A Supplier COA Is Not Component Identity Testing

Mark one incoming lot: a supplier COA is not identity testing

When a commercial shipment of raw materials arrives at the receiving bay of a finished-drug manufacturing plant or contract development and manufacturing organization (CDMO), a familiar paperwork sequence unfolds. The receiving technician checks the delivery manifest, verifies that container labels match the purchase order, inspects outer drums for punctures or breached seals, and attaches the vendor's certificate of analysis (COA) to the receiving folder. In many commercial operations, an erroneous assumption quietly takes hold: because the supplier's signed COA reports that the active pharmaceutical ingredient (API) or excipient meets United States Pharmacopeia (USP) specifications across every chemical parameter—including an entry stating Identity: Conforms—the component is treated as identified, verified, and ready for release into staging. Under federal Current Good Manufacturing Practice (CGMP) regulations, that assumption is legally and scientifically incorrect.

Under 21 CFR 211.84, a supplier certificate of analysis is not the identity test for an incoming component. For any incoming lot of active or inactive material intended for finished-drug manufacturing, the regulatory framework divides receiving and disposition into five distinct, non-interchangeable identities. Operational teams must explicitly mark each checkpoint independently rather than collapsing them into an informal receiving sign-off:

1. Visual receipt and quarantine status: Whether the material has undergone visual examination for labeling, shipping damage, broken seals, and contamination under 21 CFR 211.82, and remains segregated under quarantine with a distinctive lot code pursuant to 21 CFR 211.80(d).

2. Manufacturer-conducted specific identity testing: Whether the finished-drug manufacturer has taken representative samples after receipt and performed at least one specific identity test under 21 CFR 211.84(d)(1) to verify chemical structure and physical form before release.

3. Supplier analytical reliance for purity, strength, and quality: Whether the manufacturer is utilizing the supplier's report of analysis under 21 CFR 211.84(d)(2) solely for purity, strength, and quality parameters, and only after completing in-house identity testing and establishing supplier reliability through documented validation at appropriate intervals.

4. Packaging visual identification: Whether the item is a container or closure evaluated under the distinct pathway of 21 CFR 211.84(d)(3), which permits release based on supplier testing plus visual identification, a standard that cannot lawfully be applied to active or inactive drug components.

5. Quality control unit authorization: Whether the firm's designated quality control unit has reviewed all mandatory examination and analytical records under 21 CFR 211.22 and formally approved and released the lot under 21 CFR 211.84(a) and 211.84(e).

Treating a supplier's paper certificate as a surrogate for incoming identity testing blurs the boundary between external vendor claims and internal regulatory accountability. As regulatory inspection records repeatedly demonstrate, neither commercial pressure nor third-party pedigree exempts a finished dosage form manufacturer from verifying what is physically inside incoming containers prior to introducing those materials into compounding or tableting lines.

Five identities that are not interchangeable

In pharmaceutical supply chains, operational breakdowns often occur because receiving, quality control (QC), and supply-chain personnel use terms like verified, checked, and approved loosely. Title 21 of the Code of Federal Regulations establishes precise legal meanings for each phase of incoming material control. Under 21 CFR 210.3(b)(3), a component is defined as any ingredient intended for use in the manufacture of a drug product, including those that may not appear in such drug product (such as processing solvents or fermentation media). Paragraphs 210.3(b)(7) and (b)(8) establish the distinction between active and inactive ingredients, while paragraph 210.3(b)(15) defines the quality control unit as any person or organizational element designated by the firm to be responsible for the duties relating to quality control.

To prevent cross-contamination, material mix-ups, or unverified ingredients from entering production, the regulations establish five separate functional gates. The table below delineates their legal citations, mandatory actions, authorized actors, and analytical boundaries.

A failure at any single gate halts the progression. For example, if a firm conducts visual receipt under 211.82 and holds a supplier COA reporting passing assay results, but fails to perform the specific identity test required by 211.84(d)(1), the lot remains withheld from use. Using that lot would violate 21 CFR 211.84(a) and 211.86 and can adulterate the drug product under FD&C Act section 501(a)(2)(B), regardless of supplier ISO certification or an annual audit.

Identity worksheet for lot F-PD-21184-0918

To provide CMC, procurement, and quality assurance teams with an unambiguous operational diagnostic, we evaluate a labeled hypothetical receiving packet: lot F-PD-21184-0918. This lot is a fictional scenario constructed solely for regulatory analysis; it cannot be mistaken for an actual certificate of analysis, USP monograph, Drug Master File submission, or released commercial inventory. We evaluate lot F-PD-21184-0918 across two parallel intake streams: Stream A represents a pallet of inactive excipient drums (e.g., anhydrous citric acid USP), while Stream B represents a shipment of primary packaging components (e.g., 100 mL high-density polyethylene [HDPE] bottles with induction seals).

Worksheet analysis of lot F-PD-21184-0918 crystallizes the core compliance vulnerability. For Stream A (the excipient), having a flawless supplier COA and an up-to-date vendor validation file does not permit release. Because Row 4 (in-house specific identity testing) is missing, the Quality Control Unit is prohibited by 21 CFR 211.84(a) and (e) from approving the lot. If warehouse personnel mistake the passed visual check in Row 1 or the supplier COA in Row 5 for release, the firm commits a direct CGMP violation. Conversely, Stream B (the HDPE bottles) can legally be released because 211.84(d)(3) permits container release based on supplier testing plus visual identification, provided supplier reliability has been validated.

To illustrate how these decision gates interact during receiving triage, the flowchart below maps the mandatory analytical and quality branches for incoming lots under 21 CFR Part 211.

flowchart TD
  Receipt["Incoming Shipment Arrives at Receiving Dock"] --> VisExam["21 CFR 211.82(a) Visual Examination<br/>(Examine labeling, container damage, seals, contamination)"]
  VisExam --> Quar["21 CFR 211.82(b) & 211.80(d) Quarantine Storage<br/>(Assign distinctive receiving code; hold under physical/ERP lock)"]
  Quar --> MatType{"Material Classification<br/>under 21 CFR 210.3"}
  
  MatType -- "Active / Inactive Component<br/>(API or Excipient)" --> RepSamp["21 CFR 211.84(b) Representative Sampling<br/>(Post-receipt sampling by manufacturer; no unvalidated compositing)"]
  RepSamp --> IdTest["21 CFR 211.84(d)(1) Specific Identity Test<br/>(Conducted by manufacturer; FTIR, Raman, HPLC, or wet chemistry)"]
  IdTest -- "Identity Verified" --> COACheck{"21 CFR 211.84(d)(2) Purity, Strength & Quality<br/>Testing Strategy"}
  COACheck -- "Full In-House Testing" --> QCReview["Quality Control Unit Dossier Review<br/>under 21 CFR 211.22"]
  COACheck -- "Rely on Supplier COA" --> SuppVal{"Supplier Test Results Validated<br/>at Appropriate Intervals?"}
  SuppVal -- "Yes: Validated" --> QCReview
  SuppVal -- "No: Not Validated" --> InHouseTest["Manufacturer Must Test All Specifications<br/>In-House Before Use"] --> QCReview
  
  MatType -- "Drug Product Container or Closure" --> ContExam{"21 CFR 211.84(d)(3) Packaging Pathway"}
  ContExam -- "Rely on Supplier Certificate" --> SuppRel{"Supplier Reliability Validated<br/>at Appropriate Intervals?"}
  SuppRel -- "Yes: Validated" --> VisId["Conduct Visual Identification<br/>(Permitted in warehouse per FDA Q&A Q2)"] --> QCReview
  SuppRel -- "No: Not Validated" --> FullPackTest["Full Testing Against Written Specifications<br/>by Manufacturer"] --> QCReview
  
  QCReview --> QCRelease{"21 CFR 211.84(a), (e) & 211.22<br/>QC Unit Disposition"}
  QCRelease -- "Approved" --> Released["Released to Usable Stock<br/>(21 CFR 211.86 oldest stock first)"]
  QCRelease -- "Rejected" --> Rejected["Rejected & Segregated<br/>(21 CFR 211.89 quarantine to prevent use)"]

What 211.82 quarantine actually documents

Title 21 CFR 211.82, titled Receipt and storage of untested components, drug product containers, and closures, sets the baseline requirements for physical intake. Paragraph 211.82(a) requires that upon receipt and before acceptance, each container or grouping of containers shall be examined visually for appropriate labeling as to contents, container damage or broken seals, and contamination. Paragraph 211.82(b) requires those materials to be stored under quarantine until they have been tested or examined, whichever is appropriate, and released. Quality-control-unit release is stated in 211.84(a), not in 211.82(b).

This initial warehouse intake serves a vital logistical and custodial function, but its regulatory reach is strictly limited. Passing an intake visual inspection documents three physical facts:

• External Package Integrity: The containers arrived intact, without tears, punctures, leaks, moisture staining, or other damage or contamination visible on the container. 211.82(a) does not itself document sterility, chemical identity, or quality-unit release.

• Shipment Consonance: The external drum labels, vendor catalog numbers, and declared lot quantities match the receiving manifest and purchasing specifications.

• Custodial Quarantine Entry: The lot has entered the quarantine system mandated by 21 CFR 211.80(d), marked with a distinctive receiving code that tracks its disposition throughout the facility.

A passed visual receipt examination under 211.82 leaves the lot firmly in quarantine. It provides zero evidence regarding the chemical identity of the white powder or clear liquid inside the drums. A drum of industrial-grade technical chemical or a mislabeled barrel of diethylene glycol looks identical on visual inspection to pharmaceutical-grade excipient. Visual intake does not verify chemical structure, does not validate supplier testing, and does not authorize dispensing into manufacturing suites.

Furthermore, operational teams must maintain clear regulatory boundaries between incoming receiving inspections and broader packaging qualification frameworks. An intake inspection of incoming packaging under 211.82 verifies that cartons are undamaged and labeled correctly, while 211.84(d)(3) visual identification verifies basic physical conformity against specifications. Neither check should be confused with comprehensive packaging qualification, container-closure compatibility evaluations, or extractables and leachables toxicological assessments outlined in the FDA's 2026 CCS Draft Replaces 1999 Packaging Guidance, Not Biosimilar Devices. Receiving checks verify the physical shipment; compatibility and safety profiles belong to development qualification files.

What 211.84(d)(1) still requires the manufacturer to do

The regulatory anchor for incoming material integrity is 21 CFR 211.84(d)(1). The regulatory text is unequivocal: At least one test shall be conducted to verify the identity of each component of a drug product. Specific identity tests, if they exist, shall be used. This rule contains no exception, no conditional waiver, and no clause permitting the substitution of a supplier certificate of analysis.

In Questions and Answers on Current Good Manufacturing Practice Requirements — Control of Components and Drug Product Containers and Closures — which contains nonbinding recommendations except where it restates 21 CFR — FDA's Question 4 restates how component identity testing is understood for 211.84. The agency defines a component's identity as its chemical structure and physical form (for example, polymorph, solvate, and appearance), including, if appropriate, its stereochemistry or immunochemistry. More than one analytical test may be necessary if a single method cannot definitively differentiate the component from potential substitutes or closely related chemical congeners.

FDA's Question 4, nonbinding except where it restates 21 CFR 211.84, addresses three operational points about how samples for 211.84(d)(1) testing are gathered and handled:

• Post-Receipt Sampling: Samples must be collected by the drug product manufacturer from containers after receipt at the manufacturing facility. FDA explicitly notes that pre-shipment samples or so-called 'piggyback' samples (sample vials taped to the outside of a drum by the vendor) are generally unacceptable. A vendor-supplied sample vial does not guarantee that the bulk material inside the drum was not substituted, contaminated, or adulterated during transit.

• Representative Sampling Plans: Under 21 CFR 211.84(b), the number of containers sampled must be based on statistical criteria for component variability, confidence levels, past supplier quality history, and the reserve requirements of 21 CFR 211.170. While the regulation does not dictate an arbitrary formula (such as √n + 1), the sampling plan must be scientifically justified and documented in approved standard operating procedures (SOPs).

• Strict Restrictions on Compositing: Under 211.84 and 21 CFR 211.160, compositing for identity testing could satisfy the regulations only if the manufacturer demonstrates that a single nonconforming container would not be masked, or if an additional test routinely performed on the composite ensures that all sampled containers contain the same material. Q4 notes that testing samples from every container to determine identity may be valuable, particularly for components purchased from distributors, and that rapid, nondestructive methods can identify material directly in warehouse containers. That is not a universal every-container legal mandate for every excipient, and it is not a skip-lot rate.

Regulatory affairs and technical teams must also recognize that administrative artifacts do not constitute testing. Having an approved DMF letter of authorization, as discussed in API supplier change control: DMF letter-of-authorization and notification traps, on file with FDA allows agency reviewers to evaluate proprietary chemistry in support of an application, but it provides zero confirmation that an incoming drum contains the specified molecule. Similarly, storing an official USP monograph in the analytical laboratory's document repository establishes the release standard, but it does not execute the test. The manufacturer must pull samples and generate verifiable analytical data.

When a supplier report of analysis may replace purity, strength, and quality testing

While 21 CFR 211.84(d)(1) requires the finished-drug manufacturer to perform identity testing, paragraph 21 CFR 211.84(d)(2) provides a specific, conditional relief mechanism:

This clause is the only COA substitution provision in the component CGMP regulations. Its legal boundaries are precise and non-negotiable:

1. Permitted Scope: The supplier COA may substitute only for tests of purity, strength, and quality (e.g., chromatographic assay, related substances, residual solvents, heavy metals, sulfated ash). It never substitutes for identity.

2. Prerequisite One: In-House Identity Testing: The manufacturer must perform at least one specific identity test on that lot under 211.84(d)(1). Without an in-house identity test, the manufacturer cannot lawfully accept the supplier COA for other parameters.

3. Prerequisite Two: Documented Supplier Validation: The manufacturer must establish the reliability of the supplier's analytical results through appropriate initial validation and periodic re-validation at appropriate intervals.

In Question 15 of FDA's component CGMP guidance, the agency addresses the operational interface between API manufacturers and finished dosage manufacturers. An API manufacturer operating under ICH Q7 Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients issues a COA meeting Section 11.4 standards. However, FDA explicitly affirms that 21 CFR 211.80 and 211.84(d)(2) require the finished-drug manufacturer either to perform full testing for purity, strength, and quality or to rely on the API COA only after conducting specific identity testing and establishing supplier reliability. Question 15 explicitly states that identity is the test the finished-drug manufacturer is legally required to perform.

A pervasive myth across industry blogs and consulting forums is that 21 CFR 211.84 defines an exact 'skip-lot' formula (such as re-testing every 5th or 10th lot, or conducting full testing once per year). The regulation contains no numeric interval. It states that validation must occur through appropriate validation of the supplier's test results at appropriate intervals. The regulation does not publish a numeric interval. Q15 says the finished-drug manufacturer's validation procedure should be consistent with the principles of CGMP and risk management. This article does not invent a skip-lot rate, a process-capability threshold, or a calendar interval.

FDA continues to inspect this interface. In its 14 May 2026 warning letter to GC America, Inc. (MARCS-CMS 727602; FEI 1410097), FDA cited 21 CFR 211.84(d)(1) and 211.84(d)(2). The firm stated it does not conduct identity testing on each shipment of each lot of incoming components at high risk of a redacted contamination before using them. If the firm intends to accept supplier certificate-of-analysis results for strength, quality, and purity, the letter's requested response is that the firm specify how it will establish supplier-result reliability through initial validation and periodic re-validation, and include a commitment to always conduct at least one specific identity test for each incoming component lot. For the redacted high-risk components, that identity test includes the relevant USP identification test that detects those hazardous impurities. The component name and cited guidance title remain redacted; this article does not fill them. GC America is site-specific enforcement, not the fictional worksheet lot.

Containers and closures sit on a different 211.84(d)(3) path

A common source of regulatory confusion arises from conflating raw material components with packaging materials. Paragraph 21 CFR 211.84(d)(3) establishes a distinct mechanism for drug product containers and closures, not for active or inactive components:

Notice the fundamental difference between paragraph (d)(2) and paragraph (d)(3). For active and inactive components under (d)(2), the manufacturer must perform a specific identity test—an analytical method verifying chemical structure. For drug product containers and closures under (d)(3), the manufacturer is permitted to perform a visual identification.

In Question 2 of FDA's component CGMP guidance, the agency clarifies the operational reality of (d)(3). The guidance affirms that once supplier reliability has been established through documented validation of test results, the manufacturer may conduct the required visual examination entirely within the warehouse receiving area. Once supplier reliability has been established by validation of test results, Q2 states that a manufacturer could perform that visual examination entirely in the warehouse. Visual identification of bottles, vials, stoppers, or caps is the (d)(3) bar. It is not a 211.84(d)(1) identity test for APIs or excipients.

The regulatory hazard lies in illicitly transferring this packaging flexibility to chemical ingredients. Inexperienced warehouse managers or aggressive manufacturing schedules sometimes attempt to treat raw chemicals like bottles: looking at white crystals through a drum liner, checking that the drum label says 'Ascorbic Acid USP', and calling that visual check an 'identity test.' Under 21 CFR 211.84(d)(1), visual observation of an active or inactive ingredient does not constitute specific identity testing. Applying the 211.84(d)(3) visual pathway to active pharmaceutical ingredients or excipients is an egregious CGMP deficiency.

Quality-unit release is a fifth field, not a COA stamp

Even when physical receiving under 211.82 is flawless, in-house identity testing under 211.84(d)(1) is complete and conforming, and supplier validation under 211.84(d)(2) is documented, the material remains legally unusable until a fifth, independent action occurs: formal release by the Quality Control Unit.

Under 21 CFR 211.22(a), the quality control unit has the responsibility and authority to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labeling, and drug products. Paragraph 211.22(b) mandates that adequate laboratory facilities for testing and approval or rejection be available to the quality control unit, and paragraph 211.22(c) empowers the quality unit to approve or reject all procedures or specifications impacting identity, strength, quality, and purity.

Title 21 CFR 211.84(a) explicitly links material availability to quality unit action: each lot shall be withheld from use until the lot has been sampled, tested, or examined, as appropriate, and released for use by the quality control unit. Paragraph 211.84(e) completes the mandate: any lot that meets appropriate written specifications may be approved and released, while any lot that fails must be rejected.

In practice, operations must guard against common workflow errors that misrepresent release status:

• Warehouse Receiving Sign-Offs: A warehouse dock supervisor's stamp indicating 'Received in Good Order' or an inventory clerk's entry into enterprise resource planning (ERP) software is a custodial intake record under 211.80(d), not a quality release under 211.84(a).

• Supplier Quality Stamps: A 'Quality Approved' watermark or digital signature on a vendor's COA represents the vendor's internal batch release, not the finished-drug manufacturer's release under 211.22.

• Laboratory Analytical Completion: An analytical chemist signing off a passing FTIR spectrum in the laboratory information management system (LIMS) documents analytical conformance under 211.84(d)(1), but does not constitute the overarching quality unit release required to move inventory from quarantine to approved stock.

Furthermore, under 21 CFR 211.184, component records must document the supplier, lot number, receiving code, date of receipt, prime manufacturer if known, the specific test results performed under 211.82(a) and 211.84(d), and the explicit conclusions derived therefrom. Simply archiving a paper COA fails to satisfy the recordkeeping requirements of 211.184(b).

Post-release controls impose further constraints. Under 21 CFR 211.86, approved components must be rotated so that the oldest approved stock is used first. Under 21 CFR 211.87, materials stored for long periods or exposed to adverse conditions must undergo retesting and re-approval by the quality control unit before use. And under 21 CFR 211.89, rejected components must be quarantined to prevent their use in manufacturing. Neither post-release retesting under 211.87 nor commercial batch release under A PPQ Protocol Is Not Commercial Batch Release: Stage 2 Versus Stage 3 Records can substitute for incoming raw material identity verification.

In outsourced manufacturing arrangements, contract boundaries become critical. As outlined in FDA's guidance on contract manufacturing arrangements and quality agreements, a quality agreement may contractually delegate the execution of sampling or testing to a CDMO. However, under 21 CFR 211.22(a), the owner's quality control unit remains responsible for approving or rejecting drug products manufactured, processed, packed, or held under contract by another company. Commercial teams evaluating sponsor-CDMO interactions should examine documented inspection findings in CDMO quality agreement red flags that become FDA inspection findings to ensure roles are not dangerously blurred.

High-risk USP identity tests remain identity tests

The regulatory imperative for incoming identity testing is nowhere more critical than in managing high-risk components susceptible to lethal adulteration. Throughout modern pharmaceutical history, mass poisoning tragedies across the globe have resulted from the substitution of toxic diethylene glycol (DEG) and ethylene glycol (EG) for non-toxic polyols such as glycerin, propylene glycol, sorbitol solution, maltitol solution, and hydrogenated starch hydrolysate.

In response to recurrent international poisoning incidents, FDA published an immediately-in-effect guidance in May 2023: Testing of Glycerin, Propylene Glycol, Maltitol Solution, Hydrogenated Starch Hydrolysate, Sorbitol Solution, and Other High-Risk Drug Components for Diethylene Glycol and Ethylene Glycol (Docket FDA-2023-D-1573, referenced on the FDA high-risk component landing page). This guidance delivers a stark reminder: when a component's applicable USP-NF monograph incorporates a limit test for DEG and EG within its Identification section, that limit test is not a secondary purity check—it is legally an identity test under 21 CFR 211.84(d)(1).

The May 2023 immediately-in-effect guidance restates 211.84(d)(1) where a USP-NF identity-section DEG/EG limit test exists, states the monograph safety limit, and separately recommends each-container sampling for high-risk components:

• Specific Identity Testing Mandate: Under 21 CFR 211.84(d)(1), specific identity tests, if they exist, shall be used. For high-risk components where the USP-NF monograph contains an identification test that detects DEG and EG, manufacturers must perform that specific monograph identification test on representative samples of each shipment of each lot before releasing the material for use.

• Safety Limit Threshold: The test must demonstrate that diethylene glycol and ethylene glycol levels do not exceed the established safety limit of no more than 0.10% (1,000 ppm) based on the relevant monograph specification.

• Container-to-Container Sampling Recommendation: Because historical regulatory investigations revealed extreme container-to-container variability—where individual drums within a single shipment contained pure toxic DEG while adjacent drums contained pure glycerin—FDA specifically recommends testing samples from each container of each lot of high-risk components. Operational teams should note that this each-container sampling protocol is an agency recommendation tailored specifically to high-risk DEG/EG components, not a 211.84(b) numeric mandate for every inert excipient in the warehouse.

Enforcement records demonstrate that FDA rigorously cites firms that rely on supplier COAs for high-risk components. In its 12 June 2024 warning letter to Landy International (Warning Letter 679066), FDA cited 21 CFR 211.84(d)(1) and 211.84(d)(2) after inspecting the firm's OTC drug manufacturing facility. The letter states that the firm failed to perform adequate identity testing of each component lot, relied on suppliers' certificates of analysis without establishing the reliability of those analyses at appropriate intervals, and did not perform the USP glycerin identification test that detects DEG and EG on each shipment of each lot. When the firm stated that 21 CFR 211.84 'was not fully understood,' FDA found the response inadequate because it did not explain how the firm would verify supplier-COA reliability or qualify suppliers. The letter separately notes that DEG/EG-contaminated ingredients have caused lethal poisoning incidents worldwide; it does not treat Landy as this article's fictional worksheet lot, and it is not a failure-rate table.

What this worksheet is not: part 111, Q7, DMF, and skip-lot blogs

To maintain rigorous compliance hygiene, pharmaceutical professionals must understand not only what 21 CFR 211.84 requires, but also what external standards, industrial folklore, and peripheral regulatory pathways do not apply to incoming finished-drug component control.

First, this incoming-lot identity worksheet is not dietary supplement CGMP. Under 21 CFR 111.75, the regulations governing dietary supplement manufacturing establish a dual standard. Paragraph 111.75(a)(1) mandates identity testing for dietary ingredients. However, paragraph 111.75(a)(2) permits a supplement manufacturer to confirm the identity of other (non-dietary-ingredient) components by relying on a supplier COA, provided the supplier is qualified through audit, test results are re-confirmed periodically, and the quality unit reviews the documentation. That dietary-supplement COA-for-identity pathway does not exist in finished pharmaceutical manufacturing under 21 CFR Part 211. Applying 21 CFR Part 111 logic to pharmaceutical APIs or excipients is a severe regulatory error.

Second, this worksheet is not API-plant raw material management under ICH Q7. ICH Q7 paragraph 7.30 recommends at least one identity test for each batch of material, with the exceptions in 7.32, and allows a supplier certificate of analysis in place of other tests if the manufacturer has a supplier-evaluation system. Paragraph 7.31 recommends complete analyses on at least three batches before reducing in-house testing, then a complete analysis at appropriate intervals. Paragraph 7.32 carves out processing aids, hazardous or highly toxic raw materials, other special materials, or intra-company transfers that may rely on the manufacturer's certificate of analysis plus visual examination of containers and labels. Those Q7 sentences are nonbinding API-plant overlay. They do not rewrite 211.84(d)(1) for finished-drug components, and 7.31's three-batch sentence is not a 211.84 skip-lot rate.

Third, this worksheet must not be confused with adjacent manufacturing, laboratory, and regulatory lifecycle controls. Operational teams frequently encounter complex compliance boundaries that belong to separate technical domains:

• Drug Master Files: Filing a Type II DMF or submitting a facility PreCheck does not verify incoming component lots. The operational boundary between facility registration and active CGMP inspection is explored in PreCheck's Type V Facility DMF Is Not a PAI, and a CDMO Seat Does Not Transfer CGMP.

• Process Performance Qualification (PPQ): Executing Stage 2 validation runs establishes that an overall manufacturing process is capable of reproducible commercial performance. The boundary between validation protocols and commercial batch release is analyzed in A PPQ Protocol Is Not Commercial Batch Release: Stage 2 Versus Stage 3 Records.

• Equipment Qualification: Signed installation and operational qualification of manufacturing equipment is a different packet from process performance qualification, as detailed in Equipment Qualification Is Not Process Performance Qualification. Qualified instruments still have to be used to generate lot-specific 211.84(d)(1) data; an IQ/OQ file is not the identity test.

• Laboratory Investigations: When an incoming component identity test yields an atypical chromatographic peak or anomalous spectrum, the resulting inquiry is governed by out-of-specification procedures detailed in An OOS Result Is Not Confirmed Failure or a Field Alert, rather than informal re-sampling.

• Analytical Method Transfer: Transferring an in-house identity test or monograph assay to a new release-testing laboratory requires formal transfer protocols, as examined in Analytical Method Transfer Acceptance Criteria for a New Release-Testing Lab.

• Lifecycle Production Records: Incoming material records under 211.184 flow into executed production documents, governed by the distinction between A Master Batch Record Is Not an Executed Batch Record, while post-campaign evaluations are governed by An Annual Product Review Is Not Continued Process Verification and site-transfer packages in Tech-transfer package gaps before moving a commercial product to a second site.

Finally, pharmaceutical manufacturers must disregard arbitrary skip-lot rules promoted on chemical vendor portals and commercial consulting websites. Claims that a firm can automatically reduce testing to 'every 5th lot' or 'once per calendar year' reflect commercial convenience rather than federal regulation. Under 21 CFR 211.84(d)(1), as restated in FDA Q&A Q4, representative samples of each shipment of each lot of active and inactive components must be identity-tested before release for use. For purity, strength, and quality under 211.84(d)(2), supplier-result reliability is established through appropriate validation at appropriate intervals; Q15 says that validation procedure should be consistent with CGMP and risk-management principles. The regulation does not publish a numeric skip-lot rate.

Sources

This analysis is grounded in 21 CFR, FDA's component CGMP Q&A and other cited guidance, and published FDA warning letters:

• 21 CFR 211.84 — Testing and approval or rejection of components, drug product containers, and closures. Title 21, Code of Federal Regulations, Part 211, Subpart E (Control of Components and Drug Product Containers and Closures).

• 21 CFR 211.80 — General requirements. Title 21, Code of Federal Regulations, Part 211, Subpart E.

• 21 CFR 211.82 — Receipt and storage of untested components, drug product containers, and closures. Title 21, Code of Federal Regulations, Part 211, Subpart E.

• 21 CFR 211.22 — Responsibilities of quality control unit. Title 21, Code of Federal Regulations, Part 211, Subpart B (Organization and Personnel).

• 21 CFR 210.3 — Definitions. Title 21, Code of Federal Regulations, Part 210 (Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General).

• 21 CFR 211.184 — Component, drug product container, closure, and labeling records. Title 21, Code of Federal Regulations, Part 211, Subpart J (Records and Reports).

• 21 CFR 211.86 — Use of approved components, drug product containers, and closures. Title 21, Code of Federal Regulations, Part 211, Subpart E.

• 21 CFR 211.87 — Retesting of approved components, drug product containers, and closures. Title 21, Code of Federal Regulations, Part 211, Subpart E.

• 21 CFR 211.89 — Rejected components, drug product containers, and closures. Title 21, Code of Federal Regulations, Part 211, Subpart E.

• Questions and Answers on Current Good Manufacturing Practice Requirements — Control of Components and Drug Product Containers and Closures. U.S. Food and Drug Administration; HTML landing-page content current as of 16 November 2022. Contains nonbinding recommendations except where it restates 21 CFR.

• GC America, Inc. — Warning Letter 727602 (14 May 2026). U.S. Food and Drug Administration, Office of Manufacturing Quality, Office of Compliance, Center for Drug Evaluation and Research.

• Landy International — Warning Letter 679066 (12 June 2024). U.S. Food and Drug Administration, Office of Manufacturing Quality, Office of Compliance, Center for Drug Evaluation and Research.

• Testing of Glycerin, Propylene Glycol, Maltitol Solution, Hydrogenated Starch Hydrolysate, Sorbitol Solution, and Other High-Risk Drug Components for Diethylene Glycol and Ethylene Glycol. U.S. Food and Drug Administration, Guidance for Industry, May 2023.

• FDA guidance landing page — Testing of high-risk drug components for DEG and EG. U.S. Food and Drug Administration, Docket FDA-2023-D-1573.

• Q7 Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients. U.S. Food and Drug Administration / International Council for Harmonisation (ICH), September 2016.

• 21 CFR 111.75 — What must you do to determine whether specifications are met?. Title 21, Code of Federal Regulations, Part 111 (Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements).

• Contract Manufacturing Arrangements for Drugs: Quality Agreements — Guidance for Industry. U.S. Food and Drug Administration, November 2016.