An approved-supplier list is an output of qualification—not the qualification itself. Confidence must come from evidence that the supplier can consistently provide the required material or service and communicate changes that may affect quality.
The depth of qualification should reflect material or service criticality, detectability of failure, supply-chain complexity, regulatory requirements and available controls at receipt and use.
1. Classify the supply risk
| Factor | Questions |
|---|---|
| Patient and product impact | Could failure affect identity, strength, purity, sterility or performance? |
| Detectability | Would incoming testing reliably detect the relevant failure? |
| Process dependence | Does the material attribute influence a critical process or quality attribute? |
| Supply chain | Are brokers, repackers, multiple sites or long routes involved? |
| Compliance history | What do regulatory, audit, complaint and recall records indicate? |
| Business continuity | Is there a single source, long lead time or difficult replacement? |
2. Perform due diligence before approval
- Confirm legal identity, manufacturing site and supply-chain roles.
- Review licences, GMP status and relevant inspection history.
- Assess technical capability, specifications and change controls.
- Evaluate contamination, mix-up, falsification and data-integrity risks.
- Understand subcontracting, testing, storage and transport arrangements.
- Review business continuity and disaster-recovery capability.
3. Select an appropriate assessment
A questionnaire may support low-risk qualification but should not automatically replace an audit for critical materials or services. Decide between paper assessment, remote assessment and on-site audit using documented risk. Audits should evaluate actual systems and evidence, not only procedures.
- Scope the audit to the supplied material or service.
- Use auditors with relevant technical competence.
- Classify findings consistently and require supported responses.
- Assess CAPA adequacy before approval.
- Define re-audit frequency and triggers.
4. Qualify the material and supply chain
Supplier-system approval does not prove that the material is suitable for the specific process. Establish specifications, methods, sampling, identity testing and initial-lot evaluation. Compare supplier certificates with independent results and evaluate variability relevant to process performance.
Two materials can meet the same compendial specification yet behave differently because of particle size, polymorph, moisture, impurity profile or functional characteristics.
5. Establish a quality agreement
- Specifications, test methods and certificate content
- Manufacturing and testing sites and approved subcontractors
- Deviation, OOS, complaint and recall responsibilities
- Change-notification requirements and lead time
- Audit rights and regulatory-inspection communication
- Data, record retention and sample responsibilities
- Storage, transport, traceability and anti-falsification controls
6. Monitor ongoing performance
| Signal | Possible measure |
|---|---|
| Quality | Rejects, deviations, OOS, complaints and certificate discrepancies |
| Delivery | On-time performance, damage, excursions and shortages |
| Change control | Timeliness and adequacy of change notification |
| Responsiveness | Investigation and CAPA quality and timeliness |
| Compliance | Inspection outcomes, recalls, alerts and audit findings |
| Variability | Trends in critical material attributes and process performance |
7. Define escalation, change and disqualification rules
Supplier changes should be assessed through site change control before affected material is used when required. Establish triggers for increased testing, audit, probation, suspension or removal. Manage remaining stock, open orders, alternate sources and regulatory implications.
- Unapproved site or subcontractor change
- Recurring unexplained variability
- Data-integrity or falsification concern
- Critical audit finding or regulatory action
- Failure to notify significant change
- Ineffective supplier CAPA
- Loss of required licence or certification
Common supplier-qualification mistakes
- Approving from a questionnaire alone regardless of risk
- Qualifying a distributor without understanding the manufacturer
- Treating a certificate of analysis as independent assurance
- Failing to evaluate material functionality
- Using expired audits without documented review
- Ignoring logistics and storage providers
- Accepting vague change-notification clauses
- Tracking delivery performance but not quality variability
- Keeping a supplier approved despite repeated ineffective CAPA
Primary references
Accessed 23 September 2026. Verify current requirements applicable to your products, jurisdiction and approved pharmaceutical quality system.
Educational notice: This article provides general education and does not replace approved procedures, product-specific scientific assessment or regulatory requirements.