Outsourcing an activity does not outsource accountability. Maturity here is mostly about whether the programme is tiered enough to be affordable, and therefore whether it actually runs.
Supplier quality maturity is whether qualification is current today, not whether it was once performed.
The process runs when something forces it to.
Suppliers are approved on commercial terms, quality agreements are missing or generic, and qualification status is not tracked.
Typical weakness. No visibility of which suppliers are actually qualified.
Risk. An unqualified or overdue supplier is a finding in its own right.
Procedures exist and are followed, mostly.
Questionnaires are issued and filed, agreements exist for major suppliers, and audits happen when someone has capacity.
Typical weakness. Questionnaires are collected but not assessed.
Risk. Evidence of a programme without evidence of a conclusion.
The process is designed, resourced and measured.
Suppliers are tiered by what they can do to the product, scrutiny follows the tier, and re-qualification dates are owned and tracked.
Typical weakness. Change notification obligations are written but not enforced.
Risk. Unnotified supplier changes discovered during investigations.
It connects to the rest of the quality system.
Supplier performance data feeds the programme, agreements are current, and audit findings connect to the internal CAPA system.
Typical weakness. Sub-contracting by suppliers may be unmapped.
Risk. Dependency chains that are invisible until one link fails.
It improves itself, and the improvement holds.
Supplier risk is treated as an operational continuity matter, dual sourcing is considered for critical dependencies, and qualification depth is weighted into sourcing decisions.
Typical weakness. Commercial pressure to prioritise unit cost.
Risk. Cheapest supplier, most expensive failure.
Part I, Chapter 5 and Chapter 7 (outsourced activities)
For API suppliers specifically
These five levels are a GMPConsultant.nl framework for structuring a conversation about capability. They are not an official regulatory classification, no authority recognises or issues them, and a maturity level is not a statement of GMP compliance.
The GMP Health Index scores seven domains and maps each to a maturity level, in about ten minutes. It calculates in your browser and stores history on your device only.