PDA Letter Article

Formalizing a Risk Assessment for Excipients

by Frithjof Holtz, Merck KGaA, Darmstadt, Germany

Excipients serve a critical role in the production of final dosage forms for drug products and biologics. They facilitate the manufacturing process (e.g., anticaking agents) and protect, support, and enhance stability. They may also improve bioavailability. In addition, excipients help maintain the safety, or function, of the product during storage and use.

No longer characterized as inert accompaniments to an active pharmaceutical ingredient (API), excipients are the target of an intensified push for more stringent quality management, placing new requirements on both suppliers and users. Regulating excipient quality, however, is no small task. The global market is expected to exceed $5 billion by 2020—with a growth rate of 6.0% from 2014 to 2020 (1). Thousands of different excipients are available, and only a small percentage of them are manufactured solely for pharmaceutical use.

For many years, there have been clearly defined GMP requirements for APIs, including EU GMP Part II, 21 CFR Part 11 and ICH Q7: Good Manufacturing Practice for Active Pharmaceutical Ingredients. But, until recently, well-defined and stringent GMP requirements for excipients did not exist.

A Focus on Quality

The pharmaceutical industry is increasingly using risk management principles to better protect patients; this renewed focus on safety now includes excipients. At the same time, regulatory authorities have called for more secure supply lines and clearly defined quality measures for excipients.

In 2011, the EU’s Falsified Medicines Directive established that manufacturing authorization holders must use a formalized risk assessment to ascertain the appropriate GMPs for ensuring excipient suitability (2). As part of this risk assessment, manufacturers need to consider both the source and intended use of the excipients in question. The Directive went on to state that the European Commission planned to adopt guidelines for adopting appropriate GMPs for excipients. After robust discussion, guidelines for the risk management process and direction on the appropriate level of GMP for excipients were published in March 2015.

These guidelines apply not only for medicinal products produced in Europe but also for products produced outside Europe intended for the European market. Regulators now expect importers to provide risk assessments and related documents.

As of March 21, 2016, excipient users/ drug product manufacturers in the EU were legally mandated to implement GMP requirements, including completed risk assessments for each excipient used.

Keep in mind, that while regulations regarding GMP for APIs clearly define what is needed for compliance, risk assessment guidelines for excipients are just that—guidelines that offer tools and a framework for determining appropriate GMPs. This leaves the full responsibility of defining what GMPs apply as “necessary” for the excipients of a specific drug product in the hands of the marketing authorization holder.

Other countries are also developing formal requirements for excipient GMPs. The U.S. FDA assesses and permits use of excipients as part of a New Drug Application. Under U.S. law, a new pharmaceutical excipient, unlike an active drug, has no regulatory status unless it can be qualified through one or more of the approval mechanisms available for components used in finished drug dosage forms.

In 2012, the Food and Drug Administration Safety and Innovation Act (FDASIA) was signed into law, expanding the Agency’s authority and strengthening its ability to safeguard and advance public health through a number of activities, including enhancing the safety of the drug supply chain. FDASIA includes a set of provisions, contained in Title VII of the statute, which give FDA new authorities to address the challenges posed by drug supply chains that are becoming increasingly global (3). One of these new authorities requires manufacturers to include, as part of a drug listing, the name, address, and unique facility identifiers of associated excipient manufacturers.

In 2013, the FDA initiated the Secure Supply Chain Pilot Program to strengthen controls on imports of drug products. The goal was to focus the Agency’s import surveillance resources on preventing the entry of high-risk drugs that are most likely to compromise the quality and safety of the U.S. drug supply. The pilot program, which concluded in February 2016, enabled FDA to evaluate its effectiveness at enhancing imported drug compliance with FDA regulations and the security of the drug supply chain.

Implementing the Risk Assessment

ICH Q9: Quality Risk Management offers guidance for risk assessments through two principles:

  • Outlining of risks should be based on scientific knowledge and should be linked to protection of the patient
  • The level of effort, formality, and documentation of the quality risk management process (QRM) should be commensurate with the level of risk presented by the excipient

Excipient risk is assessed based on the harm posed by microbiological, chemical (toxicological, pathological effect) or physical (choking, irritation) hazards. Risk varies based on the route of administration of the drug product (oral, inhaled, injected) and the function of the excipient. An excipient used as a filler, e.g., a binder or colorant, might pose a lower risk than one used as a stabilizer or as a vehicle for controlled release, as the latter might affect bioavailability. The GMP requirements and control strategies for an excipient used as a filler in an oral application, however, would be completely different from one used for controlled release of a drug substance in a biologic.

A number of approaches for quality risk assessment and guidance are available. Figure 1 presents a risk assessment model developed by the International Pharmaceutical Excipients Council (IPEC Europe) and the Pharmaceutical Quality Group (PQG), supported by the European Federation of Pharmaceutical Industries and Associations (EFPIA). The model combines the approach of ICH Q9 with the specific requirements of the EU Risk Assessment Guideline and highlights the need for the excipient user and manufacturer to work closely together in the assessment process. An excipient manufacturer conducting a similar risk assessment would need to work in close partnership with the user to understand the function the excipient is expected to serve, as well as the route of administration.

Excipient Figure 1
Figure 1 Excipient risk assessment process
* P. Rafidison, F. Holtz, S. Rönninger, A Practical Approach of Implementing GMP for Excipients, Pharm. Tech., September, 2014, 26-36 (4)

Defining Appropriate GMPs

The good news is that manufacturers and users of excipients do not need to develop their own GMPs. A number of well-established, accepted and voluntary industry standards exist that can be followed. These include:

  • IPEC-PQG GMP Guide, 2006
  • USP General Chapter <1078>
  • NSF/IPEC/ANSI-363-2014

In many cases, applying these standards is likely to be sufficient for most excipients.But a small number of excipients could potentially pose hazards to patients. These may require application of more thorough controls than those recommended in the voluntary standards. For example, an excipient used in a parenteral might come under guidelines on the manufacture of sterile medicinal products as provided in Volume 4 of EudraLex, the rules governing medicinal products in the European Union (5).

A Positive Outlook

A greater appreciation of the role excipients play in the safety and clinical performance of drugs has focused attention on the risk they can also pose to patients, which defines the need for robust excipient GMPs. Increased attention to supply chains and more robust communication between excipient suppliers and drug manufacturers are essential to ensuring patient safety. Drug manufacturers should expect their suppliers to provide dossiers accompanying each excipient with information supporting the drug manufacturer’s risk assessment. This might be data on the manufacture, testing, supply chain and applied quality system or information showing alignment with regulatory guidelines.

The risk assessment and quality risk management principles widely used in the pharmaceutical and biotechnology industries are now being adopted for excipients. The European risk assessment guideline is one that both suppliers and users can apply in order to determine the appropriate level of GMPs, increase the assurance of supply chain integrity and provide better protections for patients.


  1. “Excipients Market Analysis By Polymers (MCC, HPMC, CMC, Ethyl Cellulose, Povidone), Alcohols (Glycerine, Sorbitol, Mannitol, Propylene Glycol), Minerals (Clay, Silicon Dioxide, Titanium Dioxide), Sugars And Segment Forecasts To 2020.” Grand View Research. September 2015.
  2. “Directive 2011/62/EU.” Official Journal of the European Union 54 (2011): 74-87.
  3. “FDASIA Title VII Overview.” U.S. Food and Drug Administration. Sept. 15, 2015.
  4. Rafidison, P., Holtz, F., and Rönninger, S. “A Practical Approach of Implementing GMP for Excipients,” Pharmaceutical Technology 38 (2014): 26–36.
  5. “Annex 1: EU Guidelines to Good Manufacturing Practice Medicinal Products for Human and Veterinary Use.” European Commission. Nov. 25, 2008.

*Special thanks to: Patricia Rafidison, Dow Corning, and Stephan Rönninger, Amgen (Europe) GmbH

About the Author

Frithjof HoltzFrithjof Holtz is a biologist who has worked for the life science business of Merck KGaA, Darmstadt, Germany, for 25 years, more than ten years of which have been spent in quality assurance and regulatory affairs.