Vendor Qualification in Pharma: How to Build an Approved Supplier Program

2026-07-19

Vendor (supplier) qualification is the GMP gate that proves a supplier is fit before you buy: risk categorisation, questionnaire, audit, trial batches, the Approved Vendor List, and requalification triggers — and the mistakes auditors find most.

An auditor picks a batch, traces it to the API used, and asks one question: "How did this supplier get approved — show me the evidence you assessed them before you bought a single kilogram?" If the answer is a purchase order and "we've used them for years," you have a finding. Under GMP you are responsible for the quality of everything you buy — and vendor qualification is the documented process that proves you earned the right to trust each supplier before their material ever touched your product.

This guide covers what vendor qualification actually is, how to categorise suppliers by risk, the qualification lifecycle end to end, and how to run it as a controlled program instead of a folder of questionnaires nobody can find at audit time.

Qualification vs. performance: two different jobs

These get confused constantly, so let's separate them:

• Vendor qualification is the quality gate — the one-time (then periodic) assessment that decides whether a supplier is fit to supply at all. It happens before the first purchase.
• Vendor performance is the ongoing scorecard — on-time delivery, rejection rate, complaints — that runs after qualification, over every subsequent order. (We cover that separately in vendor performance tracking.)

You qualify a supplier once to let them in; you track their performance forever to decide whether they stay. Skip qualification and performance data is meaningless — you're grading a supplier you never vetted.

Risk-based categorisation: not every vendor gets the same scrutiny

The depth of qualification should match what the supplier can do to your product. A one-size questionnaire wastes effort on a stationery vendor and under-scrutinises an API maker. Categorise by impact:

This mirrors the logic of equipment qualification: the more a thing can affect product quality, the more evidence you demand before you rely on it.

The vendor qualification lifecycle

Qualification is a loop that runs on every supplier, forever — approve, then keep the approval current:

   +----------------------------------------------+
   |  Identify need + candidate supplier          |
   +----------------------+-----------------------+
                          v
   +----------------------------------------------+
   |  Vendor questionnaire (self-assessment)      |
   |  + licences, GMP cert, DMF, CoA specimens    |
   +----------------------+-----------------------+
                          v
   +----------------------------------------------+
   |  Risk assessment -> category (crit/maj/min)  |
   +----------------------+-----------------------+
                          v
   +----------------------------------------------+
   |  Audit: on-site / remote / desktop           |
   |  (depth set by category)                     |
   +----------------------+-----------------------+
                          v
   +----------------------------------------------+
   |  Sample / trial batches -> QC testing        |
   +----------------------+-----------------------+
                          v
   +----------------------------------------------+
   |  Approve -> add to APPROVED VENDOR LIST       |
   +----------------------+-----------------------+
                          v
   +----------------------------------------------+
   |  Requalify: periodic + on any change/issue   |
   +----------------------------------------------+

1. Vendor questionnaire

The supplier's self-declaration — the starting evidence file. Capture their regulatory licences, GMP/ISO certificates, drug master file references, quality-system overview, sub-supplier controls, and specimen certificates of analysis. This is the data you'll verify at audit, so keep every requirement identifiable and traceable.

2. Risk assessment

Score the supplier on what they supply and the consequence of failure, and assign a category. The category then drives everything downstream — whether an on-site audit is mandatory, how many trial batches you need, and the requalification interval.

3. Audit

The verification step. For critical suppliers this is usually an on-site audit of their facility and quality system; for lower-risk ones a remote or desktop review of documents may suffice. Audit findings become observations to be closed — and a supplier with open critical findings cannot be approved until they're resolved.

4. Sample / trial evaluation

Before full reliance, test what they actually ship: sample or trial batches sent to QC against your specification. Consistent, in-spec results across trials are the practical proof the questionnaire and audit promised. This links directly to your incoming-material checks at goods receipt.

5. Approval and the Approved Vendor List

Approval is a formal, signed decision (typically QA-led) that moves the supplier onto the Approved Vendor List (AVL) — the controlled master of who you are allowed to buy each material from. The AVL is the single most audited artifact of the whole program: purchasing should not be able to raise a PO for a critical material against a vendor who isn't on it.

Requalification: approval has a shelf life

A vendor approved in 2024 is not automatically approved today. Two triggers reopen qualification:

1. Periodic requalification — a risk-based interval (e.g. critical suppliers every 1–2 years, lower risk less often) to confirm nothing has drifted.

2. Change- or event-driven requalification — a supplier changes their manufacturing site, process, or ownership; or their performance degrades (repeated rejections, a market complaint, a recall). This is the bridge to change control: a change at a qualified supplier must trigger an assessment of whether they're still qualified.

Miss this and you get the classic finding: a supplier beautifully qualified years ago, who has since moved factories, with no reassessment on file.

The gaps auditors find most often

Running it as a workflow, not a filing cabinet

The content of vendor qualification is well understood. What breaks is the management — questionnaires in email, audit reports in a shared drive, the AVL in a spreadsheet that purchasing doesn't check, and requalification dates that live in someone's memory. At audit it becomes an archaeology exercise to prove a single supplier's approval basis.

As a controlled workflow, each supplier becomes a record that moves through defined stages with the right owners and evidence captured as you go:

  Questionnaire received
      |
      v
  Risk assessment -> category assigned (QA)
      |
      v
  Audit executed -> findings logged & closed
      |
      v
  Trial batches -> QC results attached
      |
      v
  Approval (QA sign-off) -> AVL updated
      |
      v
  Approved status  <-- periodic + change-triggered requalification
                       (auto-reminders before due dates)

Done this way, every supplier has a status and an owner, the AVL is a live source of truth that purchasing checks before raising a PO, requalification dates raise their own reminders, and any change control on a supplier points straight back at their qualification record. It's the same discipline a modern pharma quality management system applies to deviations and CAPAs — applied to the supply base, and expected under revised Schedule M.

The takeaway

Vendor qualification is one continuous argument: we assessed this supplier's quality system (questionnaire), matched the scrutiny to the risk (categorisation), verified it in person or on paper (audit), proved their material meets spec (trials), formally approved them (AVL), and we keep that approval current (requalification). Build that chain once, enforce the Approved Vendor List in purchasing, and the auditor's "how did this supplier get approved?" stops being a scramble and becomes a two-minute pull of a complete, linked record.

Frequently Asked Questions

What is vendor qualification in pharma?

Vendor (or supplier) qualification is the documented GMP process of assessing a supplier before you rely on them, to prove they are capable of consistently supplying material or services that meet your quality requirements. It typically runs through a vendor questionnaire, a risk-based categorisation, an audit (on-site or desktop depending on risk), and trial-batch testing, ending in a formal QA approval that adds the supplier to the Approved Vendor List. It is required for suppliers of APIs, excipients, packaging, and outsourced GMP activities.

What is the difference between vendor qualification and vendor evaluation?

Qualification is the one-time (then periodic) gate that decides whether a supplier is fit to supply at all — done before the first purchase. Vendor evaluation (or performance monitoring) is the ongoing scorecard — on-time delivery, rejection rate, complaints — that runs over every order after qualification. You qualify a supplier once to let them in, and evaluate their performance continuously to decide whether they stay.

What is an Approved Vendor List (AVL)?

The Approved Vendor List is the controlled master document that records which suppliers are approved to supply each material or service. It is the enforced control point of the whole program: purchasing should not be able to raise a purchase order for a critical material against a supplier who is not on the AVL. Auditors examine it closely because it links a qualified supplier to the materials they are actually allowed to provide.

Is a supplier audit always required to qualify a vendor?

No — the depth is risk-based. Critical suppliers (APIs, key excipients, primary packaging, contract manufacturers and labs) usually require an on-site audit of their facility and quality system. Lower-risk suppliers may be qualified through a desktop or remote review of documents (licences, GMP certificates, certificates of analysis) plus a questionnaire. The category assigned during risk assessment determines whether a physical audit is mandatory.

How often should vendors be requalified?

Requalification is risk-based and event-driven. Critical suppliers are commonly requalified every one to two years, with lower-risk suppliers on longer intervals. Beyond the periodic cycle, requalification should also be triggered by any significant change at the supplier — a new manufacturing site, process or ownership change — or by degraded performance such as repeated rejections, a market complaint, or a recall.