Supplier Qualification: Beyond the Questionnaire

Supplier qualification is the evidence that a supplier can consistently deliver material or a service meeting your requirements. It applies to API and excipient suppliers, contract manufacturers, testing laboratories, and the suppliers of anything contacting product.

The regulatory basis is ordinary. 21 CFR 211.84 requires testing or examination of incoming components and permits reliance on a supplier's certificate of analysis only where you have established the reliability of that supplier's results. ICH Q7 and Q10 cover the same ground for APIs and quality systems, and for devices it sits in 21 CFR 820 purchasing controls.

Tiering by risk

Qualifying every supplier identically wastes effort on the ones that cannot hurt you and under-serves the ones that can.

The factors that decide the tier:

• What the material becomes. An API is not a shipping carton.
• Whether the supplier is the only source. Sole-sourced material carries risk regardless of how good the supplier is.
• Whether the supplier's own process is under control, and whether they subcontract.
• Regulatory history, which is checkable: the supplier's inspection classifications and any warning letters are public.

That last point is worth making concrete. A supplier's FDA inspection history is a matter of public record, and checking it before an audit tells you what to look at when you get there.

What each activity actually gives you

A questionnaire tells you what the supplier says about itself. Useful for triage, worthless as assurance on its own.

Document review of their quality manual and certifications tells you a system exists on paper.

An on-site audit tells you whether it operates. This is the only activity that distinguishes a written procedure from a followed one, which is why high-risk suppliers get audited and questionnaires do not substitute.

Testing of received material, over enough lots, tells you whether their certificate of analysis can be relied on. This is what 211.84 is asking for, and "we accept their CoA" without that history is the finding.

Staying qualified

Qualification decays. A supplier qualified four years ago on a process they have since changed is not qualified, and nothing in your system will say so unless something is watching.

What keeps it current: periodic requalification on a risk-based schedule, change notification obligations in the quality agreement, monitoring of incoming results and complaints against that supplier, and re-checking their regulatory history.