Supplier & Vendor Qualification
A regulated operation is only as controlled as the materials and services flowing into it. Supplier qualification is the process of establishing — before use and continuously thereafter — that an external provider can reliably deliver material or service that meets the quality requirements the product depends on. It is the point where a company’s state of control extends beyond its own walls, and it is where a surprising share of quality failures originate: a supplier who changed a process without telling anyone, a material accepted on a certificate no one verified, an audit that was a formality. ICH Q10 makes the management of outsourced activities and purchased materials an explicit element of the pharmaceutical quality system, because the responsibility for quality cannot be outsourced even when the work is.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 23 LINKSSupplier qualification extends a company's control beyond its own walls — a QMS and GMP element where a certificate of analysis is not qualification, risk sets the depth, and excipient and API suppliers answer to different guides.
06 · QUALITY MATURITY — SUPPLIER & VENDOR QUALIFICATION, REACTIVE TO ADAPTIVE
Materials are accepted on a certificate no one verifies; a supplier is "approved" by habit and an undisclosed change surfaces as a field failure.
An approved supplier list and questionnaires exist, but depth is uniform and quality agreements lack a real change-notification clause.
Qualification depth scales with risk (questionnaire to on-site audit), the right guide is applied per material, and change notification is contractual and acted on.
Supplier performance (rejections, OOS, complaints, delivery) is trended so requalification is evidence-based and a drifting supplier is caught early.
Supplier qualification is a managed lifecycle feeding management review and change control; sourcing decisions carry qualification and performance knowledge.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 4
Derived from the 4 standards SPEQ maps to this subject, across 3 regulatory bodies: ICH, IPEC, ISO.
RECORDS & OBJECTIVE EVIDENCE
- An approved supplier list scoped by material/service and status
- Risk-based qualification records (questionnaire, audit, on-site) matched to material criticality
- Quality/technical agreements with binding change-notification clauses
- The correct framework per material (ICH Q7 for API, IPEC-PQG for excipients, ISO/IEC 17025 for labs)
- Ongoing supplier performance metrics and requalification records
COMMON INSPECTION FINDINGS
- Certificates of analysis relied on as supplier qualification
- Uniform qualification depth regardless of material or service risk
- Excipient suppliers qualified against ICH Q7 rather than the IPEC-PQG guide
- Quality agreements missing or ignoring change-notification
- Qualification treated as one-time onboarding with no requalification
Qualifying the supplier is not the same as accepting the material
Two distinct decisions hide under "supplier qualification," and conflating them is a common weakness. **Qualifying the supplier** establishes that the *organisation* — its quality system, its process control, its change management — can consistently produce to the required standard. **Accepting the material** confirms that a *specific lot* meets specification, usually through testing and a reviewed certificate of analysis. A certificate of analysis speaks to one shipment; it says nothing about whether the supplier will still be in control next quarter. Treating a CoA as qualification is the classic shortcut, and it fails the moment the supplier changes something the certificate does not capture.
The practical output is an **approved supplier list** — the controlled record of who is qualified, for what material or service, and to what status — maintained through the change-control and quality systems rather than by informal habit. A supplier is not qualified in general; it is qualified for a defined scope, and adding a material, a site, or a service to that scope is itself a qualification decision.
Risk sets the depth: questionnaire, audit, on-site
Not every supplier warrants the same scrutiny, and pretending they do wastes the effort the critical ones need. The depth of qualification scales with the risk the material or service carries — how directly it affects product quality and patient safety, how hard a defect would be to detect downstream, and the supplier’s history. A low-risk commodity may be qualified on a documented questionnaire and acceptance testing; a supplier of a critical raw material or a sterile component earns a formal audit, often on-site, and a lot may still be tested on receipt regardless. This is quality risk management applied to the supply chain: rigour follows risk, not paperwork convention.
The **quality agreement** is the instrument that makes the relationship enforceable. It defines who is responsible for what — specifications, testing, deviation notification, and crucially **change notification**, the supplier’s binding commitment to tell the customer before altering a process, material, or site. The single most damaging supply-chain failure mode is the undisclosed change: a supplier "improves" a step, the customer’s validated process was qualified against the old one, and the mismatch surfaces as a deviation or a field failure. A quality agreement without a real change-notification clause — and a customer who actually acts on the notifications — leaves that gap open.
Different materials, different rulebooks — why the guide matters
A frequent and consequential error is applying the wrong reference standard to a supplier. **ICH Q7 governs active pharmaceutical ingredients** — and it explicitly does not cover excipients. That exclusion is the entire reason the **Joint IPEC-PQG Good Manufacturing Practices Guide for Pharmaceutical Excipients** exists: excipients are made in industries (food, chemical, cosmetic) where pharmaceutical GMP was never the default, so their qualification needs a purpose-built framework rather than an API guide stretched to fit. Qualifying an excipient supplier against ICH Q7 misreads both what the supplier does and what good looks like for that material class.
Services follow the same logic. A **contract testing laboratory** is qualified not only through audit but through its **ISO/IEC 17025 accreditation** — and the detail that trips people up is that accreditation is granted *per method and per matrix*, so the schedule of accreditation matters and the certificate alone does not; a lab accredited for one assay is not thereby competent for another. The principle across all of these is the same: match the qualification framework to what the supplier actually provides — API, excipient, packaging, sterile component, or analytical service — because the right rulebook is what makes the qualification mean something.
Qualification is ongoing, not a one-time gate
The most common structural failure is treating qualification as a hurdle cleared once at onboarding. A supplier’s state of control drifts — staff turn over, equipment ages, they take on new customers, they change a sub-supplier — so qualification is a lifecycle, not an event. Ongoing performance monitoring (rejection rates, out-of-specification trends, on-time delivery, complaint and deviation history) is the evidence base that decides whether requalification confirms continued fitness or a problem has emerged, and periodic re-audit intervals are set by risk, not habit.
This makes supplier qualification a full member of the quality system rather than a purchasing formality. Its outputs — supplier performance metrics, audit findings, the state of the approved supplier list — feed management review, and its decisions run through change control (a new supplier, a new material source, a disqualification are all managed changes). An operation that cannot say, on demand, which of its critical suppliers are currently qualified, against what scope, and on what performance evidence, has extended its process beyond its own visibility — which is exactly the condition regulators probe when a defect is traced back up the chain.
FREQUENTLY ASKED
Is a certificate of analysis the same as supplier qualification?
No. A certificate of analysis attests that a specific lot meets specification; supplier qualification establishes that the supplier’s organisation and quality system can consistently produce to standard over time. A CoA speaks to one shipment and says nothing about whether the supplier remains in control — relying on it as qualification is a common and consequential shortcut.
What determines how deeply a supplier is qualified?
Risk. The depth scales with how directly the material or service affects product quality and patient safety, how detectable a defect would be downstream, and the supplier’s history. Low-risk commodities may be qualified on a questionnaire plus acceptance testing; critical materials and sterile components earn a formal, often on-site audit. It is quality risk management applied to the supply chain.
Why are excipient suppliers not qualified against ICH Q7?
Because ICH Q7 governs active pharmaceutical ingredients and explicitly does not cover excipients. Excipients are made in industries where pharmaceutical GMP was never the default, so the Joint IPEC-PQG GMP Guide for Pharmaceutical Excipients exists as their purpose-built framework. Applying an API guide to an excipient supplier misreads both the supplier and what good looks like for that material.
Why is a change-notification clause so important in a quality agreement?
Because the most damaging supply-chain failure is the undisclosed change: a supplier alters a process, material, or site, but the customer’s validated process was qualified against the old one, and the mismatch surfaces as a deviation or field failure. The quality agreement’s change-notification clause is the supplier’s binding commitment to notify before changing — and it only works if the customer acts on the notifications.