SOP for Vendor Management in Pharma (Example Template)

In short: Vendor management is how a pharmaceutical manufacturer decides who may supply materials and services, keeps proof that each supplier remains suitable, and withdraws approval when it does not. This is an illustrative SOP for QA and procurement staff. Scoring, intervals and sample numbers are example choices that you must justify under your own quality system.

Objective

To set out how a manufacturing site selects, approves, monitors and, where needed, disqualifies vendors of starting materials, packaging materials and GMP-relevant services, so that only suppliers of proven suitability provide materials used in medicines.

Scope

This example covers:

• Vendors of active substances, excipients, primary and printed packaging materials.
• Contract service providers whose work affects product quality (for example contract testing, sterilisation, calibration).
• New vendors, new materials from an existing vendor, periodic requalification, vendor changes and disqualification.

Contract manufacturing is governed in more detail by EU GMP Chapter 7; see EU guideline for outsourced activities. Engineering and general-purpose items with no product impact are outside this scope.

Responsibilities

Regulatory basis in brief

• EU GMP Chapter 5, clause 5.27: selection, qualification, approval and maintenance of suppliers of starting materials, with their purchase and acceptance, must be documented in the pharmaceutical quality system. Oversight should be proportionate to risk, and the supporting evidence for each supplier and material kept.
• 5.28: quality requirements agreed with suppliers, including handling, labelling, packaging, distribution, complaints, recalls and rejection, should be written in a formal quality agreement or specification.
• 5.29: for active substances, supply chain traceability must be established and periodically verified, and audits of manufacturers and distributors are expected, repeated at intervals set by quality risk management. Excipients are controlled based on a formal risk assessment.
• 5.35 and 5.36: the finished-product manufacturer remains responsible for testing starting materials and may use a supplier’s results only under conditions, including identity testing of each batch and periodic confirmation of the supplier’s results.
• 5.45: suppliers of primary and printed packaging get attention similar to starting materials.
• EU GMP Chapter 7 (7.4 to 7.17): the contract giver is ultimately responsible for outsourced activities, must assess the legality, suitability and competence of the acceptor before outsourcing (7.5), monitor its performance (7.7), and have a written contract that allows audit (7.14 to 7.17).
• ICH Q10, section 2.7: the quality system extends to outsourced activities and purchased materials, using quality risk management to assess suitability before selection, define responsibilities in a written agreement, monitor performance, and check that incoming material comes from approved sources.
• ICH Q7, clauses 7.11 to 7.14 (APIs): a system for evaluating suppliers of critical materials, purchase from suppliers approved by the quality unit, knowledge of the original manufacturer, and change control for any change of source.
• 21 CFR 211.84: components must be tested or examined and released by the quality control unit. A supplier’s report of analysis can replace some testing only if the manufacturer runs at least one specific identity test and validates the supplier’s results at appropriate intervals.

Procedure

1. Vendor approval workflow

The overall path for a new vendor, or a new material from an existing vendor, is:

1. Request. The requesting department submits a vendor/material request giving the purpose, required specification and the reason for the new source.
2. Initial screening. QA checks regulatory fit (for example, is the vendor or manufacturing site already named in the registered dossier?) and assigns a risk class.
3. Document review. The vendor completes a questionnaire and submits supporting documents.
4. Qualification activities. Depending on class: paper assessment, audit, sample evaluation and quality agreement.
5. Decision. QA records the approval, a conditional approval with defined actions, or rejection.
6. Listing. Approved vendor and material are entered in the AVL.
7. Monitoring. Performance is reviewed continuously and the vendor is requalified at defined intervals.

A vendor is approved for a specific material and site, not as a whole. Approval of a new material from a listed vendor repeats steps 2 to 6 at the appropriate depth.

2. Risk-based classification

Classify each material-vendor combination before choosing the qualification effort. Chapter 5 clause 5.27 asks for supervision proportionate to the risk of the material, considering its source, manufacturing process, supply chain complexity and final use. A simple example matrix:

When assigning the class, consider: criticality of the material to quality; whether the vendor is the manufacturer or a trader; any history of failures or recalls; country or regulatory oversight of the site; complexity of the supply chain; and the vendor’s ability to implement changes. Record the reasoning, because inspectors will ask how the class was decided.

A scoring system (for example, rating severity, likelihood and detectability and multiplying) is a legitimate tool, but the cut-off scores are the site’s own and must be justified in a quality risk management document.

3. Vendor questionnaire and documents

Send a standard questionnaire, kept short for low-risk vendors and detailed for high-risk ones. Typical content:

• Legal name, address, ownership and the exact manufacturing site(s); whether it manufactures or trades.
• Regulatory status: licences, GMP certificates, inspection history and recent regulator findings.
• Quality system: organisation chart, change control, deviation and complaint handling, internal audits, recall procedure.
• Product-specific information: specification, certificate of analysis format, manufacturing flow, solvents and reagents, impurity and residual solvent controls.
• Supply chain: use of sub-contractors, brokers or additional sites; storage and transport conditions.
• Declarations where relevant: TSE/BSE status, GMO status, nitrosamine risk assessment, elemental impurities, allergen and cross-contamination controls.
• Commitments: notify the customer of changes, allow audits and share complaint investigations.

For active substances, ask for the full supply chain back to the active substance starting materials, because Chapter 5 clause 5.29 expects traceability to be documented and verified periodically.

QA reviews the answers against the requirements for the material, challenges unclear replies, and files the questionnaire with the assessment.

4. Audits

Audit type follows the risk class and the available information.

Audit planning and conduct:

1. Define scope and duration so that a full and clear assessment of GMP can be made (Chapter 5, 5.29). Include cross-contamination risk from other products on site.
2. Use a checklist, but follow the evidence. Look at raw data, batch records and deviations, not only procedures.
3. Issue a report that records what was seen, with clearly classified observations (for example critical, major, minor).
4. Require a written response with corrective and preventive actions (CAPA) within a set time, and track them to closure.
5. Do not approve a vendor with open critical observations.

Third-party audit reports may support a decision, but the manufacturer stays responsible for its own approval.

5. Sample and document evaluation

Before first commercial use, evaluate a representative sample from the proposed vendor:

1. Obtain samples with a certificate of analysis and the vendor’s specification.
2. Test against the site specification and pharmacopoeial requirements. For APIs, ICH Q7 clause 7.31 describes full analysis of at least three batches before reducing in-house testing; for other materials the number of lots is the site’s choice, justified by risk.
3. Where the material is used in a registered product, confirm the specification and source match the dossier, and involve regulatory affairs for any variation.
4. For packaging, add dimensional, functional, print-quality and compatibility checks, and, for primary packaging, confirm that stability data support the new source.
5. For critical changes, consider pilot or exhibit batches and a stability commitment before full approval.

A pass at this stage permits trial use only until the other qualification steps are complete.

6. Reliance on vendor certificates of analysis

Do not accept a vendor’s certificate in place of testing without a reason. Under both 21 CFR 211.84(d)(2) and EU Chapter 5 (5.35), the manufacturer must do at least an identity test on each lot. Periodically, perform a full analysis and compare it with the vendor’s certificate to confirm reliability, and re-assess whenever a certificate discrepancy appears. If the comparison fails, stop accepting certificates until the cause is closed.

7. Approved vendor list

QA maintains the AVL as a controlled document. Each line should hold:

• Material name and internal code, and grade or specification.
• Vendor, manufacturer and manufacturing site (including any trader or broker).
• Risk class, approval date, approval status and next requalification date.
• Any conditions (for example, approved for one site only, or limited quantity).

Procurement may order only from vendors on the AVL, and stores must check the manufacturer name on receipt against the AVL. Chapter 5, clause 5.30, also expects checks of delivery documents and the integrity of containers on every delivery. The AVL is also a specification-related document under EU Chapter 4 (clause 4.14 refers to approved suppliers in material specifications), so keep it consistent with the material specifications.

8. Quality and technical agreements

For high-risk and contract-service vendors, sign a quality (technical) agreement before supply. Chapter 7 expects the contract to define who does each activity (7.15), to keep or give access to records (7.16), and to permit audit (7.17), and it prohibits unapproved subcontracting and unauthorised changes (7.11, 7.12). A quality agreement typically covers:

• Responsibilities of each party for specification, testing, release and storage.
• Notification of changes to process, site, raw materials, test methods and sub-contractors, with notice periods.
• Handling of deviations, out-of-specification results, complaints and recalls.
• Audit rights and access to regulatory inspection outcomes.
• Document retention and data integrity expectations.
• Confidentiality, termination and dispute handling.

For low-risk items, a specification and a supplier declaration may be adequate.

9. Change management at the vendor

Vendors must tell you before they change site, process, key raw materials, equipment, specification or sub-contractors. On notification:

1. QA logs the change under the site change control procedure (see SOP on change control).
2. The impact on specification, registered dossier, stability and finished product is assessed.
3. Additional testing, an audit or a regulatory variation may be needed before accepting the changed material.
4. A change of source for a critical raw material is handled through change control, as ICH Q7 clause 7.14 states.

Unnotified changes found later are a serious quality event and are recorded as a vendor deviation.

10. Ongoing monitoring and periodic requalification

Monitor each vendor continuously and review formally at defined intervals. Inputs include:

• Rejections, out-of-specification results and deviations linked to the vendor.
• Complaints from production or from the market.
• Delivery performance and responsiveness to queries.
• Audit status and CAPA closure.
• Changes notified or discovered.

Requalification intervals are a site decision based on risk. As an example only:

Chapter 5 clause 5.29 only requires follow-up audits “at intervals defined by the quality risk management process” for active-substance suppliers, so these figures are not regulatory minimums.

Requalification outcome: continue approval, continue with conditions, increase monitoring or audit, or start disqualification. An annual vendor performance summary feeds management review under ICH Q10 and the quality review of each product.

11. Disqualification

Start disqualification when, for example:

• A critical observation remains open after the agreed time.
• Repeated quality failures or falsified data are found.
• The vendor refuses audit, hides changes or loses its licence or GMP certificate.
• The vendor fails requalification.

Steps:

1. QA records the reason and the decision, approved by Head QA.
2. Status on the AVL changes to “disqualified” or “on hold” and procurement and stores are informed in writing.
3. Quarantine and evaluate stock held from the vendor and assess the impact on released batches using the deviation and CAPA procedure.
4. Inform regulatory affairs if registered sources are affected.
5. Reinstatement requires a new qualification after documented corrective action.

Records

Keep for each vendor: the request, risk classification, questionnaire, audit plans and reports, CAPA responses, sample test results, agreements, change notices, performance reviews and requalification decisions. Retain them at least as long as batches made with the vendor’s materials remain in the market.

Abbreviations

AVL: approved vendor list. API: active pharmaceutical ingredient. CAPA: corrective and preventive action. GMP: good manufacturing practice. QA: quality assurance. QC: quality control. TSE/BSE: transmissible/bovine spongiform encephalopathy.

Frequently asked questions

Can a trader be on the approved vendor list? Yes, but the actual manufacturer and site must be known and approved too. Both EU Chapter 5 (supply chain traceability for actives) and ICH Q7 (7.13) expect this.

Is a vendor questionnaire enough for approval? For low-risk items it can be. For high-risk materials such as actives and sterile-product components, it is only the first step and should be followed by an audit or equivalent assessment.

Is requalification every three years a regulatory requirement? No. The regulations require periodic oversight proportionate to risk. The interval is the site’s choice and must be justified.

Can we skip testing if the vendor sends a certificate of analysis? Not entirely. At minimum, an identity test is performed on each lot, and the vendor’s results are periodically verified.

What if the vendor will not allow an audit? For GMP-critical materials, treat that as a failed qualification, unless another valid assurance exists. For contracted work, Chapter 7 expects audit rights in the contract.

References

1. European Commission, EudraLex Volume 4, EU GMP Guidelines Part I, Chapter 5: Production, version of 13 August 2014 (in operation from 1 March 2015), clauses 5.27 to 5.36 and 5.45.
2. European Commission, EudraLex Volume 4, Chapter 7: Outsourced Activities, revision 1, June 2012 (in operation from 31 January 2013), clauses 7.4 to 7.17.
3. European Commission, EudraLex Volume 4, Chapter 4: Documentation, revision 1, January 2011, clause 4.14.
4. ICH Q10: Pharmaceutical Quality System, Step 4, 4 June 2008, section 2.7.
5. ICH Q7: GMP Guide for Active Pharmaceutical Ingredients, Step 4, 10 November 2000, section 7.1 (clauses 7.10 to 7.14) and 7.3 (7.30, 7.31).
6. US FDA, 21 CFR 211.84: Testing and approval or rejection of components, drug product containers, and closures.