API change not reported during WHO PQ assessment – PQ assessment risk and mitigation



Published on 29/01/2026

Mitigating Risks of Unreported API Changes during WHO PQ Assessments

In the pharmaceutical industry, the integrity of Active Pharmaceutical Ingredients (APIs) is paramount, especially during the WHO Prequalification (PQ) assessments. An API change not reported during these critical PQ evaluations can lead to serious regulatory consequences and risks in product quality. This playbook aims to equip quality professionals and regulatory affairs personnel with actionable steps to effectively manage and mitigate the risks associated with unreported API changes during WHO PQ assessments.

By following this structured approach, industry professionals will be able to identify key symptoms, pinpoint probable causes, initiate containment actions, and ensure compliance through thorough investigation and control strategies. This guide incorporates frameworks from GMP compliance and regulatory expectations to foster audit readiness across various stages of the pharmaceutical manufacturing process.

Symptoms/Signals on the Floor or in the Lab

Recognizing early warning signs of unreported API changes is crucial for maintaining product integrity. Symptoms may manifest in various forms, including:

  • Lab Test
Discrepancies: Unexpected variances in analytical results during stability or routine QC testing.
  • Increased Batch Variability: Higher than normal deviations in process parameters or final product characteristics.
  • Deviations and Out-of-Spec (OOS) Results: Frequent OOS results that were not anticipated based on historical data.
  • Auditor Concerns: Observations or comments from internal and external audits highlighting documentation gaps or inconsistencies.
  • Supplier Changes: Changes in raw material suppliers or specifications not being communicated effectively across departments.
  • Recognizing these signals will prompt timely intervention to investigate underlying issues and prevent potential regulatory repercussions.

    Likely Causes

    Identifying the root causes of an unreported API change can be organized into several categories typically known in quality management systems:

    • Materials: Changes in the composition or source of the API without proper documentation.
    • Method: Variations in analytical or manufacturing processes not explored in validation efforts.
    • Machine: Equipment failure or calibration issues that lead to inconsistencies in production.
    • Man: Human errors in documentation or communication breaks between departments.
    • Measurement: Inaccurate testing due to unrecalibrated instruments affecting the data collected.
    • Environment: External factors such as temperature or humidity affecting the storage and handling of APIs.

    Utilizing these categories can help in streamlining investigations and identifying specific sources of non-compliance.

    Immediate Containment Actions (first 60 minutes)

    When an unreported API change is suspected, swift containment is critical. Follow these steps during the first hour:

    1. Isolate Affected Batches: Segregate all batches that used the potentially altered API.
    2. Stop Production: Cease any ongoing processes involving the implicated API until the situation is clarified.
    3. Collect Initial Data: Gather relevant documentation including batch records, test results, and CAPA logs related to the implicated API.
    4. Engage Cross-Functional Teams: Involve production, quality control, and regulatory affairs personnel in immediate discussions.
    5. Notify Regulatory Bodies: If warranted, prepare to inform regulatory authorities about the potential deviation.

    These actions will help minimize risks while initiating the investigation process.

    Investigation Workflow (data to collect + how to interpret)

    A robust investigation workflow is essential for determining the implications of an unreported API change. Follow this structured approach:

    • Collect Data: Gather evidence from batch records, stability tests, production logs, and analytical testing documentation.
    • Analyze Patterns: Look for trends in the collected data that may indicate a shift in performance or quality concerning the API.
    • Peer Review: Have the findings reviewed by a cross-functional team to confirm observations and prevent bias in analysis.
    • Document Findings: Ensure all data and insights are recorded in an investigation report that captures the issue comprehensively.

    Interpreting this data will inform the necessary corrective actions and potential impacts on product quality and regulatory status.

    Root Cause Tools (5-Why, Fishbone, Fault Tree) and when to use which

    Utilizing root cause analysis tools can deepen understanding of the problem. Here’s a breakdown of common tools:

    Tool When to Use
    5-Why Analysis When a straightforward cause-effect relationship is suspected and further qualitative deep dives are required.
    Fishbone Diagram Best for complex issues where multiple factors may contribute to the problem across various categories.
    Fault Tree Analysis Ideal for identifying potential failures in a system and assessing the impact of different potential deviations.

    Choosing the right tool depends on the complexity of the problem and the data available for analysis.

    CAPA Strategy (correction, corrective action, preventive action)

    Addressing the issue requires an effective Corrective and Preventive Action (CAPA) strategy. Here’s a structured approach:

    • Correction: Implement immediate actions to rectify the identified issue, such as quarantining affected products.
    • Corrective Actions: Define and execute actions that prevent recurrence, such as improving documentation practices around API changes.
    • Preventive Actions: Institutionalize training programs and revise process flows to ensure comprehensive understanding and reporting of changes.

    This CAPA approach fosters a culture of continuous improvement and aligns with regulatory expectations.

    Control Strategy & Monitoring (SPC/trending, sampling, alarms, verification)

    To ensure ongoing compliance and product quality, implement a robust control strategy:

    Related Reads

    • Statistical Process Control (SPC): Employ SPC techniques to monitor critical processes involved in API use.
    • Trend Analysis: Regularly review data trends to identify shifts in product quality or process variations.
    • Sampling Plans: Revise sampling strategies for APIs to include more frequent checks as necessary.
    • Alarms/Alerts: Set up automated alerts for atypical values or deviations detected within key quality metrics.
    • Verification Steps: Establish verification steps post-containment to assess integrity before releasing batches.

    This multifaceted monitoring approach will help maintain compliance and safeguard quality standards.

    Validation / Re-qualification / Change Control impact (when needed)

    Unreported changes might necessitate a re-assessment of validation and change control processes:

    • Re-validation: Initiate re-validation studies if changes to the API impact the manufacturing process outputs.
    • Change Control Evaluation: Conduct a thorough review of existing change control procedures to identify gaps that allowed the unreported change.
    • Regulatory Notice: If essential, communicate the unreported change to relevant regulatory bodies to seek guidance on next steps.

    This process ensures that any potential impacts on quality have been appropriately addressed.

    Inspection Readiness: what evidence to show (records, logs, batch docs, deviations)

    To demonstrate compliance and readiness for inspection, the following documentation must be adequately maintained:

    • Batch Production Records: Ensure all batch records accurately reflect changes and provide a comprehensive history of manufacturing.
    • Quality Control Documentation: Maintain logs of quality testing that depict the analytical journey regarding the API.
    • Deviations and CAPA Records: Document all deviations with corresponding CAPA actions taken and their outcomes.
    • Change Control Logs: Keep detailed records of all changes involving APIs, ensuring that changes have been vetted through proper channels.

    This evidentiary collection is crucial for effective regulatory inspections and compliance adherence.

    FAQs

    What should I do if I suspect an API change was not reported?

    Immediately implement containment actions, gather all relevant data, and engage cross-functional teams to assess the situation.

    How do I prevent future unreported API changes?

    Enhance training programs on change control, improve communication channels between departments, and perform regular reviews of validation credentials.

    What documentation is critical during an investigation?

    Batch production records, analytical testing results, CAPA logs, and any communication regarding changes should be collected and evaluated.

    When should I involve regulatory bodies?

    If there’s a potential for significant impact on product quality or patient safety, regulatory bodies should be notified per the established guidance policies.

    What are the implications of OOS results in relation to API changes?

    OOS results may indicate that the API or the process has deviated from expected parameters, necessitating an immediate investigation and potential CAPA actions.

    Are there specific guidelines for handling changes in APIs?

    Yes, regulatory bodies like the FDA and WHO provide guidance on change management, emphasizing the need for robust change control procedures in accordance with GMP standards.

    How can SPC be utilized during monitoring?

    SPC can identify trends and variations in the manufacturing process, enabling proactive adjustments that ensure consistent API quality.

    What common tools are used in root cause analysis?

    Common tools include 5-Why Analysis, Fishbone Diagrams, and Fault Tree Analysis, each suited for different types of investigations.

    How often should APIs be validated?

    Validation should occur during significant changes in process, materials, or equipment, with routine reviews as part of the ongoing quality assurance program.

    What evidence is required for audit readiness?

    Maintain comprehensive logs of production, deviation reports, CAPA actions, and any changes to the API with clear documentation protocols.

    Pharma Tip:  Deviation history questioned during requalification – preventing PQ suspension