E&L During Audits: the Documentation That Saves You and the Documentation That Wastes Your Time
During audits on Extractables & Leachables (E&L), something predictable often happens: the company has “some reports”, maybe from the supplier, the laboratory or recovered from emails, but it does not have a document that clearly connects:
risk → data → decision → control
The result is simple: even technically correct decisions become difficult to defend.
The problem, therefore, is not only “performing E&L studies”. The real point is to build coherent, navigable and audit-ready documentation, capable of demonstrating that the company has identified the risks, assessed exposure, selected proportionate actions and planned control throughout the entire lifecycle.
Table of Contents
- What an inspector wants to see on E&L
- Your audit-ready E&L Dossier
- Ready-to-use template: E&L Risk Assessment Summary
- Pre-audit checklist on E&L
- The 7 inspector questions and model answers
- Conclusion
- Do you want a complete E&L template package?
1. What an inspector wants to see on E&L
In one sentence, an inspector wants to see that the E&L risk has been controlled in a structured, documented and proportionate way.
More specifically, they want to verify that:
- you have identified the potential sources of extractables and leachables;
- you have assessed risk and patient exposure;
- you have selected tests, data or actions proportionate to the risk;
- you have involved adequate expertise, including toxicology where needed;
- you manage changes, suppliers and lifecycle in a controlled way.
In practice, the inspector is not only looking for an analytical report. They are looking for the logic that connects that report to the final decision.
1.1 The most common mistake
The most common mistake is having documents that are disconnected from each other:
- supplier reports;
- laboratory reports;
- technical emails;
- certificates;
- declarations of compliance;
- toxicological assessments;
- QA notes.
If these elements are not connected into a single rationale, the system appears fragile, even when the available data are good.
1.2 The audit-ready logic
E&L documentation must tell a clear story:
- which materials and components were assessed;
- which risk was identified;
- which data were used;
- which gaps were found;
- which tests were performed or not performed;
- which decision was made;
- how the risk is kept under control over time.
This is the difference between “having documents” and “having a defensible dossier”.
2. Your audit-ready E&L Dossier
An effective E&L Dossier must be easy to navigate and sufficiently complete to answer the inspector’s questions without needing to search for information in ten different folders.
Below is a recommended structure.
2.1 Section A — Executive Summary
The Executive Summary should be short, ideally 1–2 pages, and provide an immediate overview of the rationale.
It should include:
- product;
- route of administration;
- maximum daily dose;
- target population, if relevant;
- shelf-life;
- primary packaging;
- direct and indirect contact components;
- overall risk level;
- risk rationale;
- final decision: what was tested, what was not tested and why.
This section is essential because it allows the inspector to immediately understand the logic of the dossier.
2.2 Section B — Inventory of contact materials
The inventory is one of the most important elements.
It should be a complete table linking:
- component;
- material;
- type of contact;
- contact time;
- temperature;
- process phase or use;
- available data;
- criticality;
- possible risk classification.
This is the step that prevents the classic problem: the inspector finds an O-ring, a gasket, an adhesive or a “minor” component that has not been assessed.
2.3 Section C — Risk Assessment
The risk assessment section must explain the method used and the decision criteria.
It should include:
- probability criteria;
- severity criteria;
- Low / Medium / High classification;
- rationale for each component or group of components;
- references used, such as compendial data, supplier data, literature or internal studies;
- action required according to risk.
The objective is to make it clear that the decision is not subjective, but based on defined criteria.
2.4 Section D — Evidence pack
The evidence pack collects the “clean” attachments, meaning the documents that support the rationale.
It may include:
- supplier reports;
- gap assessment of supplier data;
- laboratory reports on extractables and/or leachables;
- CoC;
- CoA;
- declarations of compliance;
- technical letters;
- possible DMF extracts;
- analytical protocols and reports;
- supplier qualification documents.
The important point is that every attachment is referenced in the rationale and not included only “for completeness”.
2.5 Section E — Toxicological assessment
When required, the toxicological assessment is the bridge between analytical data and patient safety.
It should include:
- list of compounds of interest;
- detected or estimated concentrations;
- calculation of patient exposure;
- comparison with acceptable limits, such as PDE, TTC or equivalent approaches;
- assessment of unknown peaks, if present;
- signed or approved conclusion;
- any control recommendations.
Without toxicology, the analytical report risks remaining a list of peaks without a real safety conclusion.
2.6 Section F — Lifecycle and Change Control
E&L risk does not end when the initial dossier is closed.
You must demonstrate how it will be kept under control over time.
This section should include:
- quality agreement with change notification obligation;
- E&L reassessment triggers;
- link with change control;
- periodic review, for example in PQR/APR;
- management of material, supplier, process or packaging changes;
- reassessment in case of deviations, complaints or abnormal trends.
An E&L Dossier without lifecycle control is incomplete, because it does not demonstrate how the risk will remain controlled after initial approval.
3. Ready-to-use template: E&L Risk Assessment Summary
Below is a concise template that can be copied and adapted.
3.1 Document header
Document: E&L Risk Assessment Summary – [Product Name]
Version / Date: ____
Owner: QA Compliance / Packaging / Regulatory Affairs
Approval: Quality Unit
3.2 Purpose and scope
Assess and control the Extractables & Leachables risk for:
- primary packaging;
- device, if applicable;
- direct contact components;
- indirect contact components;
- process components, if applicable.
3.3 Product and intended use
Report the essential information:
- route of administration;
- maximum daily dose;
- target population;
- shelf-life;
- storage conditions;
- method of use;
- any critical conditions.
3.4 List of contact components
Insert a table with:
- component;
- material;
- type of contact;
- contact time;
- temperature;
- sterilisation, if applicable;
- available data;
- critical notes.
3.5 Risk assessment methodology
Describe:
- probability criteria;
- severity criteria;
- decision thresholds;
- data sources used;
- Low / Medium / High classification method;
- criteria for deciding when dedicated studies are needed.
3.6 Risk ranking results
For each component, report:
- assigned risk;
- rationale;
- available data;
- identified gaps;
- planned action.
Examples of possible actions:
- no additional action;
- data only;
- gap assessment;
- targeted testing;
- full extractables study;
- leachables study;
- toxicological assessment.
3.7 Summary of analytical data
If analytical studies are present, indicate:
- which studies were performed;
- on which components;
- under which conditions;
- with which methods;
- LOQ / LOD;
- relevant results;
- unknown peaks;
- compounds of interest;
- any limits applied.
3.8 Toxicological assessment
Report:
- compounds assessed;
- calculated exposure;
- comparison with limits;
- approach used;
- conclusion;
- any recommended actions.
3.9 Final decision and controls
Close the summary with:
- final decision;
- acceptance or non-acceptance of residual risk;
- planned controls;
- link with change control;
- periodic review;
- reassessment triggers.
4. Pre-audit checklist on E&L
Before facing an audit or regulatory review, verify that the E&L dossier is truly defensible.
4.1 Documentation completeness
- Is there a single document that tells the end-to-end E&L story?
- Does the dossier connect risk, data, decision and control?
- Is it clear which components are included in the scope?
- Is it clear what was tested and what was not?
- Is there a rationale for no-testing decisions?
4.2 Quality of analytical reports
- Do laboratory reports include methods?
- Are LOQ and LOD present?
- Are the criteria for peak inclusion clear?
- Are the results interpretable?
- Are unknown peaks managed?
- Are analytical conditions representative or justified?
4.3 Applicability of supplier data
- Is the link between supplier data and the specific case clear?
- Is there a gap assessment?
- Are solvents, times and temperatures representative?
- Is sterilisation covered, if applicable?
- Does the tested component correspond to the component used?
- Are change notification and quality agreement available?
4.4 Toxicology
- Is the toxicological assessment present when required?
- Is it traceable?
- Is it signed or approved?
- Does it include exposure calculation?
- Does it compare results with defined limits?
- Does it manage compounds of interest and unknown peaks?
4.5 Lifecycle and regulatory consistency
- Is there a change control mechanism?
- Are E&L reassessment triggers defined?
- Is periodic review planned?
- Were indirect components considered?
- Is the internal dossier aligned with the registration dossier, if applicable?
- Do material, supplier or process changes trigger a reassessment?
5. The 7 inspector questions and model answers
5.1 “Did you perform leachables studies?”
Strong answer:
“We conducted a risk-based assessment and defined where leachables studies are required. Here is the risk assessment and evidence pack showing the decision for each critical component.”
5.2 “Why did you not perform E&L here?”
Strong answer:
“For this product/material, the risk is low due to [specific drivers], and we have documented alternative evidence, such as compendial data, historical data or applicable supplier data.”
5.3 “Who assessed safety?”
Strong answer:
“The toxicological assessment was formalised with exposure calculation and comparison against defined limits. Here is the approved report.”
5.4 “What do you do if the supplier changes formulation?”
Strong answer:
“The quality agreement includes change notification. Any relevant change triggers an E&L review within change control.”
5.5 “Are the supplier data applicable?”
Strong answer:
“We performed a gap assessment. We verified solvents, conditions, sterilisation, materials and worst case. Where the data were not sufficient, we defined additional information or targeted studies.”
5.6 “Did you consider process components?”
Strong answer:
“Yes. Process components were assessed within the E&L scope. In the case of sterile processes or Single-Use Systems, the assessment is integrated into the CCS and validation package.”
5.7 “How do you ensure batch-to-batch consistency?”
Strong answer:
“Consistency is ensured through specifications, incoming controls, supplier management, change notification, quality of qualified materials and trending of relevant events.”
6. Conclusion
During E&L audits, the winning system is the one with a dossier that:
- is easy to navigate;
- connects risk and data;
- makes decisions defensible;
- shows lifecycle control;
- demonstrates consistency between QA, laboratory, toxicology, regulatory and supplier management.
Having scattered reports is not enough. You need a complete and coherent technical story.
A good E&L Dossier is not only useful for passing an audit: it demonstrates that the company is truly controlling risk for the patient and for product quality.
7. Do you want a complete E&L template package?
Do you want a complete package of templates, rationale examples, inspection FAQs and a ready-to-use E&L Dossier structure?
Download the GuideGxP premium guide:
Extractables & Leachables (E&L) – Practical Guide to Risk-Based Compliance
