential discipline is that the determination is documented, owned, and revisited — because it, not a regulation, is the floor.
Why is glycerin treated as a special case in excipient quality?
Because it carries the deadliest recurring failure in supply-chain history: diethylene glycol or ethylene glycol substituted for or contaminating glycerin has caused mass fatalities repeatedly for nearly a century — 1937 in the United States, Haiti in the 1990s, Panama in 2006, and multiple countries again in 2022 — and each time the material passed the identity checks then in use. The response is concrete: every lot of glycerin and similar polyols tested on receipt with methods that specifically detect and limit DEG and EG, no reliance on certificates for that determination, and provenance established back to the actual manufacturer rather than the most recent reseller. Glycerin is the standing proof that excipient risk is real, asymmetric, and cheap to miss.