Supplier Qualification Best Practices: Beyond the Audit

The Limitations of Audit-Only Qualification

Regulatory expectations for supplier qualification, set out in EU GMP Chapter 7, FDA CGMP 21 CFR Parts 210/211 and ICH Q10, require more than a point-in-time audit. An audit conducted today tells you about the supplier's quality system as it existed on the audit date. What happens between audits, process changes, personnel changes, regulatory observations, near-miss events, is where the genuine quality risk lies.

Pharmaceutical companies that treat supplier qualification as a one-time approval exercise, refreshed only by periodic re-audit, are operating a compliance programme rather than a quality programme. The distinction matters when a supplier quality failure results in a product recall or regulatory action against the pharmaceutical company.

Quality Agreements: Specificity Matters

Quality agreements are required under EU GMP Chapter 7 and are a regulatory expectation under FDA CGMP for contract manufacturing arrangements. But the existence of a quality agreement is not, by itself, evidence of effective supplier oversight. The content of the agreement determines its value.

Effective quality agreements define, with specificity:

• Which GMP activities are the responsibility of the contract giver and which of the contract acceptor, not in general terms but by specific activity
• Change notification requirements: what constitutes a notifiable change, the timeline for notification, and what approval is required before implementation
• The scope of audit rights: who may audit, with what notice, and what access is provided
• Batch release responsibilities and the documentary evidence required before release
• Deviation and OOS notification obligations: which events must be notified to the contract giver, within what timeframe
• Recall and market withdrawal cooperation obligations

Quality agreements should be reviewed whenever there is a significant change to the supply relationship and at minimum every three years. An agreement written when a supplier was providing one product and one service that has since expanded is unlikely to reflect the current scope of the relationship.

Change Notification Programmes

Change notification failures are a consistent finding in FDA Warning Letters to pharmaceutical companies. The expectation is that pharmaceutical companies are aware of changes at their suppliers that could affect product quality, and that they assess the regulatory impact of those changes before the changed product or service is used.

An effective change notification programme requires two things: a quality agreement obligation on the supplier to notify, and an internal process at the pharmaceutical company to receive, assess and act on notifications. Many organisations have the former without the latter.

When a supplier notifies a change, the pharmaceutical company must assess whether the change is significant for their product, whether it triggers a regulatory submission requirement in any market where the product is authorised, and whether any re-qualification or re-testing is needed before the changed material or service is used. This assessment should be documented and approved before the change is accepted.

Risk-Based Periodic Reassessment

Periodic reassessment of supplier qualification status should be risk-based, the frequency and depth of reassessment proportionate to the criticality of the supplier and the risk profile of the materials or services they provide. A fixed annual audit cycle applied uniformly to all suppliers regardless of risk is neither efficient nor effective.

A risk-based reassessment programme uses a supplier risk classification to determine audit frequency and scope:

• Critical suppliers (API manufacturers, sterile product CDMOs): annual or biennial on-site audits, quarterly performance review
• High-risk suppliers (excipient manufacturers, primary packaging): biennial on-site audits, annual performance review
• Standard suppliers (secondary packaging, non-critical services): risk assessment-based audit, biennial performance review
• Low-risk suppliers (office supplies, non-regulated services): questionnaire-based qualification, no routine audit

Reassessment should also be triggered by events, a critical finding at audit, a supplier regulatory action (Warning Letter, import alert), a significant quality failure, or a material change in the supplier's ownership or quality management.

Regulatory Intelligence as a Qualification Input

FDA Warning Letters, import alerts and EU non-compliance reports are publicly available and represent real-time intelligence about supplier compliance status. Pharmaceutical companies that monitor regulatory actions against their suppliers, and have a process for assessing the implications of those actions, are operating a genuinely mature supplier oversight programme.

When a supplier receives a Warning Letter, the pharmaceutical company should assess whether the observations relate to activities, products or systems relevant to their supply relationship. An import alert affecting the supplier's facility may require immediate action, including a hold on incoming materials, regardless of whether the specific product affected is the one supplied to the pharmaceutical company.