How do life sciences companies qualify their suppliers so that critical materials are secured in a GMP-compliant and audit-proof way?
We build structured supplier qualification programs, from risk-based initial assessment through quality agreement and audit to ongoing performance monitoring and requalification. Suppliers are part of your quality system, not an external procurement line item. The most expensive mistake is not the unqualified supplier, but the single-source supplier whose alternative you only decide to qualify once it has already failed.
- Pharma
- Biotech
- MedTech
- IVD
Overview
Why is supplier qualification regulatorily critical in life sciences?
Complete qualification programs across all four domains · ISO 13485:2016, EU GMP Guide Chapters 5 & 7, ICH Q10
Last updated: 2026-06-13
Suppliers of critical materials and outsourced activities are part of the manufacturer's quality system and therefore part of its regulatory risk. Both ISO 13485:2016 for medical devices and the EU GMP Guide for medicinal products require a formal, traceable qualification status. Four points determine whether a program holds up in an audit:
- ISO 13485:2016 requires defined evaluation and selection criteria for suppliers and a level of monitoring proportionate to the impact of the purchased product on the finished product. The depth of qualification must be justified on a risk basis.
- For outsourced activities, the EU GMP Guide (EudraLex Volume 4) requires in Chapter 7 a written contract between the contract giver and the contract acceptor that defines the respective GMP responsibilities. The quality agreement is not an add-on but a mandatory document.
- ICH Q10 and ICH Q9 embed supplier management within the pharmaceutical quality system: supplier selection and monitoring follow documented quality risk management, not pure procurement logic.
- Single-source dependencies without a qualified alternative are both a supply and a compliance risk: changing suppliers is a change-controlled activity that cannot be qualified ad hoc without lead time.
Services
How we support you
Supplier Assessment & Qualification Process
Design and implementation of a complete assessment and qualification process: criticality and risk assessment, qualification checklist, quality agreement and a documented approval and requalification cycle in line with ISO 13485:2016 and EU GMP Guide Chapters 5 and 7.
Supplier Audits & Development Visits
Conduct of qualification and surveillance audits at critical suppliers. The output is a findings report with findings classified by severity and concrete CAPA recommendations; development visits address suppliers with improvement potential.
Learn more →Supplier Performance Management
Build-out of a supplier performance rating system with defined KPIs for delivery quality, on-time delivery and regulatory compliance, escalation processes for weak performers and systematic trending as an early warning, designed to connect to ICH Q10.
Alternate-Source Qualification
Strategic qualification of alternative and backup suppliers for single-source risks, including parallel qualification and the change management planning that a supplier switch triggers from a regulatory standpoint.
Learn more →Quality Agreements
Drafting and negotiation of binding quality agreements in line with EU GMP Guide Chapter 7: product specifications, change notification obligations, audit rights, complaint and deviation management as well as the delineation of GMP responsibilities.
How we work together
What it comes down to
Suppliers are not an external procurement line item but a part of your quality system. Both ISO 13485:2016 for medical devices and the EU GMP Guide for medicinal products therefore require not a blanket process but a risk-based depth: the criticality of a material determines whether a questionnaire assessment is sufficient or an on-site audit is required, how often requalification takes place and how tightly the quality agreement under Chapter 7 governs change notification. Reversing this order, qualifying first and justifying criticality afterwards, leads to assessing non-critical suppliers with too much effort and the truly critical ones too superficially.
The sore point is rarely the unqualified supplier, but the single-source supplier without a qualified alternative. Changing suppliers is a change-controlled activity that triggers parallel qualification and change management and therefore needs lead time. Once the only source fails, that lead time is no longer available. This is why alternate-source qualification belongs not at the end of the program but in the risk assessment at the start, where supply and compliance risk can be mitigated with lead time rather than in the middle of a shortage.
Our approach
Our approach
Step
Result
Criticality & Risk Assessment
Classified supplier list with justified criticality that derives qualification depth and audit frequency on a risk basis.
Qualification & Quality Agreement
Completed initial qualification with questionnaire assessment or audit and a signed quality agreement in line with Chapter 7.
Supplier Audit
Findings report with findings classified by severity and a CAPA plan; in the case of critical findings, a documented supply hold.
Approval & Supplier Release
Formally approved supplier with documented qualification status in the approved vendor list.
Performance Monitoring
Ongoing KPI rating with trending and defined escalation levels for weak performers.
Requalification & Alternate Source
Planned requalification cycle and a qualified backup source for critical single-source materials.
Common pitfalls
Where projects commonly fail
The criticality assessment is missing or unjustified.
Treating all suppliers the same means assessing non-critical ones too deeply and critical ones too superficially. ISO 13485:2016 requires monitoring proportionate to the impact on the finished product. Without a documented risk justification, this gap surfaces in the audit.
The quality agreement is missing or does not reflect the actual responsibilities.
EU GMP Guide Chapter 7 requires a written contract defining the GMP obligations of both parties; without a clear change notification obligation, the manufacturer often learns of the supplier's specification or process changes only after goods receipt.
Single-source suppliers are run without a qualified alternative.
If the source fails, a backup supplier cannot be qualified ad hoc. Qualification and the associated change management need lead time that is no longer available once a shortage hits.
Audits are conducted sporadically and without a program.
Without a risk-based audit frequency and requalification cycle, qualification statuses become outdated, which an inspector immediately recognizes as a systemic gap.
Findings from supplier audits fizzle out without CAPA follow-up.
A finding without a classified severity, deadline and follow-up is regulatorily worthless; the CAPA effectiveness check must be documented and available by the next audit.
FAQ
Frequently asked questions
Sources
- ISO 13485:2016: Quality management systems for medical devices (purchasing)
- EU GMP Guide (EudraLex Volume 4), Chapter 5 (Production) and Chapter 7 (Outsourced Activities): primary text
- ICH Q10 (Pharmaceutical Quality System) and ICH Q9 (Quality Risk Management)
- Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR)
- Writer material Supplier Development & Qualification (source material, revised)
- https://theentourage.de/expertise/supplier-development-qualification/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (QM system for medical devices, purchasing)
- EU GMP Guide (EudraLex Volume 4), Chapter 5 (Production)
- EU GMP Guide (EudraLex Volume 4), Chapter 7 (Outsourced Activities)
- ICH Q10 (Pharmaceutical Quality System)
- ICH Q9 (Quality Risk Management)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- 21 CFR Part 820 (FDA Quality System Regulation, Purchasing Controls)
Related topics
Supply Chain Governance →
Overarching supply chain control beyond the qualification of individual suppliers
GxP Audits (GMP, GLP, GCP) →
Conduct of GxP supplier audits in detail
CAPA Management →
Working through CAPAs following supplier findings
Managing Supply Shortages →
Alternate-source strategy and supply assurance for single-source risks
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences