Who ran the test, and what third-party tested means

Three different things get called testing

A quality claim on a product page usually collapses three separate events into one word.

The first is testing the starting material. Federal manufacturing rules say each lot of a component is withheld from use until it has been sampled, tested or examined and released for use.

The second is testing during production, on materials that are partway through.

The third is testing the finished batch. For each batch of drug product there has to be an appropriate laboratory determination that it conforms to final specifications, including the identity and strength of each active ingredient, before release.

Those answer different questions and happen at different moments. A report from any one of them can be described as testing, and knowing which one you are holding is most of the work.

The rule about relying on somebody else's test

This is the clause worth knowing, because it is the exact question a third-party claim raises and it has a written answer.

Components have to be tested for conformity with all appropriate written specifications for purity, strength and quality. In place of that testing, a report of analysis may be accepted from the supplier of a component. Two conditions come attached.

At least one specific identity test has to be conducted on the component by the manufacturer itself. And the manufacturer has to establish the reliability of the supplier's analyses, through appropriate validation of the supplier's test results at appropriate intervals.

A parallel clause covers containers and closures. A certificate of testing may be accepted from the supplier, provided the manufacturer at least performs a visual identification and validates the supplier's results at intervals.

Read that as a design principle rather than a technicality. Somebody else's certificate is allowed to do most of the work, on condition that you check identity yourself and periodically check the other laboratory. Neither of those conditions appears in the phrase third-party tested.

Identity is separated out on purpose

The same rule carries a sentence that reads oddly until you see why it is there.

At least one test has to be conducted to verify the identity of each component of a drug product, and specific identity tests, where they exist, have to be used.

Identity is the one measurement that never gets delegated. Purity, strength and quality can be taken from a supplier's report. Whether the material is the substance it is supposed to be has to be confirmed by the party using it.

That ordering matches the failure mode a regulator keeps finding in this market. A certificate can be accurate about how pure something is and still be describing a different molecule, which is the subject of the article on reading a certificate of analysis.

Somebody has to be allowed to say no

A test result only means something if refusing it is possible. The rules put that authority in one named place.

There has to be a quality control unit with the responsibility and authority to approve or reject all components, containers, closures, in-process materials, packaging, labeling and drug products. It also has the authority to review production records, to confirm that no errors occurred or that any that did were fully investigated.

One sentence in that section answers a question this market raises constantly. The quality control unit is responsible for approving or rejecting drug products manufactured, processed, packed or held under contract by another company. Handing production to a partner does not hand off the decision.

Two more requirements sit alongside it. Adequate laboratory facilities have to be available to that unit. And its responsibilities and procedures have to be in writing, with the written procedures followed.

Specifications and test procedures are covered too. They are drafted by the appropriate unit and then reviewed and approved by the quality control unit, and any deviation from them has to be recorded and justified.

A certificate is a summary of a record

The document a buyer sees is one page. The rules describe what sits behind it, and the gap between the two is instructive.

A laboratory record has to describe the sample and identify where it came from. It carries the quantity, the lot number or other distinctive code, when the sample was taken and when it was received for testing.

It has to state each method used, and indicate where the data establishing that those methods meet proper standards of accuracy and reliability can be found. The suitability of every testing method has to be verified under actual conditions of use.

It has to hold a complete record of all data secured during each test, including graphs, charts and instrument spectra, identified to the specific material and lot tested.

And it carries two names. The initials or signature of the person who performed each test, and the initials or signature of a second person showing the original records were reviewed for accuracy, completeness and compliance.

A certificate reports the conclusion. The record is where the evidence lives, and asking which one you have been shown is a fair question.

The batch can usually be tested again

One provision explains why a serious operation can revisit a question months later.

A reserve sample representative of each lot of each active ingredient has to be retained, and a reserve sample of each lot or batch of drug product as well. The drug product reserve has to be stored in the same container and closure system the product is sold in, or one with essentially the same characteristics.

The quantity is specified. At least twice what would be needed to perform all the required tests, with sterility and pyrogen testing excluded from that calculation. Retention runs past the product's expiration date.

The consequence is practical. Where a proper reserve exists, a later question about a batch is answerable. Where it does not, the only evidence about that batch is the paperwork written at the time.

Tested, inspected and registered are three claims

Product pages mix these constantly, and separating them takes one reading pass.

Testing produces a measurement on a sample of material. An inspection or an accreditation survey assesses a facility, its procedures and its staff, on a schedule, and returns no number about your batch. Both are useful and they are not substitutes. What an accreditation is and what it covers is a separate subject here.

A laboratory's registration with a federal agency, and its accreditation by a standards body, are facts about that laboratory. Neither is a result, and neither says which tests were run on the material you were sold.

Third party is also a looser word than it sounds. A contract laboratory is outside the pharmacy, which removes the problem of a company grading its own work. It is still a laboratory the pharmacy selected and pays, which is why the manufacturing rules ask for the supplier's reliability to be validated at intervals rather than assumed.

Who these rules actually bind

The regulation quoted throughout this article states its own scope. It sets out the minimum current good manufacturing practice for preparing drug products for administration to humans or animals.

Whether a given compounder is held to it depends on which part of the compounding statute that facility operates under, because the two categories are exempted from different lists of requirements. That comparison is the subject of the article on what a compounding exemption actually exempts.

So the rules here are a reference point rather than a promise. They describe what a testing system looks like when somebody is required to build one, which is the standard a voluntary claim can be read against.

Reading a testing claim in about a minute

Ask which of the three events the claim describes. Starting material, in-process, or the finished batch you received.

Ask who signed it. A supplier's report, a contract laboratory's report and a pharmacy's own release record are three documents, and the difference is on the page.

Ask what was tested for. Sterility, endotoxin, identity, potency and purity are separate tests, and a claim can name one while implying all five.

Ask whether the result is published or only asserted. A per-lot report a reader can open is a different thing from a sentence saying testing happens.

Ask whether the lot matches. A published report describes one batch, and it only speaks about your vial if the identifiers agree.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. 21 CFR 211.84, Testing and approval or rejection of components, drug product containers, and closures, including paragraph (d)(2) permitting a supplier's report of analysis subject to a specific identity test by the manufacturer and periodic validation of the supplier — Office of the Federal Register, Electronic Code of Federal Regulations, September 2026
2. 21 CFR 211.22, Responsibilities of quality control unit, including the authority to approve or reject material and responsibility for drug products made under contract by another company — Office of the Federal Register, Electronic Code of Federal Regulations, September 2026
3. 21 CFR 211.194, Laboratory records, requiring the sample description and source, a statement of each method with its supporting accuracy data, all raw data, and the signatures of the analyst and of a second reviewer — Office of the Federal Register, Electronic Code of Federal Regulations, September 2026
4. 21 CFR 211.165, Testing and release for distribution, requiring laboratory determination of conformance to final specifications including the identity and strength of each active ingredient before release — Office of the Federal Register, Electronic Code of Federal Regulations, September 2026
5. 21 CFR 211.170, Reserve samples, requiring a retained representative sample of each lot of active ingredient and of drug product, at least twice the quantity needed for all required tests excluding sterility and pyrogen testing — Office of the Federal Register, Electronic Code of Federal Regulations, September 2026
6. 21 CFR 211.160, General requirements for laboratory controls, requiring specifications and test procedures to be reviewed and approved by the quality control unit and every deviation to be recorded and justified — Office of the Federal Register, Electronic Code of Federal Regulations, September 2026