A Risk-Based Approach to Auditing and Qualifying Suppliers and Vendors


Qualifying vendors and suppliers is a serious process. Manufacturers are responsible for compliance from their selected suppliers and vendors, and any violations by vendors can cause serious problems for manufacturers. Manufacturers must have assurance that their suppliers and vendors will not be the source of major issues.  As such, it is incumbent on manufacturers to ensure processes are in place to control outsourced activities and the quality of purchased materials.

Qualifying Vendors and Suppliers

The U.S. Food and Drug Administration (FDA) requires that all suppliers and vendors undergo a qualification process, including having standard operating procedures (SOPs) in place for performing the qualifications. All vendors and suppliers are required to meet the manufacturer’s quality expectations by aligning with the manufacturer’s quality management system (QMS). If a supplier or vendor fails to meet the manufacturer’s quality standards, the vendor may be disqualified. 

The process of qualifying a supplier or vendor should incorporate quality risk management and include:

  • Assessing prior to outsourcing operations or selecting material suppliers – this involves evaluating the suitability and competence of the other party to carry out the activity or to provide the material using a defined supply chain.
  • Defining the responsibilities and communication processes in a written agreement between the contractor (the manufacturer) and the vendor.
  • Monitoring and reviewing the performance of the service provider or the quality of the materials from the provider and identifying and implementing any essential improvements.
  • Monitoring incoming ingredients and materials to ensure they are from approved sources using the agreed-upon supply chain

It is essential that the manufacturer select and maintain sufficient oversight of the vendor’s/supplier’s operations to ensure that it is fully Current Good Manufacturing Practice (CGMP) compliant. Regardless of whether a manufacturer relies on a contract facility, the manufacturer is responsible for assuring that drugs introduced into interstate commerce are neither adulterated nor misbranded.

Since qualifying vendors and suppliers is serious business, #manufacturers must ensure that processes are in place to control sourced activities and maintain quality of materials, says @MCMasterControl http://bit.ly/2zSNbQX

Auditing Vendors and Suppliers

Just as manufacturers must audit their suppliers and vendors to assure the vendors’ and suppliers’ QMSs and quality philosophies align with the manufacturer’s. Audits are used to review the vendor’s and supplier’s total quality system, to understand vendor and supplier capabilities, and to address issues needing corrective and preventative action (CAPA) or improvement.

Types of Vendor and Supplier Audits

There are four types of audits that manufacturers can perform to qualify their vendors and suppliers:

  • New vendor/supplier assessment
  • Process/scheduled audit
  • Development audit
  • Verification/follow-up audit

New vendor/supplier assessments focus on getting a general overview of the vendor’s or supplier’s quality systems. A manufacturer should have a good idea of the vendor’s or supplier’s quality management system and how procedures and processes are carried out after this assessment. As part of this audit, the manufacturer should request a tour of the facility and review the company’s organizational chart and basic operational SOPs.

Process/scheduled audits use either a GMP- or an ISO-style audit checklist and are designed to review quality processes, procedures, and systems. This is an in-depth audit of the entire facility. When a manufacturer schedules an audit with the vendor or supplier, the manufacturer then sends the vendor or supplier an audit plan, so the vendor/supplier can prepare for the audit. The schedule will include arrival time, a time for the opening meeting, a time for the facility tour, and a list of the documents to be reviewed. The audit plan allows the vendor/supplier to prepare for the audit and have the necessary documents and personnel in place so that the audit runs smoothly and efficiently. When scheduling the audit, the manufacturer should keep the vendor’s or supplier’s business in mind. The manufacturer is there to get a bird’s-eye view of the operation and to assess the quality of goods and services it will be receiving, not to tie the supplier up and hinder its production.

A development audit focuses on areas that need specific improvement and may address a CAPA. This audit is performed after a new vendor/supplier audit or a scheduled audit and typically occurs when observations have been made that need correcting. The vendor should have sent a CAPA to the manufacturer upon receiving an audit report. Once on-site, the manufacturer is there to observe that the CAPA has been implemented and that the issues are in the process of being resolved.

A verification or follow-up audit is performed to address the implementation of a corrective action to ensure compliance with regulations. During this type of audit, the manufacturer is on-site to ensure a corrective action has been implemented and is in compliance with CGMPs or the applicable ISO requirements. The manufacturer is there to observe the corrective actions only, not the vendor’s or supplier’s overall operation.

Proper Audit Conduct

Always schedule the audit by contacting the vendor/supplier. This gives the manufacturer an opportunity to observe how the vendor or supplier responds to the proposed audit. Hesitation or a sense of unwillingness to schedule the audit by the vendor should be a red flag to the manufacturer; suppliers should welcome the manufacturer and have no problems scheduling an audit. Make sure there are no misunderstandings, and that the vendor/supplier understands the reason for the audit, before ending the call. Allow the vendor ample time to prepare for the audit. The vendor/supplier will need time to receive the audit schedule and to have the appropriate documents in place and readily available. Inform the vendor or supplier who the lead auditor will be and what resources will be required for the audit. It is important that the vendor/supplier know the audit is being performed as a qualification per the manufacturer’s policies, not as an attempt to find things wrong or to “catch them.” Let the vendor know the manufacturer views this as a partnership that is in place to benefit both parties.

Making Observations

Once on-site, be sure to take notes and ask questions for clarification. Don’t make assumptions; always ask if a situation seems noncompliant. If an observation is made, be sure to back it up with details, including what the noncompliance was, where it was observed, what time it was observed, and what personnel were involved. The supplier needs to know it is a legitimate observation. If an SOP or policy was violated, be sure to reference the document upon making the observation.

Upon making observations, be sure to classify them as minor, major, or critical. The vendor/supplier must understand the level of importance of the observation.

white paper icon

Enjoying this article? You may also enjoy this White Paper:

How to Successfully Manage Your Suppliers and Ensure Product Safety and Compliance

Download Free White Paper

A minor observation is any non-conformance or non-compliance that if allowed to continue has a low risk of affecting product quality. The observation represents limited or minor gaps in one or more quality systems.

A major observation is any non-conformance or non-compliance that if allowed to continue has a moderate risk of adversely affecting product quality. The observation represents significant gaps in one or more quality systems.

A critical observation is any non-conformance or non-compliance that already has or if allowed to continue presents high risk of adversely affecting product quality. The observation represents the complete absence or systematic lack of one or more quality systems. The observation is a repeated major observation or one that fails to meet a commitment of a regulatory authority.

Closing the Vendor/Supplier Audit

Once the manufacturer has completed the audit, a closing meeting should be held to make the vendor/supplier aware of any observations noted during the audit. It is also necessary to clarify any questions from the manufacturer to the vendor or supplier and vice versa. The manufacturer will want to share all the findings from the audit, including all observations so the vendor/supplier is not surprised once it receives the audit report. This meeting is also a place to let the supplier know what it is doing right. End the meeting on a positive note by letting the vendor/supplier know that despite a few observations, there are good things being done and that the manufacturer expects CAPAs to be put in place and the observations to be resolved quickly.

Having SOPs and policies in place is essential for a #manufacturer to interact with suppliers and vendors. Audits and quality assurance assessments will help ensure that quality materials and services are delivered, says @MCMasterControl http://bit.ly/2zSNbQX


Qualifying vendors and suppliers can be challenging due to differences in philosophies. However, it is necessary because the manufacturer is ultimately responsible for the goods and services received from the vendor or supplier. Having SOPs and policies in place for interacting with vendors and suppliers is essential. Knowing what services will be performed by the vendor and implementing quality assurance assessments will ensure quality from that vendor. Even though extensive travel may be involved, performing on-site audits of the vendor or supplier is a necessity so that the manufacturer can see the actual activities carried out by the supplier at its site. This provides an opportunity to make observations and to request corrective actions before signing a contract for services. Performing an on-site audit is beneficial not only to the manufacturer receiving goods and services, but also to the vendor/supplier as it helps both parties come together as partners and work together to improve and maintain compliance.


2018-bl-author-joys-mcelroyJoy McElroy earned a degree in zoology at North Carolina State University after which she entered the pharmaceutical industry in 1992 at Pharmacia & UpJohn performing Environmental Monitoring and Sterility Testing.  In 1998, McElroy moved to Wyeth Lederle and worked in quality assurance, performing GMP compliance audits, batch record reviews, and holding annual GMP training for new employees. After working in quality assurance for a few years, she moved into equipment qualification and cleaning validation at Mallinckrodt.

With 16 years of experience as a consultant, and over 25 years total experience in the pharmaceutical and biotech industries, McElroy has gained extensive knowledge of quality assurance, process and cleaning validation, and equipment qualification. She has consulted for numerous companies such as Novartis, Mallinckrodt, Wyeth Lederle, Merck, BioMerieux, Catalent, and Phillips Medisize. McElroy is an expert in quality assurance auditing, analytical and manufacturing equipment qualifications, cleaning validation, process validations, and CGMP compliance. She also provides compliance training in the form of webinars and seminars to various clients and individuals.

In 2013, McElroy founded her own company, Maynard Consulting Company, which provides engineers, auditors and validation and quality assurance specialists to pharmaceutical, biotech and medical device clients across the United States, Canada, and the world.