Phase 1
Identification and Risk Assessment
1Identify supplier and material scope
Document the proposed supplier, the materials or services to be supplied, and the intended use in GMP manufacturing. Identify all products and batches that would rely on this supplier. Confirm the supplier holds a current Manufacturing Authorisation, registration or licence appropriate to the material type and jurisdiction. Check FDA warning letter database, import alert list and EU GMP non-compliance database for any current or recent regulatory actions against this supplier before proceeding.
21 CFR 211.84(a) · EU GMP Chapter 5.27 · FDA Warning Letter database
↓
2Risk assessment and tier assignment
Conduct formal risk assessment using ICH Q9(R1) 2023 methodology. Assess: material criticality to product quality and patient safety, supplier GMP status and regulatory history, supply chain complexity and whether the supplier is a manufacturer or broker, availability of alternative qualified suppliers and consequence of supply failure. Assign the supplier to High, Medium or Low risk tier with documented rationale. The tier assignment determines the qualification pathway and ongoing monitoring intensity.
ICH Q9(R1) 2023 · USP 1083 · ICH Q10 Section 3.2.3
↓
Does the supplier have any current FDA warning letters, import alerts or EU non-compliance certificates?
YES → Enhanced assessment required
NO → Phase 2
↓
⚠ Active regulatory action - do not approve without QA director sign-off
A supplier with a current FDA warning letter, active import alert or EU GMP non-compliance certificate presents elevated risk to your supply chain and regulatory standing. Enhanced assessment including senior QA and regulatory affairs review is required. Approval of such a supplier must include documented risk acceptance at QA director or higher level with a defined monitoring and exit strategy.
ICH Q10 · FDA supplier oversight expectations 2026
Phase 2
Qualification Assessment
3Send qualification questionnaire
Issue a structured qualification questionnaire covering: quality system certification and status, GMP compliance history and recent inspection outcomes, manufacturing controls and facilities, material specifications and testing capabilities, change control procedures and change notification commitments, deviation and CAPA systems, complaint handling procedures and recall capability. Questionnaire responses must be reviewed and assessed - not just collected and filed. Inadequate or evasive responses are disqualifying signals.
21 CFR 211.84(d) · EU GMP Chapter 5.29 · USP 1083
↓
4Review quality system documentation
Request and review: current GMP certificate or ISO 9001 certification, Site Master File or equivalent quality documentation, recent internal or third-party audit reports, regulatory inspection outcomes from the last three years, product-specific technical data sheets and specifications, COA examples for the proposed materials, and analytical method summaries. EU GMP Chapter 5.29 requires documented review of the active substance manufacturer's GMP compliance status before approval as a supplier.
EU GMP Chapter 5.29 · 21 CFR 211.84 · ICH Q7
↓
Does risk tier require on-site audit?
YES - High risk → Step 5
NO - Med/Low → Step 6
↓
5Conduct on-site GMP audit
On-site audit by a qualified GMP auditor covering: facility condition and housekeeping, manufacturing controls and equipment qualification, quality management system and record keeping, laboratory controls including OOS and analytical method validation, personnel training and qualification, deviation and CAPA programme effectiveness, change control system and notification procedures, and cleaning validation for shared equipment. Audit report prepared with findings classified by severity. Critical findings prevent approval until resolved.
EU GMP Chapter 5.27 · 21 CFR 211.84 · ICH Q10 Section 3.2.3
↓
6Incoming material qualification testing
Conduct incoming qualification testing of the proposed material against all release specifications. For API suppliers this must include full identity, assay, purity and impurity testing regardless of the supplier COA. 21 CFR 211.84 permits reduced testing against the COA only after the supplier's testing reliability has been validated through appropriate means at appropriate intervals. Initial qualification requires full testing. Reduced testing requires documented validation of the supplier's analytical reliability over a defined period.
21 CFR 211.84(d)(1) and (d)(2) · EU GMP Chapter 5.31
Phase 3
Approval and Quality Agreement
7Prepare supplier qualification report
Document the complete qualification outcome: risk assessment and tier assignment with rationale, questionnaire assessment conclusions, documentation review findings, audit report summary and CAPA status for any audit findings, incoming qualification testing results versus specifications, and overall qualification conclusion. The qualification report is the evidence package that supports the supplier approval decision. QA review and approval of the report is required before the supplier can be added to the Approved Supplier List.
21 CFR 211.84 · ICH Q10 Section 3.2.3 · EU GMP Chapter 5
↓
Does the qualification assessment support supplier approval?
YES → Step 8
NO → Do not approve
↓
8Negotiate and execute quality agreement
A quality agreement is required for all high and medium risk suppliers under EU GMP Chapter 7 and expected by FDA per the 2016 contract manufacturing guidance. The quality agreement must cover: material specifications and release criteria, change control and change notification obligations, deviation handling and CAPA responsibilities, complaint handling procedures, audit rights and audit frequency, recall procedures and regulatory authority notification, GMP compliance maintenance obligations and what happens when GMP status changes. Missing or incomplete quality agreements are a frequent FDA and EMA inspection finding in 2025 and 2026.
EU GMP Chapter 7 · FDA Contract Manufacturing Guidance 2016 · 21 CFR 211.84
↓
9Add to Approved Supplier List
Add the approved supplier to the site Approved Supplier List with: supplier name and address, materials approved for supply, risk tier designation, qualification date, next re-qualification date, quality agreement reference, approved contact details, and any specific conditions of approval such as mandatory audit rights or enhanced testing requirements. The ASL is a controlled document requiring QA approval for all additions, modifications and deletions. Materials from suppliers not on the ASL cannot be used in GMP manufacturing.
21 CFR 211.84(a) · EU GMP Chapter 5.27 · ICH Q10
↓
✓ APPROVED
Added to ASL. Quality agreement executed. Ongoing monitoring programme initiated.
✗ NOT APPROVED
Findings not resolved. Not added to ASL. Alternative supplier required.
Phase 4
Ongoing Monitoring and Re-qualification
10Incoming material testing programme
Implement risk-based incoming testing programme. For API suppliers: full identity testing on every lot received per 21 CFR 211.84(d)(1). Reduced testing against supplier COA requires documented validation of the supplier's testing reliability - typically three years of results comparison without unexplained discrepancies. EU GMP Chapter 5.31 requires at least one identity test per container of active substance received. Never release a GMP material to manufacturing based solely on a supplier COA without at minimum identity verification.
21 CFR 211.84(d) · EU GMP Chapter 5.31 · USP 1083
↓
11Performance monitoring and KPIs
Monitor supplier performance against defined KPIs at defined intervals: COA compliance rate versus in-house testing, delivery performance and supply reliability, complaint and deviation rate attributable to this supplier, change notification timeliness, and audit finding closure rates. Performance data reviewed quarterly for high-risk suppliers and annually for medium and low risk. Deteriorating performance triggers escalation to enhanced monitoring or re-qualification. EU GMP Chapter 8.14 requires continuous assessment of supplier performance.
EU GMP Chapter 8.14 · ICH Q10 Section 3.2.3 · USP 1083
↓
12Periodic re-qualification and re-audit
Re-qualify suppliers at risk-tier-appropriate intervals: High risk suppliers annually or bi-annually with on-site re-audit. Medium risk every two to three years. Low risk every three to five years or when performance data indicates risk tier change. Re-qualification triggered additionally by: supplier change notification received, FDA warning letter or import alert issued against the supplier, significant quality event attributable to the supplier, quality agreement expiry or renegotiation, and supply chain changes such as new manufacturing site for existing materials.
EU GMP Chapter 5.27 · ICH Q10 Section 3.2.3 · 21 CFR 211.84
↓
Does re-qualification confirm continued GMP compliance?
YES → Renew on ASL
NO → Suspend and investigate
↓
13Change notification management
The quality agreement must require the supplier to notify the manufacturer of all changes that could affect the approved material's quality, specifications or GMP status. Change notifications must be assessed through the manufacturer's change control system. A change to the API synthetic route, manufacturing site or specification requires regulatory assessment and may require a Prior Approval Supplement or equivalent regulatory submission before the changed material can be used. Do not accept changed material without formal change assessment regardless of the supplier's assurance that quality is unaffected.
21 CFR 314.70 · EU GMP Chapter 7 · ICH Q12
Quality Agreement - Required Elements (EU GMP Chapter 7 and FDA 2016 Guidance)
Material specifications and release criteria
Approved specifications for each material supplied. Testing requirements and analytical methods. COA format and content requirements. Retained sample requirements. Shelf life and storage conditions.
Change control and notification
Supplier obligation to notify the manufacturer before implementing changes to manufacturing processes, raw materials, equipment, specifications or analytical methods. Notification timelines defined - typically 30 to 90 days for changes requiring regulatory assessment. Emergency change notification procedure.
Deviation and CAPA responsibilities
Who is responsible for investigating deviations in supplied materials. Timelines for investigation and CAPA completion. Right to review supplier investigation reports. Escalation procedure for critical deviations.
Complaint handling
Procedure for raising material complaints with the supplier. Response timelines. Root cause investigation requirements. Replacement material provision. Credit or return procedure.
Audit rights
Right to conduct on-site audits of the supplier's manufacturing and testing facilities at agreed notice period. Frequency of routine audits by risk tier. Right to conduct for-cause audits with short notice in the event of a significant quality event. Supplier obligation to address audit findings within agreed timelines.
GMP compliance maintenance and regulatory notification
Supplier obligation to maintain GMP certification and to notify the manufacturer immediately if GMP status changes, if a regulatory authority takes action against the facility, or if the supplier receives a warning letter or import alert. Obligation to provide inspection reports from regulatory authority inspections on request.
Recall and field alert procedures
Procedure for supplier to notify manufacturer of any recall or field alert affecting supplied materials. Traceability requirements enabling identification of all manufacturer batches that used affected supplier lots. Cooperation obligations during recall investigations.
GMP Supplier Audit Programme - What Inspectors Look For
Facility and manufacturing controls
Facility cleanliness and maintenance. Equipment qualification status. Pest control programme. Environmental controls appropriate to the material. Cross-contamination controls for multi-product facilities. Cleaning validation for shared equipment.
Quality management system
Document control system. Deviation and CAPA programme effectiveness - particularly repeat deviation rates. Change control system including how changes are communicated to customers. Management review evidence.
Laboratory controls
OOS investigation programme. Analytical method validation status. Reference standard management. Data integrity - audit trails, raw data accessibility, no evidence of data manipulation. Analyst training and qualification records.
Supply chain transparency
Whether the supplier is a manufacturer or a broker or distributor. If a broker: who manufactures the material and is that manufacturer qualified? GDP compliance for storage and transport. Temperature excursion management. Chain of custody documentation.
Common Supplier Qualification Failures - FDA and EMA 2025-2026
Missing or incomplete quality agreements
The most frequently cited supplier qualification deficiency in FDA warning letters and EMA inspections. Quality agreements must exist for all contract manufacturers, contract testing laboratories and critical material suppliers. A general purchase agreement is not a quality agreement.
No on-site audit of API manufacturers
EU GMP Chapter 5.27 requires that active substance manufacturers be audited. Remote or desk-based assessment alone is not sufficient for API suppliers under EU GMP. The audit must have been conducted and documented.
Relying on supplier COA without identity testing
21 CFR 211.84(d)(1) requires at least one identity test on each shipment of each component. EU GMP Chapter 5.31 requires at least one identity test per container of active substance. Accepting a COA and releasing the material to manufacturing without identity testing is a direct regulatory violation.
Change notifications not assessed through change control
Supplier change notifications received and acknowledged but not formally assessed through the manufacturer's change control system. Material from a changed manufacturing process used in GMP production without regulatory impact assessment.
ASL not maintained as a controlled document
Approved Supplier List not kept current, not QA-controlled, or not used in purchasing - materials ordered from suppliers not on the ASL. The ASL is the primary evidence of supplier qualification programme operation.