Supplier qualification: what the file has to prove
An approved supplier list is a conclusion. An inspector asks for the evidence behind it. Most firms can produce a questionnaire, a certificate and a quality agreement for each supplier. Fewer can show that those documents agree with each other, or with what the receiving dock did last month.
Four rulebooks, one expectation
| Source | What it asks for |
|---|---|
| 21 CFR 211.84(d)(2) | A supplier's report of analysis may replace your own testing only if you run at least one specific identity test and establish the reliability of the supplier's analyses by validating their results at appropriate intervals. |
| 21 CFR 211.22(a) | The quality unit is responsible for approving or rejecting product made, processed, packed or held under contract by another company. |
| ICH Q7, section 7 | A system for evaluating suppliers of critical materials. Full analysis on at least three batches before reducing in-house testing, then full analysis at appropriate intervals compared with the certificate of analysis. |
| ICH Q10, section 2.7 | Assess a supplier's suitability before selection, define responsibilities in a written agreement, and monitor and review performance. Responsibility stays with the company. |
| EU GMP Chapters 5 and 7 | Supplier qualification and supply chain traceability for starting materials, audits of active substance manufacturers, and written contracts for outsourced activities. |
SOURCES: 21 CFR PART 211, ICH Q7, ICH Q10, EUDRALEX VOLUME 4. SEE BELOW.
Wording differs. The expectation is the same: approval is earned with evidence and kept current.
What the file has to show
- The basis for approval. An audit, a questionnaire with supporting evidence, or a documented history. Something a reviewer can read and reach the same conclusion.
- The basis for reduced testing. If you accept a certificate of analysis, the identity test on every receipt and the periodic full analysis that proves the certificate can be trusted.
- A quality agreement that says who does what. Change notification, deviation reporting, right to audit and record retention, signed and current.
- Monitoring on a stated cadence. Re-evaluation dates set by risk, and evidence that they happened.
- Controlled change of source. A new supplier or a supplier's process change handled through change control, with the regulatory impact assessed.
Where supplier files stop agreeing
| This record says | That record says | What an inspector concludes |
|---|---|---|
| Approved supplier list names one manufacturing site | Receiving records show material from a second site | Material from an unqualified source was used |
| SOP allows reduced testing on certificate of analysis | No periodic full analysis on file | The reliability of the supplier's analysis was never established |
| Quality agreement requires notice of changes | Change control log shows no supplier notifications in two years | Either nothing changed or nobody was told |
| Supplier audit report lists open findings | No CAPA or follow-up record | Oversight stopped at the audit |
| SOP sets requalification every two years | Last evaluation is older than that | The supplier is approved on paper only |
ILLUSTRATIVE PAIRS. NOT DRAWN FROM ANY ONE COMPANY.
Each record passes review by itself. The finding is in the pair.
Set the cadence by risk
ICH Q9(R1) supports scaling oversight to risk. A supplier of a critical excipient for a sterile product and a supplier of secondary packaging do not need the same audit frequency. They both need a written rationale for the frequency you chose, and proof that you kept to it.
Where Clinplex fits
Clinplex reads supplier qualification procedures, quality agreements and oversight records together, read-only, and shows where they stop agreeing with each other or with the regulations that govern them. Findings cite the clause. Your quality unit decides what to do about them.
Sources
- 21 CFR Part 211. Sections 211.22 and 211.84. ecfr.gov
- FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements. Guidance for industry, November 2016. fda.gov
- ICH Q7, Q9(R1) and Q10. Quality guidelines. ich.org
- EudraLex Volume 4. EU GMP Part I, Chapter 5 (Production) and Chapter 7 (Outsourced Activities). ec.europa.eu
Frequently asked questions
Can we rely on a supplier's certificate of analysis?
Yes, with conditions. Under 21 CFR 211.84(d)(2) you still perform at least one specific identity test and you establish the reliability of the supplier's analyses at appropriate intervals.
Is a supplier audit always required?
Not in every case under US rules, where the level of evaluation follows risk. EU GMP expects audits of active substance manufacturers. Whatever you choose needs a documented rationale.
What belongs in a quality agreement?
Who is responsible for each GMP activity, how changes and deviations are communicated, audit rights and record retention. FDA's 2016 guidance on quality agreements sets out the expected content.
How often should a supplier be requalified?
No regulation fixes a number. Set the interval by material and supplier risk, write it down, and keep to it.
Read your supplier file the way an inspector will.
Send three records. We return the gaps with the clause attached in 48 business hours, under a mutual NDA.
Run an Inspection Stress Test