Supplier qualification is the risk-based process of establishing and maintaining confidence that a material supplier or contract organisation can consistently meet your quality requirements — because their deviation becomes your recall.
Supplier qualification is the risk-based process of establishing and maintaining confidence that a material supplier or contract organisation can consistently meet your quality requirements — because their deviation becomes your recall.
Plain-English explanation, then the primary regulation it comes from.
Two chapters carry the requirements. Chapter 5 covers starting materials and the assessment of their suppliers. Chapter 7 covers outsourced activities, where the contract giver remains responsible for assessing the competence of the contract acceptor and for ensuring the principles of GMP are followed. Responsibility does not transfer with the work.
Risk-based tiering is what makes the programme survivable. Not every supplier warrants an on-site audit: an API manufacturer and a supplier of secondary packaging cardboard present very different exposure. Tier by what the supplier can actually do to your product, then set scrutiny and re-qualification frequency accordingly. Without tiering, either everything gets audited (which does not happen) or nothing does.
The quality agreement is the document that decides arguments later. It should settle who does what, who notifies whom of changes and deviations, audit rights, sub-contracting permissions, and specification and testing responsibilities. Change notification is the clause that matters most in practice — an unnotified supplier change discovered during an investigation is a recurring and avoidable finding.
Qualification is also a state that decays. Re-qualification dates pass, questionnaires arrive and are filed unassessed, agreements go out of date, and the programme drifts into existing on paper. The measure worth tracking is not how many suppliers are qualified but how many are qualified today, against current agreements.
Part I, Chapter 5 (starting materials) and Chapter 7 (outsourced activities)
For API suppliers specifically
ICH Q9 for risk-based tiering
Outsourcing an activity does not outsource the accountability — which makes supplier qualification a continuity question as much as a compliance one.
“Are our suppliers qualified today, against current agreements?”
Re-qualification dates pass, questionnaires arrive and are filed unassessed, and quality agreements go out of date. The measure worth tracking is not how many suppliers are qualified but how many are qualified now.
Tier suppliers by what they can actually do to your product, and make change notification the clause you enforce hardest.
GMP for Quality“Where is our supply genuinely dependent?”
A contract manufacturer's compliance position is a dependency on your balance sheet whether or not it appears there. Concentration in a single site or supplier converts their regulatory problem directly into your supply interruption.
Ask which single supplier or site, stopping tomorrow, would interrupt supply — and what is known about its compliance position.
GMP for CEO“What is the financial shape of this dependency?”
Supplier selection optimised on unit cost alone ignores the cost of qualification failure: rejected material, investigation, held stock, expedited replacement and, where it reaches the market, recall assessment.
Weight qualification depth and audit history into sourcing decisions rather than treating them as a quality overhead applied afterwards.
GMP for CFO“How do we keep supply running through third parties?”
Risk-based tiering is what makes a supplier programme survivable. Without it, either everything requires an audit — which does not happen — or nothing does, and the programme exists only on paper.
Resource the audit programme honestly against the tiering, and run audits jointly where internal capacity is the genuine constraint.
GMP for COOLooking for a definition rather than an explanation? The GMP glossary covers the abbreviations in one line each.
If you want to know where your site actually stands against this, the readiness score covers seven quality-system domains in twenty questions, and takes about ten minutes.