Quality by Design and Design of Experiments: CQAs, CPPs, and the Design Space

Quality by Design (QbD) is the discipline of building product quality into a process by understanding it, rather than testing it in at the end. Design of Experiments (DoE) is the statistical engine that makes that understanding efficient. The two are inseparable in modern pharmaceutical development: QbD gives you the structure (define what quality means, rank what affects it, control it), and DoE gives you the data to fill that structure with numbers instead of opinions.

This page walks the full chain that an inspector, an interviewer, or your own process development lead will expect you to know cold: from the Quality Target Product Profile (QTPP) down through Critical Quality Attributes (CQAs), risk ranking, Critical Process Parameters (CPPs) and Critical Material Attributes (CMAs), the DoE work that connects parameters to attributes, the design space, and finally the control strategy that holds it all together. It maps onto Stage 1 (Process Design) of the FDA process validation lifecycle and onto the ICH Q8/Q9/Q10/Q11 set.

The regulatory basis: what actually requires this

QbD is not one regulation. It is a coherent set of ICH guidances plus the FDA process validation framework. Knowing which document says what is itself an interview discriminator.

ICH Q8(R2) makes the core point that quality cannot be tested into a product after the fact; it has to be built in through design. That principle is the thesis of the entire approach.

The regulatory point worth internalizing: QbD is not mandatory in the sense that you will be cited for not doing it. The minimal/traditional approach is still legal. But once you make QbD claims in a regulatory submission (a design space, real-time release testing, expanded change-management flexibility under Q12), you are held to the data that supports those claims. A design space asserted without supporting DoE is a finding waiting to happen.

The quality rationale is simpler than the regulatory map: a process you understand has fewer deviations, fewer out-of-specification (OOS) results, fewer batch failures, and a far easier path through post-approval changes. The investment in Stage 1 pays back in Stage 3 (Continued Process Verification) for the life of the product.

Minimal development vs QbD: what actually changes

The most common point of confusion for anyone new to this area is whether QbD is required. It is not, in the sense that a company can still develop and file a process the traditional way and no regulation cites a firm for skipping QbD outright. What changes is not a compliance checkbox; it is the basis for the specifications, the room to change the process later, how much data the filing carries, and what the firm is on the hook for when something goes wrong. The comparison below lays that out side by side.

Neither column is the compliant one and neither is the wrong one. A low-volume, well-characterized legacy process with a long track record may not justify the DoE investment a QbD filing requires. What is not defensible is asserting QbD language, a design space, real-time release testing, expanded change flexibility, without the data behind it. Once a firm makes that claim, an inspector reads it as a commitment, and a design space with no DoE behind it is not a shortcut. It is a finding.

The deliverable chain at a glance

QbD is a sequence of linked deliverables. Each one feeds the next, and an inspector will trace the linkage. If your CQA list does not flow from your QTPP, or your CPPs do not flow from a documented risk assessment, the chain is broken and the conclusions are unsupported.

1. QTPP (Quality Target Product Profile): what the product must be to be safe and effective.
2. CQAs (Critical Quality Attributes): the measurable properties that must stay in range for the product to meet the QTPP.
3. Initial risk assessment: map process parameters and material attributes against CQAs to find what might matter.
4. DoE / experimental studies: quantify which parameters and attributes actually affect which CQAs, and by how much.
5. CPPs and CMAs: the parameters and material attributes that, based on the data, are critical.
6. Design space: the multidimensional region of inputs proven to deliver acceptable CQAs.
7. Control strategy: the set of controls (parameter ranges, in-process controls, specifications, monitoring) that keeps you inside the design space.
8. Continued verification: ongoing data (Stage 3 / CPV) that confirms the model held and feeds improvement.

QTPP: the Quality Target Product Profile

What it is and why it is required

The QTPP is a prospective summary of the quality characteristics a drug product should have to deliver the desired therapeutic benefit, accounting for safety and efficacy. ICH Q8(R2) defines it as the basis of design for the product. It is the anchor: everything downstream is justified by tracing back to a QTPP element. Without a QTPP you have no objective definition of “good,” and CQA selection becomes arbitrary.

What goes in it

A QTPP is patient and product focused, not process focused. Typical elements:

• Intended use / indication and route of administration
• Dosage form and strength(s)
• Container closure system
• Pharmacokinetic target (for example, bioequivalence to a reference, or a defined release profile)
• Drug product quality attributes appropriate to the dosage form: identity, assay, content uniformity, impurities/degradants, dissolution or release, sterility (for injectables), particulate matter, and stability/shelf life

Worked example: QTPP for a small-molecule immediate-release tablet

Note that the QTPP states targets, not yet criticality. Criticality is decided next.

Acceptance criteria for a good QTPP

It is patient-centric, complete for the dosage form, sourced (literature, reference product label, clinical needs, compendial requirements), and traceable forward to every CQA. A QTPP that simply restates a finished-product specification is a common weakness; the QTPP should justify the specification, not copy it.

To capture the QTPP as a controlled document from the outset, rather than reconstructing it after the fact for a filing, use the Quality Target Product Profile (QTPP) form: a field table, an approval chain, and a filled specimen.

CQAs: Critical Quality Attributes

What it is and why it is required

Per ICH Q8(R2), a CQA is a physical, chemical, biological, or microbiological property or characteristic that has to stay inside a suitable limit, range, or distribution for the product to meet its intended quality. CQAs are the measurable outputs you commit to control. They are required because they convert the QTPP (a profile) into a set of attributes you can actually test, monitor, and tie to acceptance criteria.

The criticality of an attribute is driven by the severity of harm to the patient if the attribute is out of range. Note that severity does not change based on how well you control the attribute. An attribute can be highly critical (high severity) and yet well controlled and low risk. Beginners conflate “critical” with “risky”; keep them separate.

How to identify CQAs

1. List all candidate quality attributes from the QTPP and dosage-form knowledge.
2. For each, assess the consequence to safety and efficacy if the attribute falls outside an acceptable range (severity). Use prior knowledge, the mechanism of action, toxicology, clinical data, and compendial requirements.
3. Designate as a CQA any attribute whose deviation would meaningfully affect safety or efficacy. Document the rationale for those you exclude.
4. Carry CQAs forward as the responses (the Y’s) you will study in DoE.

Worked example: CQA designation for the tablet above

A frequent and defensible move: an attribute like hardness or disintegration is not itself a final CQA but is an intermediate or in-process attribute that influences a true CQA (dissolution). Capturing that relationship is exactly what DoE is for.

For biologics, the CQA list is longer and harder: aggregation, charge variants, glycosylation profile, host cell protein, residual DNA, potency, and so on. The same logic applies, with potency and immunogenicity-linked attributes typically carrying high severity. See process validation for biologics and comparability and potency assays.

From CQAs to parameters: the initial risk assessment

What it is and why it is required

Before any experiments, you do a structured risk assessment that maps every process parameter and material attribute against every CQA. The purpose is to focus the experimental program: you cannot study everything, so you use prior knowledge and risk ranking to decide what enters the DoE and what is screened out. ICH Q9(R1) is the governing guidance for the methodology, and ICH Q8 expects the rationale to be documented.

This is where two more definitions land:

• Critical Process Parameter (CPP): a process parameter whose variation affects a CQA, so it has to be monitored or controlled for the process to turn out the intended quality (ICH Q8(R2)).
• Critical Material Attribute (CMA): the analogous concept for an input material property (raw material, excipient, intermediate) that affects a CQA. The term is widely used in practice and in ICH Q11 thinking, though Q8 itself emphasizes parameters.

How to do it: step by step

1. Build the cause-and-effect inventory. Use an Ishikawa (fishbone) diagram per CQA or per unit operation, categories typically Materials, Methods, Machines, Measurement, Man, Environment. Brainstorm every parameter/attribute that could plausibly affect each CQA.
2. Score risk in a matrix. A common first pass is a relative-risk ranking or a failure mode and effects analysis (FMEA). For each parameter-CQA pair, score severity, occurrence (likelihood of deviation), and detectability. Multiply or rank to prioritize.
3. Classify each parameter as high, medium, or low risk (sometimes “potential CPP” vs “non-CPP”). High and medium typically advance to experimental study; clearly low-risk ones are documented out with rationale.
4. Record the assessment as a controlled document. The traceability from CQA to studied parameter is what an inspector follows.

Worked example: risk-ranking matrix (extract)

Severity (S), Occurrence (O), Detection (D) on a 1-5 scale; RPN = S x O x D. Higher RPN means study first.

A caution on FMEA scales: RPN is ordinal, not ratio, and multiplying ordinal scores is statistically crude. Many organizations use RPN only to rank and prioritize, never to set a hard pass/fail threshold, and they always keep any high-severity item in scope regardless of a low RPN. Inspectors push back when a high-severity failure mode was screened out purely because occurrence or detection scores diluted its RPN. For the broader method, see quality risk management.

A ready-to-use scoring worksheet that turns this step into a documented, defensible classification, methodology, scoring scales, the parameter-by-CQA assessment table, mitigations, and residual risk, is the CQA/CPP/CMA criticality ranking risk assessment. Its scoring scales run 1 to 4 rather than the 1-to-5 scale used in the worked example above; both are valid FMEA designs, and either range works as long as the organization fixes one scale, defines each point on it, and applies it consistently across every risk assessment that feeds the same design space.

Design of Experiments: the engine

What it is and why it matters

DoE is a structured approach to varying multiple inputs simultaneously, according to a statistical design, so you can estimate each factor’s effect and, critically, the interactions between factors, with a minimum number of runs. The alternative, one-factor-at-a-time (OFAT), is the single biggest mistake in process development: it is inefficient, and it is blind to interactions. If the effect of granulation water on dissolution depends on compression force, OFAT will never see it. DoE will.

DoE underpins the entire QbD claim. A design space is only credible if it rests on a designed study with a fitted model, not on a scatter of historical batches.

Key vocabulary you must use correctly

• Factor: an input you deliberately vary (a parameter or material attribute). Can be continuous (temperature) or categorical (supplier A/B).
• Level: a setting of a factor (for example, low and high, often coded -1 and +1).
• Response: the measured output, normally a CQA.
• Main effect: the average change in a response when a factor moves from low to high.
• Interaction: when the effect of one factor depends on the level of another.
• Center point: runs at the mid-level of all continuous factors; used to detect curvature and estimate pure error.
• Replication: repeating runs to estimate experimental error.
• Randomization: running in random order to protect against confounding from time-related drift.
• Blocking: grouping runs to account for a known nuisance variable (different days, different raw-material lots).
• Resolution (for fractional designs): how badly main effects and interactions are confounded (aliased). Resolution III, IV, V matter.

The three phases of a DoE program

DoE is rarely one experiment. It is a sequence:

1. Screening. Many factors, few resolved interactions. Goal: find the vital few factors from the trivial many. Designs: fractional factorial (for example a 2^(7-3) resolution IV), or Plackett-Burman for pure main-effect screening. Cheap, lots of factors, accept aliasing.

2. Characterization / optimization. A handful of important factors, now with interactions and curvature. Designs: full factorial (2^k) with center points, then a response surface design, a central composite design (CCD) or a Box-Behnken design (BBD), to fit a quadratic model and locate optima.

3. Verification / ruggedness. Confirm the model predicts reality at chosen setpoints, and confirm the process is insensitive to small expected variation around the setpoint.

How to run a DoE: step by step

1. State the objective and responses. Which CQAs are you modeling, and what is “good” for each (target, max, min, range)?
2. Select factors and ranges. From the risk assessment. Set ranges wide enough to provoke a measurable effect but inside what is operationally plausible.
3. Choose the design. Match the design to the phase (screening vs optimization) and to your run budget. Confirm the design can estimate the effects you care about (check the alias structure).
4. Randomize and block. Randomize run order; block on known nuisance factors (lot, day, analyst).
5. Execute with discipline. Hold non-DoE parameters constant. Measure responses with a qualified, validated analytical method (a noisy method can swamp real effects). See method validation essentials.
6. Fit and reduce the model. Fit the appropriate model, check significance (p-values, but read them with effect size in mind), and remove non-significant terms while respecting model hierarchy.
7. Check the model. Residual analysis (normality, constant variance, no patterns), lack-of-fit test, and the adjusted and predicted R-squared. A high R-squared with a poor predicted R-squared means you are overfitting.
8. Optimize and predict. Use the response surface and, for multiple CQAs, a desirability function or overlay plot to find the operating region that satisfies all responses at once.
9. Run confirmation batches at the chosen setpoint and at challenging corners of the proposed space.

Worked example: a 2^3 full factorial with center points

Three factors from the matrix above: granulation water (A), compression force (B), blend time (C). Response: dissolution at 30 minutes (% released, target not less than 80%).

Reading it without software: the main effect of water (A) is the average of the ”+” runs minus the average of the ”-” runs. High-water runs (2,4,6,8) average 74.5%; low-water runs (1,3,5,7) average 90.0%. So moving water from low to high drops dissolution by about 15.5 percentage points. Compression force (B) is a smaller negative effect; blend time (C) barely moves dissolution at all (it would have mattered for content uniformity instead). The center points sit near the average and look stable, suggesting little curvature for this response over this range. The interpretation: water content is the dominant driver of dissolution, force is secondary, blend time is not a dissolution driver. Water and compression force become candidate CPPs for dissolution; blend time stays a candidate CPP for content uniformity, which would be modeled with content uniformity as the response.

This is the heart of QbD: the experiment told you which knobs matter and how much. Now you can set ranges with evidence. For the statistical foundations and how this links to process capability and control charts, see statistics in quality: Cpk and control charts.

Acceptance criteria for a sound DoE

A reviewer or inspector looks for: a pre-specified objective and analysis plan; factors and ranges justified from the risk assessment; randomization and replication; a fitted model with residual diagnostics and a passing lack-of-fit; confirmation runs that match predictions within a stated tolerance; and the measurement system itself qualified (otherwise you are modeling noise). Missing confirmation runs and unqualified analytical methods are the two most common technical gaps.

Mixture designs: when the factors are not independent

Everything above assumes the factors can move independently: granulation water can go up while compression force stays exactly where it was. Pharmaceutical formulation work regularly breaks that assumption. When the factors are proportions of the same whole, binder percent, filler percent, and disintegrant percent in a tablet, or the ratio of buffer components in a biologic formulation, and those proportions must sum to 100 percent, moving one component forces at least one other to move too. Raise the binder and something else in the blend has to give up the same amount of room.

A standard factorial or central composite design assumes the factors are orthogonal: each one can be set independently at any combination of levels inside a rectangle or a cube. Run that assumption against a fixed-sum constraint and it fails in two visible ways. First, several of the design’s own corner points become infeasible, a “high binder, high filler, high disintegrant” corner cannot exist if the three together cannot exceed 100 percent. Second, and more damaging, the fitted model is wrong even at the points you can physically run: because the components are not free to vary independently, the ordinary regression model’s intercept term is confounded with the mixture proportions themselves, so the usual factorial polynomial is not properly estimable. Fit it anyway and the coefficients describe the specific constrained region sampled, not the true relationship, and the model rarely extrapolates or replicates on the next batch.

Simplex-lattice and simplex-centroid designs. These are the standard designs built for a fixed-sum constraint. Picture the feasible region for three components summing to 100 percent as a triangle, a two-dimensional simplex: each corner is a pure component (100 percent of one, none of the others), each edge is a two-component blend, and the interior is every three-component blend. A simplex-lattice design places runs at a systematic grid across that triangle, its vertices and points along its edges at fixed fractions, described by its degree, for example a {3,2} lattice for three components at second-degree resolution. A simplex-centroid design instead places a run at every subset of components taken alone, in pairs, in triples, and so on, plus the overall centroid where all components appear in equal proportion. Both spread points to characterize the whole feasible triangle, or, for four or more components, the higher-dimensional simplex, rather than assuming a cube that does not exist.

D-optimal designs for a constrained mixture space. Real formulations usually carry constraints beyond “sums to 100 percent”: a disintegrant might be held between 2 and 6 percent for cost or compressibility reasons, or a filler might need at least 40 percent to hit tablet weight. Layer those floors and ceilings onto the simplex and the feasible region becomes an irregular, cut-down shape inside the triangle, and a standard simplex-lattice or simplex-centroid grid no longer lines up with its boundaries, or wastes runs outside it. A D-optimal design solves this by algorithm rather than by a fixed pattern: given the constrained feasible region and the model to be fitted, software selects the specific set of points, from a large candidate list spanning the region, that minimizes the variance of the fitted model’s coefficients (equivalently, maximizes the determinant of the information matrix, hence “D”). It is the practical answer whenever real formulation constraints make a textbook simplex design not fit the space actually available to run.

Worked example: tablet excipient-blend optimization

Three excipient components make up the non-drug portion of a tablet’s fill weight: binder, filler, and disintegrant, and by definition they sum to 100 percent of that portion (drug substance and coating are held fixed and are not part of the mixture). Formulation knowledge sets constraints: binder 5 to 15 percent (too little and tablets cap or fail friability; too much and dissolution slows), filler 70 to 90 percent (the bulking agent), disintegrant 2 to 8 percent (too little slows disintegration; too much weakens the compact). The response is disintegration time in minutes, target not more than 15 minutes.

Reading it the way the factorial example was read earlier: the runs richest in disintegrant and leanest in filler (runs 1 and 3) disintegrate fastest, under 12 minutes; the run richest in filler and leanest in both binder and disintegrant (run 2) is far slower, over 22 minutes, missing the 15-minute target. Binder shows a more complex effect: high binder with high disintegrant (run 1) is fast, but a binder-filler blend with little disintegrant (run 4) is slow, so binder’s effect depends on how much disintegrant is present, an interaction, exactly what a mixture model (a Scheffe quadratic, which carries cross-product terms between components) is built to estimate, and what a series of one-factor-at-a-time trials would never surface cleanly. The fitted model here points the formulation toward a blend near run 1 or run 3, high disintegrant, moderate to low filler, with further confirmation runs tightening the exact optimum inside that region.

Acceptance criteria for a sound mixture DoE

A reviewer looks for: every component’s constraint (minimum and maximum proportion, and confirmation that the full set is fixed to sum to 100 percent of the defined basis) stated and justified before any run; a design, simplex-lattice, simplex-centroid, or D-optimal, that actually covers the constrained feasible region rather than assuming an independent-factor cube; a fitted model in the correct mixture form (a Scheffe canonical polynomial, not an ordinary factorial polynomial with a separate intercept term, since the sum constraint makes that form non-estimable); a combined mixture-process variable design, rather than a factor treated as if it were part of the mixture, whenever an independent process factor such as compression force is studied alongside the excipient ratios; residual diagnostics and a lack-of-fit check the same as any other DoE; and confirmation runs inside the feasible region, including near the proposed optimum and at least one constrained boundary, that match the model’s prediction within a stated tolerance.

Build a full DoE study of this kind, the approval page, the design matrix, and the model diagnostics checklist, from the DoE study protocol.

Which DoE design fits your situation? A decision guide

Use the branches below to move from “a DoE is needed” to a specific design family, before touching a statistics package.

This mirrors, in one picture, the phase logic (screening, then characterization, then verification) and the CCD-versus-Box-Behnken call covered above; treat it as the quick-reference version.

CPPs and CMAs: deciding criticality

What it is and why it is required

Once the DoE quantifies effects, you formally designate CPPs and CMAs. A parameter is a CPP if its variation, over the range it will actually experience in manufacturing, has a meaningful impact on a CQA. Criticality is a function of sensitivity (how strongly the CQA responds) and the width of variation the parameter will see relative to the proven acceptable range. ICH Q8(R2) frames criticality as a continuum, not a binary, but most companies still classify into CPP / non-CPP (sometimes with a “key process parameter” middle tier that is monitored but not specification-controlled).

How to decide

1. From the model, get the effect size of each parameter on each CQA.
2. Compare the parameter’s normal operating variation against the range over which the CQA stays acceptable. A strong effect but a very narrow normal variation may still need control; a weak effect with wide variation may not.
3. Classify: CPP (controlled, in the batch record, often with a narrow proven acceptable range and an in-process control), KPP/non-critical (monitored for process consistency but not directly tied to a CQA failure), CMA for material inputs (flows into raw-material specs and supplier controls).
4. Document the basis for each classification, including the data that supports it.

Worked example: criticality decisions

CMAs feed directly into supplier and material controls. See supplier and vendor qualification and quality in technology transfer for how CMAs get locked into incoming specifications and transferred to commercial sites.

The design space

What it is and why it is required

Per ICH Q8(R2), the design space is the multidimensional combination and interaction of input variables (such as material attributes) and process parameters that have been shown to deliver assured quality. The defining regulatory consequence is also in Q8: operating inside the design space is not treated as a change (from a regulatory filing standpoint), whereas moving out of it is a change and normally initiates a post-approval change process. That flexibility is the commercial reason QbD is worth the effort.

A design space is optional. You are not required to define one. But if you file one, it must be supported by data, and it becomes a regulatory commitment.

Key distinctions you must get right

• Knowledge space: everything you investigated, including conditions that produced bad product. Wider than the design space.
• Design space: the proven-acceptable region inside the knowledge space, where all CQAs meet criteria. Approved as part of the application.
• Control space / normal operating range (NOR): the tighter region where you actually run day to day, sitting inside the design space with margin.
• Proven Acceptable Range (PAR): the range of one parameter (others held nominal) shown to give acceptable quality. A set of PARs is a weaker, univariate construct; a true multivariate design space accounts for interactions and is generally preferred and more defensible.

A picture in words: imagine water content on one axis and compression force on the other. The knowledge space is the whole experimental rectangle. The design space is the irregular sub-region inside it where dissolution stays at or above 80%. Your NOR is a small box well inside that sub-region. The further your NOR sits from the design-space boundary, the more margin your process carries against routine variation.

How to construct and verify a design space

1. Define it from the response-surface models, not from individual PARs, so interactions are captured. The boundary is where any CQA reaches its limit.
2. Build it multivariately. For multiple CQAs, overlay the acceptable regions; the design space is the intersection where all CQAs pass.
3. Account for uncertainty. A point estimate of the boundary ignores model error. Mature practice uses the prediction interval or a probability-based (“reliability”) design space, so the claim is “at least X% probability all CQAs pass,” not just “the mean passes.”
4. Verify at scale. A design space developed at lab or pilot scale must be confirmed at commercial scale; scale effects (mixing, heat transfer) can move boundaries. State scale dependency explicitly.
5. Decide on operating ranges and filing strategy under ICH Q12 (Established Conditions) so you know which moves need prior approval.

Worked example: design-space statement

Acceptable dissolution (Q not less than 80% at 30 min), content uniformity, and assay are assured when granulation water is 28-36% (of the documented basis), main compression force is 8-14 kN, and blend time is 12-18 min, with API D90 not more than the specified limit, demonstrated across the studied region with confirmation at commercial scale. The normal operating ranges are water 30-34%, force 9-12 kN, blend time 14-16 min.

Acceptance criteria for a defensible design space

It is derived from a fitted, validated model; it is multivariate; it incorporates model uncertainty rather than only mean predictions; it is verified at the intended commercial scale; and its boundaries are confirmed by runs (especially at the corners/edges) rather than only interpolated. The most common weakness is a design space presented as a simple box of independent PARs, when the underlying data show interactions that make the true region non-rectangular.

The control strategy

What it is and why it is required

Per ICH Q8(R2), a control strategy is a planned set of controls, drawn from current product and process understanding, that assures process performance and product quality. It is the operational output of all the work above. If CQAs are what must be right and the design space is the region that makes them right, the control strategy is how you stay in that region and prove it batch after batch. It is required because understanding without controls is just a report; the control strategy is what actually protects the patient in routine manufacturing, and ICH Q10 operates it across the lifecycle.

What goes in a control strategy

A control strategy is layered, and a good one names the layer for each control:

• Input material controls: CMA-driven specifications on API, excipients, and components; supplier controls.
• Process parameter controls: CPP setpoints and ranges in the batch record; automated controls where appropriate.
• In-process controls (IPCs): measurements during manufacture (LOD, blend uniformity, hardness, in-line PAT) that confirm the process is on track and allow correction before a CQA fails.
• Process Analytical Technology (PAT): real-time or near-real-time measurement and control, the most advanced control layer, enabling Real-Time Release Testing (RTRT) in some cases.
• Finished-product specification: the final acceptance tests and limits.
• Stability and lifecycle controls: the program that confirms CQAs hold over shelf life, plus continued process verification.

A mature control strategy shifts controls earlier. Instead of relying on end-product dissolution testing, you control the parameters and material attributes that DoE proved drive dissolution, and you verify with IPCs. End-product testing becomes confirmation, not the primary control.

Process Analytical Technology and Real-Time Release Testing: a worked example

PAT and RTRT are two distinct ideas that get blurred together. PAT, as FDA’s 2004 guidance “PAT, A Framework for Innovative Pharmaceutical Development, Manufacturing, and Quality Assurance” describes it, is a system for designing, analyzing, and controlling manufacturing through timely, typically in-line or at-line, measurements of critical quality and performance attributes, aimed at ensuring final product quality. PAT is the measurement and control approach. RTRT is one thing done with it once it is validated: per ICH Q8(R2), RTRT is the ability to evaluate and ensure the quality of in-process and final product based on process data, typically a validated combination of measured material attributes and process controls, used in place of, or to reduce reliance on, a separate end-product test. A firm can run PAT for tighter in-process control without ever filing an RTRT claim; a firm cannot claim RTRT without the PAT-grade measurement behind it.

Worked example. Return to the tablet running through this article: dissolution is a CQA, and the earlier DoE work established that granulation water content is the dominant driver of dissolution, with blend time driving content uniformity. The traditional control strategy verifies both at the end, with a dissolution test and a content-uniformity test on the finished tablets. A PAT-based control strategy moves the measurement earlier:

1. During the DoE and design-space verification work, near-infrared (NIR) probes are mounted on the fluid-bed dryer and the blender, collecting spectra continuously during processing.
2. A chemometric model, typically partial least squares regression, is calibrated against the reference methods already in use, loss-on-drying or Karl Fischer for granule moisture, and HPLC or UV assay of thief samples for blend uniformity, across the full range the design space covers, including its edges.
3. The NIR-based moisture and blend-uniformity models are validated as analytical methods in their own right, addressing accuracy, precision, and linearity across that range, consistent with USP General Chapter <1856> Near-Infrared Spectroscopy, Theory and Practice, and the site’s own method-validation program, with a defined, acceptable prediction error relative to the reference method.
4. Once validated, the real-time NIR prediction becomes an in-process control that confirms, run by run, that granulation and blending stayed inside the design space, caught and corrected during processing instead of discovered at final test.
5. With that in-process evidence tied to the design space, the control strategy can file a real-time release testing approach for dissolution and content uniformity, reducing, or in some cases replacing, depending on what the data support and what is approved, the end-product test with the validated in-process prediction, along the lines EMA’s Guideline on real time release testing (formerly the guideline on parametric release) sets out for demonstrating equivalence to the test being reduced or replaced.

The honest caveat: nothing here shortcuts the rest of this article. An NIR probe generates a real-time number, not real-time understanding; the model behind it works only because the DoE already proved which parameters drive dissolution and content uniformity, and the NIR method itself has to be validated as rigorously as any analytical method it stands in for. A PAT tool added to a process that was never characterized through DoE produces a fast, precise measurement of a relationship nobody proved.

Worked example: control-strategy table (extract)

For how this carries into qualification and ongoing verification, see process validation lifecycle, process performance qualification (PPQ), and continued process verification (CPV).

Acceptance criteria for a good control strategy

Every CQA traces to at least one control; every CPP and CMA appears in the strategy; controls are layered (not everything dumped onto end-product testing); IPC limits are derived from the process understanding, not invented; and the strategy is a living document maintained under change control as the process matures. See change control for validated systems.

The QbD development and control strategy summary report ties the QTPP, the risk assessment, the DoE work, the design space, and this control strategy into one document a reviewer or inspector can follow end to end.

Roles and responsibilities

QbD is a team sport, and inspectors will ask who owned which decision.

A practical note: QA does not need to run the statistics, but QA must understand them well enough to challenge an unsupported design space. “The model has R-squared 0.99 so it’s fine” is not an answer QA should accept without seeing the predicted R-squared and the confirmation runs.

Common mistakes and inspection-finding patterns

These are the patterns that show up in deficiency letters and audit observations. No company names; these are generic and recurring.

• OFAT dressed up as QbD. A development report that varied one parameter at a time and then claims a “design space.” No interaction data, so the multivariate claim is unsupported.
• Design space as a box of independent PARs. Univariate ranges stitched into a rectangle while the data clearly show interactions that make the real acceptable region non-rectangular. The corners of the box may not actually pass.
• Criticality reasoning that flips severity. An attribute downgraded from critical because “we control it well.” Severity is patient-driven and does not change with control. Inspectors catch this quickly.
• High-severity failure mode screened out by a low RPN. Occurrence and detection scores diluted a severe failure mode out of scope. A high-severity item should stay in scope regardless.
• No confirmation runs. A predicted optimum and design space with no batches actually run at those conditions to confirm the prediction.
• Lab-scale design space never verified at commercial scale, with scale-dependent unit operations (granulation, lyophilization, mixing) that are known to shift.
• Unqualified analytical method. The DoE responses were measured with a method whose variability swamps the effects, so the model is fitting noise. The method must be validated first.
• Broken traceability. CQAs that do not trace to the QTPP, or studied parameters that do not trace to a documented risk assessment. The chain has a gap and the conclusions float.
• Control strategy that leans entirely on end-product testing. QbD work was done but the controls were never moved upstream, so the “understanding” delivered no operational benefit.
• Static documents. QTPP, risk assessment, and control strategy frozen at filing and never updated as CPV data accumulate. ICH Q10 expects living maintenance.
• Overfitting. A response-surface model with many terms, high R-squared, and a poor predicted R-squared, presented as predictive when it is not.

Interview-ready: questions you will be asked

What is the difference between a CQA and a CPP? A CQA is an output property of the product (assay, dissolution, an impurity) that must stay in range to assure quality. A CPP is an input process parameter whose variation affects a CQA and therefore must be controlled. CQAs are the Y’s; CPPs are the X’s you control to keep the Y’s in range.

How do you decide if an attribute is critical? By severity of harm to the patient if it is out of range, using mechanism of action, toxicology, clinical and compendial knowledge. Severity is independent of how well you control it. An attribute can be highly critical and yet low risk because it is well controlled.

Walk me through the QbD chain. QTPP defines what the product must be; CQAs are the measurable properties that deliver the QTPP; a risk assessment maps parameters and material attributes against CQAs; DoE quantifies which of those actually matter; that designates CPPs and CMAs; the proven multivariate region becomes the design space; and the control strategy keeps you inside it and verifies quality batch to batch.

Why DoE instead of one-factor-at-a-time? DoE varies factors together, so it estimates main effects and interactions efficiently, with fewer runs. OFAT is blind to interactions and uses more experiments to learn less. Interactions are usually where the real process behavior lives.

What is the difference between knowledge space, design space, and control space? Knowledge space is everything investigated, including failing conditions. Design space is the proven-acceptable region inside it, filed and committed. Control space (NOR) is the tighter region you actually operate in, sitting inside the design space with margin.

What is the regulatory benefit of a design space? Per ICH Q8(R2), movement within an approved design space is not considered a change, so you gain operational flexibility without a prior-approval supplement. Movement outside it is a change. This pairs with ICH Q12 Established Conditions to define what needs prior approval.

What makes a design space defensible to an inspector? It is built from a fitted, validated multivariate model, it accounts for model uncertainty (a probability-based boundary, not just mean predictions), it is verified at commercial scale, and its boundaries are confirmed by actual runs rather than only interpolated.

A screening DoE shows a factor is not significant. Do you drop it? Usually you remove it from the optimization model, but you keep its potential criticality in mind. If it has high severity on a CQA, you may still control it. Statistical insignificance over the studied range is not the same as “irrelevant to quality.”

How does QbD connect to process validation? It is Stage 1 (Process Design) of the FDA 2011 lifecycle. The design space and control strategy from QbD set up Stage 2 (Process Qualification, including PPQ) and define what you monitor in Stage 3 (Continued Process Verification).

What is the difference between Box-Behnken and central composite designs? Both are response-surface designs that fit quadratic models. CCD adds axial (star) points to a factorial and can require factor levels beyond the factorial range; Box-Behnken uses midpoints of edges and never goes to the extreme corners, which is useful when corner conditions are unsafe or infeasible, at the cost of less corner information.

What does a CMA flow into? Incoming material specifications and supplier controls. A CMA proven to affect a CQA (such as API particle size affecting dissolution) becomes a specification on the raw material and part of supplier qualification.

How do you optimize a formulation when the components have to sum to 100 percent? An ordinary factorial or response-surface design assumes the factors move independently, and that breaks the moment components are proportions of a fixed total: raising one forces at least one other down. Use a mixture design instead, a simplex-lattice or simplex-centroid design across the constrained simplex, or a D-optimal design when a component also carries its own minimum or maximum proportion. The model fitted is a Scheffe canonical polynomial, not the ordinary polynomial form used for independent factors, because the sum constraint makes an ordinary intercept term non-estimable.

What is Real-Time Release Testing, and what has to be true before you can claim it? RTRT, as ICH Q8(R2) frames it, is releasing a batch based on process data, typically a validated combination of in-process measurements and process controls, instead of relying only on end-product testing. Before claiming it, a firm needs the DoE-established relationship between the in-process measurement and the CQA it stands in for, a qualified and validated in-process measurement method, and a control strategy that demonstrates the substitute measurement predicts the end-product result at least as well as the test it replaces.

Is PAT the same thing as RTRT? No. PAT is the toolset, in-line or at-line sensors, chemometric models, and feedback control, used to measure and control a process in real time. RTRT is one possible use of that toolset: using the real-time data, once validated, to support release instead of, or in addition to, end-product testing. A firm can implement PAT for tighter in-process control without ever filing an RTRT claim.

Practical tips

• Qualify the measurement system before the DoE. A noisy assay can hide a real effect or invent a false one. The variance you can attribute to method should be small relative to the effects you want to detect.
• Set factor ranges wide enough to provoke a measurable response, but inside operationally plausible limits. Too narrow and nothing moves; too wide and you waste runs in regions you would never operate.
• Always include center points in a factorial. They cost little, detect curvature, and give a pure-error estimate.
• Randomize the run order and write down the actual order. If you cannot randomize fully (an oven that takes hours to change temperature), block deliberately and document it.
• Keep the knowledge space, design space, and NOR visually distinct in your reports. Reviewers get lost when these are blurred.
• Use a desirability function or overlay plot for multi-CQA optimization. A setpoint that maximizes dissolution but fails content uniformity is not an optimum.
• Treat the QTPP, risk assessments, and control strategy as living documents under change control, refreshed as CPV data come in. QbD is a lifecycle, not a filing event.
• For analytical methods, the same QbD logic now applies under ICH Q14: define the ATP, identify method CQAs, and establish a Method Operable Design Region (MODR). See ICH Q14 and Q2(R2) analytical lifecycle.

Related reading

• Quality risk management. Where the ICH Q9 risk-ranking method used above comes from.
• Process validation lifecycle. The three-stage framework QbD feeds.
• Process performance qualification (PPQ). Stage 2 confirmation at commercial scale.
• Continued process verification (CPV). Stage 3 monitoring that closes the loop.
• Statistics in quality: Cpk and control charts. The statistical backbone for DoE and ongoing monitoring.
• Process validation for biologics. Applying CQA/CPP thinking to complex molecules.
• ICH Q12 lifecycle management. Established Conditions and post-approval flexibility from a strong design space.
• ICH Q14 and Q2(R2) analytical lifecycle. QbD for analytical methods.
• Quality in technology transfer. Carrying CPPs, CMAs, and the control strategy to the commercial site.
• Annual product review / PQR. Where ongoing CQA and CPP data get reviewed for trends.
• Form: Quality Target Product Profile (QTPP). A ready-to-use field table, approval chain, and filled specimen for capturing the QTPP as a controlled document.
• Risk Assessment: CQA/CPP/CMA Criticality Ranking. Turns the risk-ranking step into a scored, documented classification with mitigations and residual risk.
• Protocol: Design of Experiments (DoE) Study. Approval page, factors and levels, design matrix with actual and predicted results, model diagnostics, and confirmation runs, for factorial, response-surface, or mixture designs.
• Report: QbD Development and Control Strategy Summary. Rolls up the QTPP, the risk assessment, the DoE work, the design space, and the control strategy into one reviewable document.