API site WHO GMP risk during API sourcing – avoiding repeat WHO observations



Published on 28/01/2026

Mitigating Risks in API Sourcing to Ensure WHO GMP Compliance

The sourcing of Active Pharmaceutical Ingredients (APIs) often presents challenges that can jeopardize compliance with WHO GMP standards. Frequent failures or observations during WHO inspections not only impact operational integrity but may also stall important therapeutic products from reaching patients. By adhering to a structured playbook, pharma professionals can navigate these complications and fortify their compliance strategies.

This article provides a comprehensive playbook for pharmaceutical professionals involved in API sourcing. It details the immediate steps needed to triage issues, effective investigation workflows, and long-term controls to mitigate risks while ensuring inspection readiness. By the end of this article, you will have actionable insights to protect against repeat WHO observations and strengthen your quality systems (QMS).

Symptoms/Signals on the Floor or in the Lab

Identifying symptoms or signals that indicate potential risks during API sourcing is crucial. Common symptoms may include:

  • Increased Deviations: A rise in deviation
notices related to API quality metrics can signal underlying issues.
  • Frequent Rejections: Elevated rates of rejected batches because of quality or purity failures.
  • Supplier Audits Findings: Identifying multiple or recurring non-conformances during supplier audits can indicate lapses in the GMP compliance of API producers.
  • Analytical Failures: Inconsistent results in quality control test results or discrepancies in the testing methods used by laboratories.
  • Customer Complaints: Receiving complaints related to API-related issues from formulators or partners.
  • Regulatory Feedback: Observations or concerns raised during regulatory inspections may suggest gaps in your sourcing strategy.
  • Likely Causes

    Understanding the likely causes of these symptoms can streamline corrective actions. Analyzing through different categories such as Materials, Method, Machine, Man, Measurement, and Environment can help pinpoint the issue:

    Category Potential Causes
    Materials Non-compliant suppliers; poor raw material quality; lack of appropriate documentation.
    Method Inadequate validation of testing methods; outdated procedures; insufficient training on SOPs.
    Machine Equipment miscalibration; lack of preventive maintenance leading to equipment failure.
    Man Human error due to lack of training; insufficient oversight in supplier quality agreements.
    Measurement Inaccurate or blind sampling leading to false quality indicators; lack of proper controls.
    Environment Inadequate environmental controls during transport or storage impacting API stability.

    Immediate Containment Actions

    Within the first 60 minutes of identifying a potential compliance issue, it’s critical to take immediate containment actions. Here are the steps that should be undertaken:

    • Cease all API usage: Immediately halt the use of the affected API batches to prevent further processing until the issue is addressed.
    • Establish a response team: Form a cross-functional team that includes representatives from QA, QC, Regulatory Affairs, and Production to assess the situation.
    • Document the Event: Create a temporary incident report. Ensure all communications and decisions are logged for future audits.
    • Initiate Quarantine: Quarantine any remaining stock from the supplier until proper investigation and evaluation occur.
    • Notify Stakeholders: Ensure all relevant personnel, including upper management, are informed of the situation and implications.
    • Engage with the Supplier: Contact the supplier to inquire about the status of their operations and if other customers have experienced similar issues.

    Investigation Workflow

    The investigation workflow is pivotal for understanding the scope of the issue. The following steps outline how to collect and interpret relevant data effectively:

    • Data Collection: Gather relevant operational data, quality assurance records, supplier audits, deviations, and complaint log details.
    • Investigate Root Causes: Utilize tools such as the 5-Why Analysis to dig deeper into the why’s behind deviations. Engage with frontline workers who may have sensed issues before formal reporting.
    • Trend Analysis: Review quality control metrics for trends that coincide with the observed issue, including batch records of any affected APIs and previous non-conformance reports.
    • Document Findings: Review your collected evidence and create a detailed report to support compliance and audit needs.
    • Validation of Investigation: Confirm findings with regulatory expectations, whether through WHO standards or other guidelines relevant to your region.

    Root Cause Tools

    To clarify the basis of the problem and prevent recurrence, several analytical tools can be deployed:

    • 5-Why Analysis: Effective for straightforward issues, this tool focuses on examining the root cause of a problem by repeatedly asking why it occurred. Use this when the symptoms are direct and easily traced back to a specific cause.
    • Fishbone Diagram: Helpful for identifying complex issues with multiple causative factors. Use this when symptoms span multiple departments (e.g., QA, Production).
    • Fault Tree Analysis: Best for analyzing systems failures and complex problems where multiple variables may contribute to a non-conformance. This is useful when capturing minor deviations that could lead to severe compliance issues.

    CAPA Strategy

    Once the root cause has been determined, it is essential to implement a comprehensive CAPA (Corrective and Preventive Action) plan:

    1. Correction: Address immediate non-compliance issues found during the investigation. For instance, if a batch fails a quality check, obtain a certificate of analysis or decide to discard the batch.
    2. Corrective Action: Once a correction has been made, implement actions to prevent the recurrence of the issue, such as updating supplier qualification processes or revising standard operating procedures (SOPs).
    3. Preventive Action: Focus on systemic changes to reduce the risk of future occurrences, which may include ongoing training for personnel, enhanced supplier audits, or amendments to the quality agreement.

    Control Strategy & Monitoring

    Once corrective actions have been implemented, developing a control strategy is necessary to monitor compliance and maintain the quality of your API supply chain:

    • Statistical Process Control (SPC): Utilize SPC to track process variability and monitor control limits for API quality parameters.
    • Sampling Plans: Establish robust sampling criteria for incoming API batches to catch any deviations early.
    • Real-time Monitoring: Employ real-time monitoring systems to alert personnel to deviations in manufacturing conditions or API storage environments.
    • Lifecycle Review: Make ongoing assessments of supplier performance, integrating lessons learned into the continuous improvement framework for sourcing activities.

    Validation / Re-qualification / Change Control Impact

    Any corrective actions that involve changes to processes or suppliers may necessitate validation or re-qualification efforts:

    • Change Control Procedures: Define the protocol interfaces with change control to ensure all modifications go through formal assessment before implementation.
    • Vendor Qualification: If a new supplier is proposed, ensure extensive vendor qualification and validation of their processes and capabilities.
    • Ongoing Validation: Implement a program for periodic re-evaluation of suppliers as well as testing methods to account for any new regulatory updates or internal procedure changes.

    Inspection Readiness: What Evidence to Show

    Being inspection-ready means having clear, organized documentation available at all times. Here’s what should be compiled:

    • Records of Deviations: Maintain clear records documenting all deviation investigations conducted, the outcome, and corrective actions implemented.
    • Batch Documentation: Provide batch production records and analytical testing results to support compliance claims during inspections.
    • Audit and Inspection Logs: Keep a history of internal audits, supplier audits, and regulatory inspections to track trends over time and demonstrate continuous compliance.
    • Quality Agreements: Ensure all quality agreements with suppliers highlight expectations regarding WHO GMP standards and compliance to maintain accountability.

    FAQs

    What are the consequences of non-compliance with WHO GMP when sourcing APIs?

    Non-compliance can lead to regulatory actions, including fines, product recalls, or withdrawal of market authorization.

    Related Reads

    How can I rapidly identify potential issues during API sourcing?

    Monitor failure trends, maintain open communication with suppliers, and conduct regular audits.

    What role does quality assurance play in managing API sourcing?

    Quality assurance is critical in ensuring adherence to protocols, managing supplier relationships, and maintaining documentation.

    What should be included in an API supplier audit?

    Include evaluations of quality control processes, manufacturing workflows, SOP compliance, and training programs.

    How frequently should suppliers be evaluated?

    Implement a risk-based approach, evaluating higher-risk suppliers more frequently, while maintaining periodic checks on lower-risk suppliers.

    What is the significance of CAPA in API sourcing?

    CAPA ensures that once an issue is identified, systematic actions are taken to prevent recurrence, promoting continuous improvement.

    How can SPC contribute to GMP compliance?

    SPC helps monitor and control processes by identifying variability, thus ensuring consistent API quality.

    Can environmental factors affect API quality during sourcing?

    Absolutely; temperature and humidity control during transport and storage are critical to maintaining API stability.

    What documentation is essential for regulatory inspections of API sourcing?

    Key documentation includes batch records, quality control data, supplier assessments, and compliance reports.

    When is re-validation necessary after sourcing changes?

    Re-validation is necessary when there are changes to suppliers, processes, or materials that could affect API quality or compliance.

    How can training mitigate risks during API sourcing?

    Regular training ensures that all personnel involved in sourcing understand compliance requirements and can recognize potential issues early.

    Is there a relationship between document control and API compliance?

    Yes, effective document control ensures that all procedures, audits, and corrective actions are properly recorded and easily accessible during inspections.

    Pharma Tip:  API site WHO GMP risk during prequalification preparation – CAPA aligned to WHO standards