IndustriesAPI & CDMO

• API & CDMO

An audit pack that is a filtered view, not a project

Each client sees only what its quality agreement allows. Change control routes per client. An audit pack is one client, one product and one date range.

Book a demoSee the controls

Supported frameworks, not certifications. Regulatory updates included.

API-0836 · CUSTOMER BATCH

Process evidence, ready for review.

  1. 01Process parameters
  2. 02Yield reconciliation
  3. 03Customer review pack
20 configured controlsICH Q7 · EudraLex Volume 4 Part II / Chapter 7 · Revised Schedule M
One controlled record

Why now

Your client is responsible
for a batch you made.

Responsibility is shared between the contract site and the client. The quality agreement sets the terms, and the record has to honour them.

  • The record stays at the site

    The executed record must stay where the batch was made, and be retrievable for the whole retention period.

  • The agreement sets the rules

    Retention, format, access rights and what happens at contract end.

  • Factro holds both sides

    The record of truth stays at your site. Each client sees what its agreement allows.

What is tailored

One site.
Each client’s own rules.

Where the API & CDMO pack changes how the core behaves.

Controlled documents

Change control per client

Approval and notification follow each client agreement's own thresholds, instead of one blanket workflow.

Quality

Scoped client access

Each client sees their batches, deviations, changes and documents, and nothing belonging to another.

Facility

Containment, tracked

Cleaning validation and cross-contamination control, including containment tracking for potent materials.

Built for API and CDMO

Many clients.
One record of truth.

These features switch on with the API and CDMO pack. Your site keeps the record. Each client sees what its quality agreement allows.

01 / Sales · Client-scoped records

Each client sees only its own batches.

Your site keeps one record for every client. Each client’s view holds its batches, CoAs, deviations and changes, scoped by its quality agreement, and another client’s records stay out of view.

  • 01
    Scoped by the agreement.

    Each client sees its batches, deviations, changes and documents, and nothing belonging to another, without a second system.

  • 02
    The record stays on site.

    The record of truth is held where the batch was made, and stays retrievable for the whole retention period.

  • 03
    Every copy is logged.

    Certified true copies are a controlled act, logging who exported what, for whom and when.

02 / QA · Change control per client

Change control that follows each agreement.

The impact assessment names the clients a change affects. Approval and notification follow each agreement’s own thresholds, not one blanket workflow.

  • 01
    Impact names the clients.

    The assessment covers documents, equipment, validation and established conditions, and lists every client the change reaches.

  • 02
    Each agreement sets the route.

    One client approves before the change, another is told after it, as each quality agreement sets out.

  • 03
    A notice is a record.

    Evidence of notification sits on the change, so a change communicated is a record rather than an email.

03 / Shop floor · Cleaning and containment

Cleaning validated, containment tracked.

Each cleaning record carries its steps, swab and rinse samples and signatures. Potent materials keep containment tracking, and the equipment stays blocked until the record is complete.

  • 01
    Steps, samples, signatures.

    The record follows the SOP step by step, with the swab and rinse results and who signed each step.

  • 02
    Blocked until complete.

    The next product cannot start on the equipment until every step is signed and every sample passes.

  • 03
    Containment for potent materials.

    Potent materials carry containment tracking as part of cross-contamination control, on the same record.

04 / QA · Audit pack

An audit pack is a filter.

Choose one client, one product and one date range. The pack assembles from records you already have, across the areas every client audit walks, and the download is logged.

  • 01
    Scope it in three choices.

    One client, one product and one date range. Nothing to chase across teams.

  • 02
    The areas clients check.

    Deviations and CAPA, audit trail review, change notifications, supplier traceability and validation, drawn from the records.

  • 03
    The download is a record.

    Each pack is logged with who downloaded it and who it was shared with, in the audit trail.

Audit readiness

A state,
not a project.

Clients check five areas continuously. Scope by one client, one product and one date range, and the audit pack assembles from records you already have.

  • Deviation and investigation quality

    Evidence in Factro

    Deviation, OOS and OOT investigations carry their root cause and CAPA, so depth and effectiveness are visible rather than asserted.

    Lives inQuality assuranceLaboratory

  • Audit trail review

    Evidence in Factro

    Review is a scheduled activity, evidenced with a reviewer and a date, not just an available log.

    Lives inAudit trailEvery module

  • Change control notification

    Evidence in Factro

    Each change is checked against what that client’s agreement required, and the notification is a record, not an email.

    Lives inControlled documentsQuality assurance

  • Supplier qualification and starting materials

    Evidence in Factro

    Supplier qualification with audit history and re-qualification, and starting materials traced container by container.

    Lives inPurchaseInventory

  • Validation and method transfer

    Evidence in Factro

    Validation and method transfer status, current and linked to the products they cover.

    Lives inLaboratoryShop floor

  • The audit pack

    Scope it, and it assembles.

    Drawn from records that were never scattered.

    Scope

    Client
    One client
    Product
    One product
    Period
    One date range

    Audit pack, assembled

Controls

20 controls.
6 standards.

Every control below runs on the Compliance Engine. The same record carries the evidence across the plant.

Also mappedWHO TRS 1044 Annex 4

20 controls shown for ICH Q7
01

Append-only, hash-chained audit trail capturing old value, new value, author, time and reason

02

Scoped client access, where each client sees their batches, deviations, changes and documents and nothing belonging to another

03

Record of truth held at the manufacturing site, immediately retrievable throughout retention

04

Certified true copies produced as a controlled act, logging who exported what, for whom and when

05

Client-specific change control routing, matching each agreement's approval and notification thresholds

06

Evidence of notification, so a change communicated is a record rather than an email

07

Executed batch records with full material, process and equipment genealogy

08

Starting material and key intermediate traceability, container by container where required

09

Supplier qualification with audit history and re-qualification scheduling

10

Deviation, out of specification and out of trend investigation with root cause and CAPA

11

Audit trail review as a scheduled, evidenced activity, not just an available log

12

Role-based access control, down to the individual field

13

Segregation of duties enforced in the system, maker is never checker

14

Cleaning validation and cross-contamination control, including containment for potent materials

15

Process validation and equipment qualification with IQ, OQ, PQ and calibration history

16

Analytical method validation and transfer, with protocol and report held together

17

Technology transfer pack, sending and receiving responsibility matrix, gap assessment and comparability

18

Established conditions checked before a change reaches the floor, per ICH Q12

19

Master file alignment, keeping the open and restricted parts consistent with the process as run

20

Product quality review assembled from records rather than compiled at year end

Regulatory change

We watch the rules.
You do not have to.

The Compliance Engine tracks the rules that apply to you, works out what a change touches, updates the system and re-validates before release. You file no change request.

  1. • applied

    ICH Q7 finalised

    The GMP guide for active pharmaceutical ingredients was agreed. It remains the baseline most API sites and their clients audit against.

  2. • applied

    Revised Schedule M notified

    India’s revised GMP schedule was published, and it reaches API sites that were previously covered mainly through ICH Q7 guidance.

  3. • applied

    Scoped multi-client access shipped

    Client-specific change control routing and scoped access — each client sees only their own batches and documents — were built before Schedule M's API-site enforcement went live with no grace period.

  4. • applied

    Revised Schedule M enforcement for API sites

    Where ICH Q7 recommends, Schedule M requires — pharmaceutical quality system, quality risk management, product quality review, lifecycle validation, computerised system controls and data integrity are now obligations on every covered site, with no grace period for any turnover band.

Validation readiness

Controls built in,
not configured on top.

Validation packs

Available on the Dedicated tier, mapped to your workflows. URS, IQ, OQ, PQ, RTM and GAMP 5.

ISO 27001

Certification in progress. Encryption, access control and backups are described on Security & Trust.

Readiness, scored

The Compliance Engine scores inspection readiness continuously, with guidance on each open gap.

Make it your workflow

Have a requirement
to walk through?

Bring the regulation that keeps you up at night. We will show you the control that answers it, on a batch from your plant.

Book a demo