Supplier Qualification in GMP: Vendor Audit Checklist and Process

Supplier quality is one of the most common GMP inspection findings globally. Regulators expect pharmaceutical companies to have a robust, risk-based system for evaluating and monitoring the suppliers who provide APIs, excipients, packaging, and contract services. This guide gives you the practical framework to build and maintain it.

Why Supplier Qualification Matters

The quality of your finished product depends directly on the quality of incoming materials and services. A single unqualified supplier delivering out-of-spec API or contaminated excipients can result in product recalls, patient harm, regulatory action, and reputational damage. EU GMP Chapter 5 and FDA 21 CFR Part 211 both require documented supplier qualification programmes.

The Risk-Based Approach to Qualification

Not every supplier needs the same level of qualification. Apply a risk classification based on:

• Impact on product quality - API suppliers carry the highest risk; indirect service providers the lowest
• Regulatory requirements - some materials (APIs, excipients per EU GMP) have specific qualification requirements
• Supplier track record - new suppliers with no history require more thorough qualification
• Regulatory oversight of the supplier - GMP-certified manufacturers in ICH regions carry lower inherent risk

The Supplier Qualification Process

1. Supplier Selection and Initial Assessment

Before qualification begins, gather basic information: regulatory certifications (GMP certificates, ISO 9001), product specifications, quality agreements, and regulatory inspection history. Request a supplier self-assessment questionnaire covering their quality system, manufacturing processes, and testing capabilities.

2. Supplier Audit

For critical suppliers, conduct an on-site or remote audit. The audit should cover:

• Facility and equipment qualification records
• Personnel qualifications and training records
• SOP control and documentation management system
• Change management and notification procedures
• Deviation, OOS, and CAPA management
• Testing methods validation and laboratory controls
• Batch record system and traceability
• Customer complaint handling

3. Material/Component Testing

For new suppliers, conduct independent verification testing of initial material batches against your specifications. Do not rely solely on the supplier's certificate of analysis (CoA) for initial qualification - verify independently.

4. Approval and Documentation

A qualified supplier must be formally approved in your approved supplier list (ASL) with documented evidence supporting the decision. The qualification record should include: audit report, qualification test results, risk assessment, approved supplier agreement, and any conditions of approval.

Quality Agreements

EU GMP Chapter 7 requires a written quality agreement with all contract manufacturers and contract laboratories. The agreement must define quality responsibilities, change notification requirements, access rights for audits, and GMP obligations. PHARPRO can review or draft quality agreements aligned with current regulatory expectations.

Ongoing Supplier Monitoring

Qualification is not a one-time event. Maintain ongoing monitoring through:

• Periodic incoming material testing against specifications
• Annual review of supplier performance (delivery performance, complaint rate, OOS frequency)
• Monitoring of regulatory databases for inspection outcomes and recalls
• Re-qualification on a risk-based schedule
• Immediate re-assessment triggered by critical quality failures