Why Supplier Qualification is more than just an Audit

Outsourcing is a critical activity in the pharmaceutical industry and is subject to a comprehensive set of quality assurance requirements defined in GMP regulations. The EU GMP Guidelines and national legislation specify the obligations that must be agreed between the contract giver and the contract acceptor or supplier in order to ensure product quality. The qualification of suppliers, contract manufacturers and contract laboratories is therefore a fundamental element of both supplier selection and ongoing cooperation.

Numerous aspects must be clearly defined in advance, particularly within contractual arrangements. In addition, operational questions inevitably arise during day-to-day business that require mutually acceptable solutions while fully complying with GMP requirements.

Legal Basis

Pharmaceutical manufacturers are obliged to control all outsourced activities. Chapter 7 of the EU GMP Guidelines explicitly states:

"Any activity covered by the GMP Guide that is outsourced should be appropriately defined, agreed and controlled […]. There must be a written contract between the Contract Giver and the Contract Acceptor which clearly establishes the duties of each party. The Pharmaceutical Quality System of the Contract Giver must clearly state the way that the Qualified Person certifying each batch of product for release exercises his full responsibility."
Furthermore, section 7.4 specifies that: "The Pharmaceutical Quality System of the Contract Giver should include the control and review of any outsourced activities. The Contract Giver is ultimately responsible for ensuring that processes are in place to assure the control of outsourced activities."

Supply chain overview requirements are described in Annex 16 1.7.2 and Chapter 5.29 of the EU GMP Guidelines. Active substance manufacturers (API) are explicitly addressed, and audits are clearly required: "Audits should be carried out at the manufacturers and distributors of active substances to confirm that they comply with the relevant good manufacturing practice and good distribution practice requirements."
For manufacturers of excipients, at least a documented risk assessment is required, which may also indicate the need for an on-site audit.

According to Annex 16 of the EU GMP Guidelines, supplier qualification is one of the responsibilities of the Qualified Person (QP), although this task may be delegated. The QP must ensure that: "Supplier quality management systems are in place that ensure only materials of the required quality have been supplied" (section 1.7.6).

The ICH Q10 Pharmaceutical Quality System Guideline likewise emphasizes the responsibility of pharmaceutical manufacturers for outsourced activities, stating that the contract giver "should be responsible for assessing the suitability and competence of the contract acceptor to carry out the work required."

Supplier Qualification is more than just an Audit

In practice, it is still often overlooked that audits or audit reports represent only one element, albeit an important one, of supplier qualification. Audit reports primarily describe the GMP compliance status observed at a specific point in time. However, additional information must also be considered, such as inspection reports from authorities (e.g. FDA Warning Letters), non-compliance statements from the EudraGMDP database, or information available from the EDQM database. The type of service or goods supplied, transport routes and logistical complexity also influence the overall evaluation. All relevant information should be consolidated within a documented risk assessment. This assessment supports not only audit planning and audit frequency decisions, but also the overall evaluation and qualification of suppliers. Commonly applied systematic risk analysis tools in this context include Failure Mode and Effects Analysis (FMEA) and Hazard Analysis and Critical Control Points (HACCP).

The ICH Q9 Guideline lists several factors that should be considered during audit planning and that are equally relevant for initial and ongoing supplier qualification, including:

• Existing legal requirements;
• Overall compliance status and history of the company or facility;
• Robustness of a company's quality risk management activities;
• Complexity of the site;
• Complexity of the manufacturing process;
• Complexity of the product and its therapeutic significance;
• Number and significance of quality defects (e.g., recall);
• Results of previous audits/inspections;
• Major changes of building, equipment, processes, key personnel;
• Experience with manufacturing of a product (e.g., frequency, volume, number of batches);
• Test results of official control laboratories.

A clearly structured documentation system is required to summarise and maintain the risk assessment and qualification decision. Standardised forms and appropriate IT systems can significantly support this process. At the latest stage, the Qualified Person must be involved in supplier qualification and approval, or at minimum must have unrestricted access to all relevant information (see EU GMP Guidelines Annex 16, sections 1.7.2 and 1.7.3). Summary reports with appropriate cross-references can also be presented during inspections without immediately disclosing full audit reports.

Re-qualification and Ongoing Assessment

Qualified suppliers must be periodically reassessed or re-qualified. This involves comparing current supplier performance against previously defined and agreed specifications. Experience gained from the supplied goods or services is considered, as well as any changes at the supplier, such as personnel, facilities or manufacturing processes. Such changes must be communicated to the pharmaceutical manufacturer without delay.

Re-qualification activities should likewise be supported by a documented risk assessment. This approach increases transparency and traceability and facilitates risk-based decision-making. Potential risks can be identified early, allowing timely implementation of appropriate mitigation measures. Conversely, positive risk assessments may justify reduced audit scope or frequency, thereby reducing both direct and indirect costs.

Contracts

Within the GMP environment, contracts are essential for defining tasks, responsibilities and specifications. In principle, all aspects of cooperation between the contract giver and contract acceptor may be contractually regulated. For clarity and transparency, it is advisable to establish separate contractual documents, such as:

• Supply agreements, defining commercial terms, delivery conditions, payment modalities and warranties
• Confidentiality agreements, regulating the exchange and protection of information
• Quality agreements (technical or GMP agreements), defining all GMP-relevant responsibilities and interfaces

Chapter 7 of the EU GMP Guidelines clearly outlines expectations for quality agreements. In the United States, regulatory expectations were less explicit until the publication of the FDA Guidance for Industry "Contract Manufacturing Arrangements for Drugs: Quality Agreements" in 2016.
To remain effective, contracts must be kept up to date and periodically reviewed. This requirement is also reflected in the EU Product Quality Review (PQR) (EU GMP Guidelines Chapter 1, section 1.10 xii).

Conclusion

Supplier qualification aims to identify and minimise risks associated with outsourced activities. The comprehensive set of qualification measures increases supply chain transparency, supports the verification of trust in suppliers and service providers, and contributes to consistent product and service quality. Ultimately, it fosters stable and sustainable business relationships.

ECA is offering a course on this topic and a dedicated one on suppliers from China and India. GMP-Auditors are supported by the European GMP-Auditor Association.