Control strategy

A control strategy is not a single document — it's the holistic set of controls that, together, deliver the QTPP. ICH Q11 §6 gives the canonical list: controls on input materials (API + excipient + packaging CMAs, supplier qualification), controls inherent to product design (formulation, container/closure), controls on the manufacturing process (CPP set-points + ranges, in-process controls, PAT), controls of the production environment (facility classification, EM, cleaning, line clearance), and finished-product specifications. The control strategy spans development, technology transfer, commercial manufacturing and lifecycle.

• Input-material controls — CMA specifications, supplier qualification (audit + approved-vendor list), incoming-test plan (skip-lot, identity, full panel), retain-sample programme, CoA review SOP.
• Process controls — CPP set-points and ranges (linked to PARs and design space), batch size and scale rationale, equipment specification, IPC sampling plan, PAT instrumentation and chemometric models, hold-time and clean-hold/dirty-hold limits.
• Facility + environment controls — area classification (cGMP grade, ISO class, Annex 1 zones), environmental-monitoring programme (viable + non-viable + personnel), HVAC + utility qualification, cleaning validation, line clearance, contamination-control strategy (Annex 1).
• In-process controls — content uniformity, dissolution, weight, hardness, friability, moisture, pH, bioburden, endotoxin (per CQA, with frequency and acceptance criteria).
• Finished-product specification — the registered release spec plus shelf-life spec, the test methods (validated under Q2(R2)), the AQL/sampling plan, the OOS/OOT response procedure.
• Monitoring + trending — SPC charts, CPV plan, alert/action limits, periodic review (ongoing process verification + APR).
• Change control + lifecycle — change-classification matrix (movement-in-design-space, post-approval categories per ICH Q12), comparability protocols, established conditions.

A given CQA can be controlled at multiple points: at the raw-material spec, at the process parameter, in-process test, or at the finished-product spec. The QbD principle is to control as early in the chain as possible — controlling API particle size at the supplier is more powerful than controlling dissolution at the end. Practical rule-of-thumb: high-risk CQAs (per the QRM risk assessment) get controls at multiple points (defence in depth); low-risk CQAs may be controlled at a single point. The decision tree should be documented and traceable in the development report.

In a Real-Time Release Testing (RTRT) control strategy, the in-process measurement replaces a finished-product test (e.g. NIR-derived blend uniformity replaces the conventional stratified-sampling assay). The RTRT element is approved in the filing; the in-process measurement is qualified to the same standard as the analytical method it replaces (ICH Q2(R2)); the model is change-controlled; and the finished-product spec stays on file — it's just not retested on every batch. ICH Q13 makes RTRT a baseline expectation for continuous manufacturing.

The control strategy is a living artefact. New CPV signals tighten or relax controls. Supplier changes adjust CMA specs. Equipment upgrades change CPP ranges. ICH Q12 introduces formal tools: Established Conditions clarify which control-strategy elements are notifiable; PACMPs (Post-Approval Change Management Protocols) pre-agree the data needed for a future change; the Product Lifecycle Management document collects the lot.

Annual Product Review (APR per 21 CFR 211.180(e) / Product Quality Review per EU GMP Ch.1 §1.10) is the cadence at which the control strategy is formally re-assessed. The APR pulls every batch's CQAs, CPPs, deviations, OOS, change-control events and complaint data, and asks: 'is the control strategy still adequate?' The answer feeds the next year's quality plan.

1. Control strategy described in Module 3 but not reflected in site SOPs and batch records — paper says one thing, kiosk does another.
2. Finished-product spec is the only real control — the upstream CMA/CPP controls are 'documented' but not enforced.
3. PAT/RTRT claimed in the filing but the operator releases on legacy lab tests anyway — the control-strategy benefit is theoretical.
4. EM trending exists but never feeds back into the contamination-control strategy (Annex 1 §2.5 finding).
5. CPV data accumulate without any annual review of whether the control strategy still matches the process reality.
6. Change-control events approved without revisiting the impacted control-strategy element — the filing slowly diverges from operations.
7. No clear ownership — quality, manufacturing, engineering and regulatory each hold a piece, no one owns the whole.

• Single control-strategy register per product — the platform links each CQA to its CMA controls (supplier qualification + incoming spec), its CPP controls (recipe parameters + PARs + design space), its facility/environment controls (EM plan, classified-area routes), its IPC plan and its finished-product spec. The register is the single source of truth that the kiosk, the lab, the supplier portal and the change-control workflow all read from.
• Kiosk enforcement: CPP outside PAR/design-space, CMA outside spec, EM out-of-trend — each blocks the next step or triggers the controlled-deviation flow, automatically.
• RTRT support: when an RTRT element is approved, the platform treats the in-process measurement as the release datum and surfaces the conventional finished-product test as 'replaced by RTRT, not required this batch' on the BMR.
• Change-control impact assessment: every proposed change is auto-matched against the control-strategy register — the system surfaces which elements are impacted, which require regulatory notification (per ICH Q12 Established Conditions classification) and which require revalidation.
• APR pack: the annual review draws batch-population CQAs/CPPs, deviations, OOS/OOT, complaint data and change-control history from one database; the output is a control-strategy adequacy assessment, not a manually compiled spreadsheet.