The Annual Product Quality Review (PQR / APR): What EU GMP and the FDA Require

The annual Product Quality Review is the one GMP document that asks a manufacturer to look at a product across a whole year and say, in writing, whether the process is still doing what it was validated to do. Done well, it finds the slow drift that no single batch record shows. Done badly, it is a binder of trend charts that nobody reads, signed in a rush before the inspector arrives.

This guide goes through what the EU, the US and ICH texts actually require, how to group products and set a timeline, what makes a PQR worthless, and how to turn its findings into CAPA and change control so the next review has something to check.

What the PQR is for

EU GMP Chapter 1, paragraph 1.10, gives the objective: regular periodic or rolling quality reviews of all authorised medicinal products, including export-only products, “with the objective of verifying the consistency of the existing process, the appropriateness of current specifications for both starting materials and finished product, to highlight any trends and to identify product and process improvements.” Such reviews “should normally be conducted and documented annually, taking into account previous reviews” (Chapter 1). Note what is missing from that sentence: nothing says “summarise the year.” The review exists to verify, to highlight and to identify. A document that only summarises has not met its own objective.

EU GMP Chapter 1, paragraph 1.10, item by item

The text lists twelve items the review should include “at least.” Here they are, with what a reviewer needs to do for each, beyond listing data.

1. Starting materials and packaging materials, especially from new sources, and the supply chain traceability of active substances. Show which sources changed, and whether quality of incoming lots moved with them.
2. Critical in-process controls and finished product results. This is where the trend analysis lives: capability and drift against limits, not a table of averages.
3. All batches that failed to meet specification, and their investigation. Every one, including the ones you would prefer to forget.
4. All significant deviations or non-conformances, their investigations, and the effectiveness of the resulting corrective and preventive actions. Effectiveness is the part that is usually missing.
5. All changes to the processes or analytical methods. Link each to its change control and say whether revalidation was assessed.
6. Marketing authorisation variations submitted, granted or refused, including export dossiers.
7. Stability monitoring results and any adverse trends.
8. Quality-related returns, complaints and recalls, and the investigations done at the time.
9. Adequacy of previous corrective actions on the product, process or equipment. The 1.10 lead-in adds that each review takes previous reviews into account; together they mean last year’s recommendations must be followed up.
10. Post-marketing commitments for new authorisations and variations.
11. Qualification status of relevant equipment and utilities, such as HVAC, water and compressed gases.
12. Contractual arrangements under Chapter 7, to confirm they are up to date.

Paragraph 1.11 then makes the review an input to the quality system: the manufacturer and, where different, the marketing authorisation holder “should evaluate the results of the review and an assessment made as to whether corrective and preventive action or any revalidation should be undertaken.” There should be procedures for managing those actions, and the effectiveness of those procedures verified during self-inspection. Where the MAH is not the manufacturer, a technical agreement should define who does what in producing the review.

The US annual product review: 21 CFR 211.180(e)

The FDA equivalent sits in 211.180(e). Written records “shall be maintained so that data therein can be used for evaluating, at least annually, the quality standards of each drug product to determine the need for changes in drug product specifications or manufacturing or control procedures.” Written procedures must provide for a review of a representative number of batches, whether approved or rejected, and the associated records, and a review of complaints, recalls, returned or salvaged drug products, and investigations conducted under 211.192.

Compare the two texts directly and the differences are clear. The US text is shorter and framed as an evaluation of quality standards, with the purpose of deciding whether specifications or procedures need to change. It asks for a representative number of batches, where the EU asks for every batch that failed specification. It has no itemised list of starting materials, stability, changes, variations, utilities or contracts, and no marketing authorisation holder concept. A site supplying both markets should write one procedure to the EU list and map the US requirement onto it, not maintain two reviews.

ICH Q10 and continual improvement

ICH Q10 does not mention the PQR by name, but it describes what the PQR feeds. Section 3.2.1 asks for a monitoring system that confirms a state of control and identifies sources of variation for continual improvement. Section 3.2.4 puts “periodic quality reviews” into management review, covering complaints and recalls, the conclusions of process performance monitoring, and the effectiveness of changes including those from CAPA, and asks management review to identify actions such as improvements to manufacturing processes and products (ICH Q10). Annex 15 closes the circle from the validation side: ongoing process verification supports the validated status “as documented in the Product Quality Review” (5.32) (Annex 15). The PQR is where a validated state is re-affirmed, or not.

PIC/S participants and the SFDA guide

The SFDA has been a PIC/S participating authority since 1 July 2023. Its current GMP guide is version 4.4 (SFDA GMP Guideline V4.4). Chapter 1, paragraph 1.10, carries the same twelve-item list as the EU text. In paragraph 1.11, the SFDA text carries a sentence that the EU Chapter 1 text does not have: the Qualified Person responsible for final batch certification, together with the marketing authorisation holder, “should ensure that the quality review is performed in a timely manner and is accurate.” If you manufacture for Saudi Arabia, that makes the PQR a document the QP has a stake in.

Grouping, timeline and signatures

Grouping. Paragraph 1.11 permits it: reviews “may be grouped by product type, e.g. solid dosage forms, liquid dosage forms, sterile products, etc. where scientifically justified.” The words that matter are “scientifically justified.” Two strengths made on the same line with the same process can share a review, with strengths shown separately in the data. Two products that merely share a dosage form and a building cannot, unless you can argue the process is the same. Write the justification into the PQR scope, and revisit it when a process changes.

Timeline. The text says annually, and allows rolling reviews. In practice, fix the review period (a calendar year, or twelve months to a fixed date), set a data cut-off, and give yourself a defined window after it to finish. The trap is starting data collection after the period ends. Batch lists, deviation extracts and stability pulls take weeks if they come from separate systems, and a review finished fourteen months after the first batch of the period reads as stale. Many sites open the review at period start and add data as they go.

Who signs. Chapter 1 does not name signatories. The common arrangement is: the author or product owner who compiled it, the head of quality assurance who accepts the conclusions, the Qualified Person where required, and the marketing authorisation holder’s representative where the MAH is a different legal entity. Whatever your arrangement, the technical agreement should say who owns each section, and the signatures should come after the conclusions are written, not before.

What makes a PQR useless

We have read a good many PQRs that satisfied the list in 1.10 and told the reader nothing. The signs are consistent:

• Copy-paste trend charts. Last year’s charts with this year’s points added, and a caption that says “within limits.” No capability index, no statement on whether the limits themselves are still appropriate.
• Sections with data and no conclusion. Every section should end with a sentence a person could be held to: satisfactory, satisfactory with comment, or action required, and why.
• “No deviations of significance” with fifteen on the log. If you judge them insignificant, say what you used to judge, and say how many.
• CAPA listed but not assessed. Item 4 asks for effectiveness. A table of CAPA numbers and closure dates is not an assessment.
• Previous recommendations forgotten. Item 9 covers the adequacy of earlier corrective actions on the product, process or equipment; the 1.10 lead-in adds that each review takes previous reviews into account. Together they mean last year’s recommendations must be followed up. If the new PQR does not refer to the old one, nobody is reading either.
• Conclusion written first. “The process remains in a state of control” appears in the executive summary before the capability analysis has been run.
• Data that cannot be reproduced. A hand-built spreadsheet pasted into a document, with no way to show the numbers match the source records.

Turning findings into CAPA and change control

The test of a PQR is what it changes. Each finding should end in one of four dispositions: no action (with a reason), a CAPA, a change request (for example a specification limit or a method), or a revalidation assessment. Give each action an owner and a due date at the moment the PQR is approved, with a reference back to the PQR section it came from, so the action appears in the CAPA log with its origin attached.

That origin reference is what makes next year’s item 9 cheap to do: you filter the CAPA and change registers for actions raised from last year’s review and report what happened to each. Without it, the check becomes archaeology. Apply the same standard you would to any CAPA, including a defined effectiveness check, and read our guide to the CAPA process in pharmaceutical GMP for what survives inspection.

How the Corpex-eQMS PQR works

The Product Quality Review module in Corpex-eQMS, which is installed on your own servers or private cloud, has a 16-section template (S01 to S16) built on the 1.10 list, with each section carrying references to EU GMP Chapter 1, 21 CFR 211.180 and PIC/S PE 009. Batch, yield and result data can be imported from Excel workbooks. When the owner submits the review, the sources the sections draw on are frozen as snapshots, each with a SHA-256 hash, and a hash of the batch data is stored at submission, so what the reviewers sign is what was compiled. Recommendations are written against a section, and each can raise a real CAPA or a change request from inside the review, with the origin recorded. A 95-second overview film is on the product page; the module sits with the rest of the Corpex-eQMS quality records it pulls from.

The software does not write the conclusions. It removes the copy-paste and the argument over which version of the data the signatories saw. The judgement stays with your quality unit.

Frequently Asked Questions

What is the difference between a PQR and an APR?

They are the same activity under different names. The EU and PIC/S texts call it the Product Quality Review (Chapter 1, paragraph 1.10); the US text in 21 CFR 211.180(e) requires an evaluation of the quality standards of each drug product at least annually, usually called the Annual Product Review. The EU list is longer and more prescriptive, so many sites write one procedure to the EU list.

Can several products be covered by one PQR?

Yes, where scientifically justified. Chapter 1, paragraph 1.11 allows quality reviews to be grouped by product type, such as solid dosage forms, liquid dosage forms or sterile products. The justification should be written into the review scope, and products with different processes should not be grouped.

Does the PQR have to be finished within twelve months?

Chapter 1 says reviews should normally be conducted and documented annually, taking into account previous reviews, and allows periodic or rolling reviews. It sets no deadline after the review period ends, so your procedure should define the period, the data cut-off and the completion window, and you should be able to show you met them.

Who is responsible for the PQR when the marketing authorisation holder is not the manufacturer?

Chapter 1, paragraph 1.11 says a technical agreement should define the responsibilities of the parties in producing the review. The SFDA guide version 4.4 also says that the Qualified Person responsible for final batch certification, together with the marketing authorisation holder, should ensure the review is performed in a timely manner and is accurate.

Sources

1. EU GMP Volume 4, Chapter 1: Pharmaceutical Quality System, paragraphs 1.10 and 1.11
2. 21 CFR 211.180, General requirements (paragraph e)
3. ICH Q10: Pharmaceutical Quality System, sections 3.2.1 and 3.2.4
4. EU GMP Annex 15: Qualification and Validation, paragraph 5.32
5. SFDA Guide to Good Manufacturing Practice for Medicinal Products, version 4.4, Chapter 1, paragraphs 1.10 and 1.11