A valid certificate, undefined

The phrase appears once in section 503A of the Federal Food, Drug, and Cosmetic Act. A licensed pharmacist may compound with a bulk drug substance if the substance complies with an applicable USP-NF monograph and the USP chapter on pharmacy compounding where a monograph exists, or, where none exists, is a component of an approved drug, or, where neither holds, appears on the list FDA develops by regulation; and if in every case it is manufactured by an establishment registered under section 510 and is accompanied by valid certificates of analysis. Section 503B carries the identical requirement for an outsourcing facility. Neither defines the term, and neither carries a field list.

The content standard is assembled from three instruments that do not cite one another. ICH Q7 states what a certificate carries. USP General Chapters 795 and 797, both official since 2023, state what a compounding facility must do with a component when it arrives. 21 CFR 211.84 states the one test a certificate can never stand in for. A receiving check built on all three catches what any one of them alone will miss.

What a certificate of analysis should include for an active pharmaceutical ingredient

ICH Q7, the good manufacturing practice guide for active pharmaceutical ingredients that FDA adopted as guidance, sets the field list in five short paragraphs at section 11.4, opening at 11.40 with the entitlement itself: authentic certificates of analysis should be issued for each batch on request. It is written as an expectation rather than rule text, which is precisely the reason to copy it into a purchase specification. An expectation a supplier has agreed to in writing is a term.

The sentence carrying the most weight is section 11.42: "The Certificate should list each test performed in accordance with compendial or customer requirements, including the acceptance limits, and the numerical results obtained (if test results are numerical)."

Three things are owed per test, not one: the test, the limit it was read against, and the number. A certificate that gives the test and the number but no limit forces the reader to supply the limit from memory, and that is how a lot gets accepted against the wrong specification.

The four omissions that stop a lot at the dock

Most incomplete certificates fail in one of four ways, and each removes something a receiving check depends on. A lot arriving with any of them is a lot to hold in quarantine and query, not a lot to log in and shelve.

• The original manufacturer is not named. A certificate reissued by a repacker, an agent or a broker has to name the laboratory that performed the analysis, reference the name and address of the original manufacturer, and attach a copy of the original batch certificate. A document naming only the party that sold you the material has removed the one fact that makes everything else on it checkable.
• A word stands where a number belongs. Conforms and Pass are dispositions, not results. Section 11.42 asks for each test, its acceptance limit, and the numerical result. A column of words cannot be trended, compared against the previous lot, or read against a specification the buyer wrote.
• The batch number does not match the container. The number on the certificate is the only thing tying the document to the drum in front of you, and it must appear again in the compounding record. A mismatch is not a clerical matter to correct on your side. It is an open question about which lot you received.
• No signature, or no date. Section 11.43 asks for both, by the quality unit, alongside the original manufacturer's name and address. An unsigned certificate records that testing happened. It does not record that anyone with authority to release the batch read it and did so.

A retest date is not an expiration date

Common practice for an active pharmaceutical ingredient is a retest date rather than an expiration date, and Q7 says so at section 11.61. The two are different statements. Q7 defines a retest date as the date when a material should be re-examined to ensure that it is still suitable for use. An expiration date says the material is no longer to be used. A retest date says only that nobody has looked at it lately.

This becomes a receiving decision because the compounding record asks for the expiration date of each component, and a package carrying only a retest date has not supplied one. USP 795, section 6.2.2, gives the rule for a component lacking a vendor expiration date: mark the receipt date clearly and indelibly on the package, then assign a conservative expiration date based on the nature of the component, and in no case later than three years after receipt.

The sterile chapter is stricter and governs where the two overlap. USP 797, section 9.3.2, holds a component received without a manufacturer expiration date to an assigned date no more than one year after receipt, with both dates marked on the package. Section 6.2.2 points at the sterile chapter directly: a shorter date must be assigned where the same container is also used in sterile compounding, or where the ingredient is susceptible to degradation. One drum feeding both benches takes the shorter clock.

Identity is the test a certificate cannot perform for you

A purity figure states how much of a lot is one substance. It does not state which substance, and a peptide assembled in the wrong sequence can measure high on a purity assay while being the wrong molecule. That is why the identity test sits apart in the regulation and is not delegable to a document.

21 CFR 211.84(d)(1) is two sentences long: "At least one test shall be conducted to verify the identity of each component of a drug product. Specific identity tests, if they exist, shall be used." Paragraph (d)(2) then allows a supplier's report of analysis in place of other testing on two conditions, and the second is the one usually dropped. The first is that at least one specific identity test is conducted by the manufacturer. The second is that the manufacturer establishes the reliability of the supplier's analyses through appropriate validation at appropriate intervals. A certificate accepted without both is accepted on faith.

Part 211 binds a finished pharmaceutical manufacturer rather than a compounding pharmacy, so read it as the principle the compounding chapters implement. USP 795, section 6.2.3, requires every component to be re-inspected before use and rejected immediately where identity, strength, purity and quality cannot be verified, including where a container's labeling is damaged or incomplete.

The supplier qualification half of the question has numbers attached, and they are the numbers a buyer should expect a supplier's own incoming program to meet. Q7 section 7.30 permits a supplier's certificate to replace other testing only where the manufacturer has a system in place to evaluate suppliers. Section 7.31 says what that system does: full analyses on at least three batches before in-house testing is reduced, a full analysis at appropriate intervals thereafter compared against the certificates, and the reliability of the certificates checked at regular intervals. Qualification is a schedule, not a questionnaire answered once.

From the certificate to the compounding record

USP 795, section 6.2.2, lists what must be documented when a component arrives, according to the facility's own standard operating procedures and as described in the chapter's documentation section: receipt date, quantity received, supplier name, lot number, expiration date, and results of any in-house or third-party testing performed. Section 7.2 then lists what the compounding record carries for every component used: the name, the vendor or manufacturer, the lot number and the expiration date. It gives the reason in one line. The compounding record must permit traceability of all components in the case of a recall or known quality issue.

Those two records are what the federal tracing statute leaves to the facility, because the Act's transaction requirements do not reach a bulk drug substance. State wholesale distribution and pharmacy recordkeeping rules can add to them, and they vary by state. The Drug Supply Chain Security Act attaches its tracing obligations to a product, defined as a prescription drug in finished dosage form. A bulk drug substance is not a product under that definition, so no transaction history follows an active pharmaceutical ingredient into a pharmacy. The certificate, the receipt entry and the compounding record are the core of the traceability system, and a lot number transcribed wrongly at receiving is the point where it breaks.

Manufacturer, repacker, distributor

Q7 section 17 applies to any party other than the original manufacturer that trades, takes possession of, repacks, relabels, distributes or stores an active pharmaceutical ingredient. It is short enough to use as a due diligence list. Section 17.20 states what such a party must be able to produce: the identity and address of the original manufacturer, purchase orders, bills of lading, receipt documents, the name of the substance, the manufacturer's batch number, transportation and distribution records, all authentic certificates of analysis including the original manufacturer's, and the retest or expiry date. Section 17.61 requires the party supplying the material to give the customer the name of the original manufacturer and the batch numbers supplied. Section 17.63 applies the certificate rules of section 11.4 to that party exactly as they apply to the manufacturer.

The phrase FDA-registered is worth reading precisely for the same reason. Under 21 CFR 207.17(a), manufacturers, repackers, relabelers and salvagers register each establishment. Under 207.17(b), a private label distributor that does not itself manufacture, repack, relabel or salvage is not required to register at all. Registration is therefore a statement about an establishment that performs one of those activities, and section 503A asks for registration of the establishment that manufactured the substance. It is a fact about the manufacturer. An NDC is no substitute for it either: under 21 CFR 207.37(a)(2), a product may be deemed misbranded where an NDC is used to denote or imply FDA approval.

What this means for a buyer

The check is short once the fields are known, and it belongs before the container is opened. Read the batch number against the drum. Read down the test column and confirm each line carries a limit and a number. Find the original manufacturer's name, and where the certificate was reissued, find the attached original. Find the signature and the date. Then decide what date you are marking on the package, and mark it.

All of it fits into a purchase specification in a paragraph. A supplier working this way issues the certificate with the lot rather than after it, and files the manufacturer's incoming certificate against the lot it released, so both documents answer the same question later. GradeBio does this. Any supplier can be asked to do the same.

Sources

1. Congress Federal Food, Drug, and Cosmetic Act section 503A 21 U.S.C. 353a(b)(1)(A)(i) to (iii)
2. Congress Federal Food, Drug, and Cosmetic Act section 503B 21 U.S.C. 353b(a)(2)(D)
3. International Council for Harmonisation, adopted by FDA as guidance ICH Q7, sections 7.30 to 7.32, 11.4 11.61 and 17
4. United States Pharmacopeia General Chapter 795, sections 6.2.1, 6.2.2 6.2.3 and 7.2
5. United States Pharmacopeia General Chapter 797, sections 9.3.1 and 9.3.2
6. Food and Drug Administration 21 CFR 211.84(a), (d)(1) and (d)(2)
7. Food and Drug Administration 21 CFR 207.17
8. Food and Drug Administration 21 CFR 207.37(a)(2)
9. Congress Drug Supply Chain Security Act 21 U.S.C. 360eee(13)