It depends. Normally, additional testing is done when something hits its retest date or nears its
retest. If you look across the industry, you’ll see numerous options in terms of how firms do this.
The real issue here is to have whatever you do in a written policy, so that it’s clear as to how
you’re going to deal with retest dating. The bottom line is, there are various options for
establishing your retest period. “An API expiry or retest date should be based on an evaluation of
data derived from stability studies”. And, obviously, “those stability studies should be done using
stability indicating methods”.