Materials, Components & Packaging Controls
Control of what comes in: specifications, provenance, sampling, testing, status control, traceability, storage conditions, and the notification obligations attached to change. Material attributes propagate directly into product, and a specification that omits an attribute the process depends on will be met by material that does not work — with the supplier entirely correct in saying it complied.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 24 LINKSIncoming control is the last point at which a problem is cheap: everything that passes it becomes part of a batch, and reliance on a certificate is a decision to trust a document over a test.
06 · QUALITY MATURITY — MATERIALS, COMPONENTS & PACKAGING CONTROLS, REACTIVE TO ADAPTIVE
Materials are received against the purchase order and released on the supplier’s certificate. Identity is confirmed by the label.
Specifications exist and identity is verified, but the specification lists compendial attributes rather than the attributes this process depends on.
Specifications include the functional attributes that drive performance, certificate reliance is justified by periodic verification, and printed components are controlled as regulated documents.
Incoming variability is trended and correlated with process performance, so a supplier shift is detected as a pattern before it becomes a deviation.
Material attributes are understood well enough to be specified narrowly where it matters and left wide where it does not, and supplier change is anticipated rather than absorbed.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 5
Derived from the 5 standards SPEQ maps to this subject, across 4 regulatory bodies: FDA, ICH, IPEC, EC.
RECORDS & OBJECTIVE EVIDENCE
- Material specifications, including functional attributes beyond compendial identity
- Identity verification records for every incoming lot
- The justification for certificate reliance, with its periodic verification testing
- Printed and packaging component control, including version and reconciliation
- Incoming variability trending, correlated with process performance where relevant
COMMON INSPECTION FINDINGS
- Release on certificate with no periodic verification establishing it can be relied on
- Specifications limited to compendial attributes while the process depends on others
- Identity confirmed from labelling rather than by test
- Printed components uncontrolled, so obsolete artwork remains available for use
- Supplier-side changes reaching the process as unexplained variability
The specification is the contract, and it is usually incomplete
Incoming material specifications are typically assembled from a compendial monograph plus whatever the supplier’s certificate reports. Both are legitimate starting points and neither was written for this process. The attributes that actually drive performance — particle size distribution, bulk density, moisture, a functional property specific to how this material is used — are frequently absent, because they were never identified during development or were known and never written down.
This is where the "compliant material that does not work" failure originates, and it is invisible until it happens. The corrective step is not more testing; it is going back to the process characterisation and asking which material attributes the process is actually sensitive to, then putting those in the specification with a justified range.
Provenance and the tiers you did not qualify
ICH Q7 requires knowledge of the supply chain for active substances, and the practical question is how far back that knowledge extends. A qualified supplier who blends, repacks or brokers rather than manufactures introduces a tier nobody assessed, and the certificate of analysis may be transcribed rather than generated. Falsified-medicines legislation and the excipient GMP guidance both push in the same direction: know who actually made it.
Excipients carry the additional complication that ICH Q7 covers actives, not excipients — which is exactly why the joint IPEC-PQG GMP guide exists. Applying an API-derived expectation to an excipient supplier produces a mismatch in both directions: unrealistic in some areas and insufficient in others, most notably in the risk-based approach the excipient guide actually asks for.
Change notification is the clause that decides everything later
A supplier who changes a manufacturing site, a synthetic route, a grade or a subcontractor without telling the customer has not necessarily broken the specification. Whether the customer finds out depends entirely on a change-notification obligation agreed in the quality agreement, with a defined scope of what counts as notifiable and a defined lead time before implementation.
The failure mode is well documented and expensive: a change made and notified after the fact, or notified in a way that reached procurement rather than quality, discovered when the process behaves differently. The clause is cheap to negotiate at qualification and effectively impossible to obtain during a dispute, which is why it belongs in the qualification decision rather than in a later contract review.
SPEQ interpretation — status control is a physical control
Quarantine, released and rejected are states, and in most sites they are recorded in a system and enforced by a label. Where the physical control does not match the system state — released and quarantined material stored adjacent, a status change that does not move anything, an operator who can pick either — the system record describes an intention rather than a control.
The test is whether an incorrect pick is prevented or merely detected afterwards. Detection is a reconciliation finding; prevention is segregation, scanning at the point of use, or an interlock. Sites that rely on labels alone reliably discover this through a mix-up investigation, and the investigation conclusion is almost always about the person who picked.
FREQUENTLY ASKED
Why does compliant material sometimes not work?
Because the specification omitted an attribute the process depends on — particle size distribution, bulk density, moisture, a functional property specific to this use. Specifications assembled from a compendial monograph plus a supplier certificate were written for other purposes, and the missing attribute is invisible until a batch behaves differently.
Does ICH Q7 cover excipients?
No — it covers active pharmaceutical ingredients, which is precisely why the joint IPEC-PQG GMP guide for excipients exists. Applying API expectations to an excipient supplier is unrealistic in some areas and insufficient in others, most notably in the risk-based approach the excipient guide actually asks for.
What should a change-notification clause specify?
What counts as notifiable — site, route, grade, subcontractor, specification — and the lead time before implementation, with notification routed to quality rather than procurement. It is cheap to negotiate at qualification and effectively unobtainable during a dispute, which is why it belongs in the qualification decision.
Is material status control a system control or a physical one?
Both, and the test is whether an incorrect pick is prevented or only detected afterwards. Where released and quarantined material sit adjacent and a status change moves nothing, the system record describes an intention. Segregation, scanning at point of use or an interlock is prevention; reconciliation is detection.