How to Qualify a Pharmaceutical Supplier: A Risk-Based Due-Diligence Checklist

Key takeaways

• A supplier's price, website or certificate alone cannot establish suitability. The assessment should connect the supplier's identity, the actual manufacturing site, the material or service, its intended use, and the buyer's market requirements.
• Assessment depth should follow risk. An API, an excipient, a printed packaging component and a contract manufacturer do not need the same review.
• A distributor can be a legitimate supplier, but the buyer may still need to know who manufactures the material and which supply-chain steps are involved.
• GMP certificates, inspection reports and CoAs are evidence to read carefully, not a complete qualification.
• Qualification is not a one-time onboarding task: define what triggers a review after approval.

1. A supplier can look qualified and still be the wrong choice

Two suppliers offer the same material. One is cheaper and answers quickly. Both send a company profile and a folder of certificates.

That is the point where many assessments stop, and it is where the real questions begin. Who actually manufactures the material? At which site? Does each document cover that site and that product? What happens when the process changes, a batch fails, or a subcontractor is replaced?

The question this guide answers is: what evidence should a pharmaceutical company review before approving a supplier, and how much review is appropriate for each type of supplier?

One principle first. A missing document is not proof that a supplier is unsafe. It is a gap that needs to be explained, and the size of the gap should be judged against the risk of the material and its use.

2. First define what is being qualified

Before requesting any document, be precise about what you are buying and why it matters.

2.1 Classify the product or service

Qualification differs by supplier type. Treat these separately:

• Active pharmaceutical ingredients (APIs)
• Excipients
• Starting materials and intermediates
• Primary packaging materials
• Printed packaging materials
• Contract manufacturing or testing services
• GMP-relevant services such as equipment maintenance and calibration

2.2 Establish the intended use

Ask:

• Does the material contact the product directly?
• Is it part of the registered product or process?
• Could a defect affect patient safety, identity, strength, purity or packaging integrity?
• Does the service affect a GMP-controlled activity or a quality decision?
• Which market and product requirements apply?

2.3 Set the depth according to risk

One checklist cannot be applied identically to every vendor. The assessment should reflect the material's source, the manufacturing process, the complexity of the supply chain and the intended use. EU GMP expects the selection, qualification, approval and maintenance of suppliers of starting materials to be documented as part of the pharmaceutical quality system, with a level of supervision proportionate to the risks posed by the material, taking account of its source, manufacturing process, supply-chain complexity and final use (EudraLex Volume 4, Part I, Chapter 5, section 5.27). The European Medicines Agency's questions and answers on GMP and GDP describe audits and other evidence as part of a risk-based approach to active-substance suppliers.

A simple decision path. Work through four questions in order: what is the supplier's role, how will the material or service be used, what is the risk to quality or patients if it fails, and therefore how deep should the assessment be. Depth runs from document review, to a questionnaire, to a remote assessment, to an on-site audit; higher risk moves you further along that scale.

3. Confirm the supplier's identity and actual role

A buyer should know whether the company they are talking to is the manufacturer, an authorised distributor, an agent or a broker.

3.1 Verify the legal entity

Request or confirm:

• Registered company name and address
• Company registration details, where relevant
• Official website and business contact details
• The relationship between the contracting entity and the manufacturing site

3.2 Identify the actual manufacturing site

For relevant materials, confirm:

• Name and address of the manufacturing site
• Which operations take place there
• Whether the site named in a certificate or audit report is the site that supplies the material
• Whether any manufacturing steps are outsourced

For critical materials, ICH Q7 (section 7.13) expects an API or intermediate manufacturer to know the name and address of the manufacturer when the supplier of a critical material is not the manufacturer.

3.3 Map intermediaries and supply-chain steps

Ask the supplier to disclose the relevant parties involved in manufacturing, repackaging or relabelling, testing and release, storage, and transport and distribution.

Note. A distributor may be an appropriate supplier. The buyer may still need visibility of the original manufacturer and of the relevant supply-chain steps.

4. Review regulatory and quality evidence carefully

This section is about what documents can tell a buyer, and what they cannot establish alone.

4.1 Build a document request list that fits the supplier

Possible evidence includes:

• Applicable manufacturing, import or distribution authorisations
• GMP or GDP evidence, where relevant
• Relevant inspection information or certificates
• Product- and site-specific documentation
• A quality-management-system overview
• A recent audit report or an audit-status summary
• A list of relevant subcontractors
• Product specification and a sample Certificate of Analysis (CoA)
• Procedures for complaints, recalls, deviations and change notification

This is not a universal mandatory list. The evidence required depends on the supplier type, the material, the market and the risk.

4.2 Check scope, site, validity and product coverage

For each document, ask:

• Does it identify the correct legal entity and site?
• Is the supplier's role covered?
• Does the scope cover the relevant product or activity?
• Is it current?
• Are there limitations, exclusions or conditions?
• Can the buyer verify it with the issuing authority or database?

Where an authority publishes a database, use it. Examples in the EU context include the Union database of manufacturing and import authorisations, wholesale distribution authorisations and GMP certificates (EudraGMDP), and, for substances with a Certificate of Suitability, the EDQM certification database. Other markets have their own registers; verify directly with the issuing authority rather than relying on a copy supplied by the vendor.

4.3 Treat certificates and inspection history as evidence, not a full qualification

A certificate or inspection can be useful input. It may not cover the buyer's specific product, site, supply chain or quality risks. EMA explains that inspection reports or GMP certificates can inform a manufacturer's assessment and audit priorities, but do not by themselves fulfil all of the manufacturer's responsibilities for active-substance suppliers.

A related point for regulatory dossiers: a Drug Master File (DMF) or Certificate of Suitability (CEP) reference shows that a file exists and who holds it. It is not an approval of the supplier for your product. The U.S. FDA states that DMFs are neither approved nor disapproved and that it reviews their technical content in connection with the applications that reference them. The EDQM states that a CEP is neither equivalent to a GMP certificate nor does it replace it, and that it does not guarantee that a batch of the substance is of suitable quality.

4.4 Check quality-system maturity

Look for clear procedures and ownership for deviations and investigations, OOS/OOT results where applicable, CAPA, change control, complaints and recalls, document and data management, training and personnel qualification, and control of suppliers and subcontractors.

Table 1 — Evidence and what it can establish

5. Evaluate product-specific quality controls

Here the article moves from reviewing the company to assessing the actual material or service.

5.1 Compare the offered material with the required specification

Confirm the material name and grade, any compendial or other standard that applies, the specification and test methods, the manufacturing site and material origin, the packaging configuration, storage and transport conditions, retest or expiry information, and whether the offered grade suits the intended use.

5.2 Review the CoA and batch-documentation model

Check whether the CoA identifies the specific batch, reports results against the agreed specification, identifies the testing site where relevant, is approved by an authorised person, matches the agreed methods and limits, and can be linked to the delivered batch and its labels.

ICH Q7, section 7, describes approved suppliers, agreed specifications, evaluation of critical-material suppliers and controls for receipt, quarantine, testing and acceptance of materials. It also allows a supplier's CoA to be used in place of some other testing only where the manufacturer has an appropriate system to evaluate suppliers. Relying on a CoA does not remove the expectation to verify the identity of each batch of material, subject to the limited exceptions the guidance itself describes (sections 7.30 and 7.32).

5.3 Address traceability and batch identity

Ask how the supplier maintains manufacturer and site identity, batch and lot traceability, the link between test results and shipped batches, controls for mixed batches, repackaging or relabelling, and records for nonconforming or rejected material.

5.4 Assess packaging-specific risks

For primary and printed packaging, evaluate the correct material and specification, identity and batch traceability, artwork and version control for printed components, controls against mix-ups, substitution, damage or unauthorised access, and notification of changes to composition, printing or manufacturing site.

EU GMP asks that suppliers of primary and printed packaging materials receive attention similar to that given to starting materials, that printed materials be stored securely to exclude unauthorised access, and that each delivery or batch carry a specific reference number or identification mark (Chapter 5, sections 5.45 to 5.47). This is one jurisdiction's example, not wording every market shares.

5.5 Do not forget excipients

Excipients are often treated as low risk by default. In the EU, manufacturers of medicinal products are expected to ascertain appropriate GMP for excipients using a formalised risk assessment. This follows from the second paragraph of Article 46(f) of Directive 2001/83/EC and is detailed in the Commission guidelines of 19 March 2015. As a general risk-based practice, the excipient's source, manufacturing process and intended use should guide the depth of the assessment.

6. Assess audits and other methods

6.1 Decide whether an audit is appropriate

Consider the material or service risk, the complexity of the site and supply chain, existing inspection or audit evidence, supplier performance history, serious quality events or unresolved findings, and whether the supplier performs a critical outsourced activity.

6.2 Choose the assessment method

Possible methods: document review, supplier questionnaire, remote assessment, on-site audit, and reliance on a qualified third-party audit where appropriate and permitted.

These are not interchangeable in every situation. In the EU context, EMA states that inspectorates are not generally in favour of paper-based audits, because they do not provide the same level of assurance as on-site assessment and cannot replace on-site audits of active-substance suppliers, although they can be a useful interim and temporary measure within the manufacturer's audit programme (EMA Q&A).

6.3 Define the audit scope in advance

Typical areas: quality system, relevant manufacturing or testing operations, materials and contamination control, data and documentation practices, deviation, CAPA and change-control systems, outsourced activities, storage, handling and distribution, and prior audit findings with their corrective actions.

6.4 Review findings and follow up

Document the findings and their potential impact, the root-cause and corrective-action evidence, open actions with due dates, whether a follow-up assessment is needed, and whether the supplier may be conditionally approved.

7. Qualify contract manufacturers and service providers

Keep this separate from raw-material qualification.

7.1 Confirm the scope of work

Document which party is responsible for manufacturing or testing steps, sampling and testing, batch documentation and review, deviation and OOS investigations, change notification and approval, complaints and recalls, record retention and access, and support during regulatory inspections.

7.2 Use a quality agreement where appropriate

For contract drug manufacturing under US requirements, FDA guidance (November 2016) describes quality agreements as a way for the parties to define, establish and document manufacturing activities and responsibilities under CGMP. EU GMP Chapter 7 addresses outsourced activities through a written contract between contract giver and acceptor. A template or a contract clause does not replace due diligence or either party's own obligations.

7.3 Check subcontracting and technical capability

Which activities are subcontracted? Are subcontractors disclosed and assessed? Can the contractor support the scale and product lifecycle? Are equipment, facilities and technical capabilities suitable? Can the contractor provide records and support during an investigation or inspection?

8. Evaluate delivery capability and supply risk

A supplier can have acceptable quality documentation and still be a poor operational fit.

8.1 Capacity and continuity

Ask about available capacity and lead times, minimum order quantities, production and testing bottlenecks, business-continuity arrangements, alternate manufacturing or distribution locations, and recovery plans for disruption.

8.2 Storage and transportation

Check required storage conditions, shipment monitoring and excursion handling, packaging and seal integrity, transport subcontractors, delivery records and traceability, and controls during repackaging or intermediate storage. For wholesale distributors of medicinal products in the EU, GDP guidance (section 5.2, "Qualification of suppliers") expects wholesalers to obtain medicinal products only from persons who hold the appropriate authorisation. This applies to the distribution of medicines; distribution of active substances is covered by separate EU guidelines, which expect active substances procured from an EU manufacturer, importer or distributor to come from one registered under Article 52a of the Directive, and other materials such as excipients and packaging follow their own routes.

8.3 Commercial and communication factors

Assess response time and technical support, forecast and order-commitment practices, complaint handling, escalation contacts, payment and contractual terms, and the clarity of change notifications. Treat cost as one selection factor among quality, reliability, capability and fit.

9. Turn the evidence into a documented decision

9.1 A practical status model

This is a suggested internal model, not a universal regulatory classification.

9.2 Score risk consistently

Table 2 — Example scoring categories

Rate each low, medium or high, but define your own thresholds and escalation rules. A single high rating in a critical category can outweigh good scores elsewhere.

9.3 Keep the qualification record

The file should capture supplier and site identity, the product or service in scope, the risk assessment and its rationale, documents reviewed, audit and inspection evidence considered, open actions and approvals, the approval date and review date, and the owner of periodic review.

10. Monitor the supplier after approval

Supplier qualification is not a one-time onboarding task.

10.1 Performance indicators

Rejected or nonconforming batches, deviations or complaints, on-time delivery, documentation errors, change-notification performance, CAPA closure and recurrence, and audit findings with overdue actions.

10.2 Review triggers

Reassess when there is a manufacturing-site change, a new distributor or subcontractor, a significant process or specification change, a serious quality event or recall, repeated delivery problems, or a major change in the material's intended use or product risk.

For API suppliers, ICH Q7 (section 7.14) expects a change in the source of supply of critical raw materials to be handled through change control (its Section 13).

11. The supplier due-diligence checklist

Use this list as a working checklist. For each line, record the evidence reviewed, an owner, a risk rating, any action required and a due date.

1. Supplier identity and role

• Registered legal entity name and address confirmed
• Company registration details checked (where relevant)
• Role confirmed: manufacturer / authorised distributor / agent / broker
• Relationship between contracting entity and manufacturing site documented

2. Actual manufacturer and site

• Name and address of the manufacturing site obtained
• Operations performed at the site identified
• Site on certificates/audit reports matches the supplying site
• Outsourced manufacturing steps identified

3. Regulatory and quality evidence

• Applicable manufacturing / import / distribution authorisations obtained
• GMP or GDP evidence checked for scope, site, date and conditions
• Documents verified with the issuing authority or database
• Quality-system overview reviewed (deviations, OOS/OOT, CAPA, change control, complaints/recalls)
• Subcontractor list obtained and assessed

4. Product specification and batch documentation

• Offered material compared with required specification and grade
• Test methods and limits agreed
• Sample CoA identifies batch, testing site, methods and approving person
• Packaging, storage, transport and retest/expiry information confirmed
• Packaging materials: artwork/version control and mix-up controls reviewed (if applicable)

5. Supply-chain traceability

• Manufacturer and site identity maintained through the supply chain
• Batch/lot traceability and link between test results and shipped batches
• Repackaging / relabelling / mixed-batch controls
• Handling of nonconforming or rejected material

6. Audit or assessment

• Assessment method chosen with risk rationale (document / questionnaire / remote / on-site / third-party)
• Audit scope defined in advance
• Findings, root cause and corrective actions reviewed; open actions have owners and dates

7. Capacity, delivery and continuity

• Capacity, lead times and minimum order quantities confirmed
• Business-continuity and alternate-site arrangements reviewed
• Storage, shipment monitoring and excursion handling reviewed
• Change-notification and complaint-handling arrangements agreed

8. Open gaps and follow-up actions

• Gap list with owner, control and deadline

9. Qualification decision and approval date

• Decision recorded: approved / conditionally approved / rejected or on hold
• Approval date, scope of approval and next review date recorded
• Review triggers defined (site change, new subcontractor, serious quality event, intended-use change)

12. Common qualification mistakes

• Treating an ISO or GMP certificate as proof of every relevant capability
• Assessing the distributor but never identifying the actual manufacturer
• Accepting a generic CoA without confirming batch, site, specification and test details
• Using the same audit depth for every supplier
• Assuming a questionnaire alone establishes suitability
• Failing to assess subcontracted operations
• Approving a supplier without a documented rationale
• Failing to reassess after a significant change

13. Using PharmaCountry in the process

A supplier directory helps with the first steps of this guide: finding candidates, seeing which products and dosage forms a company lists, and identifying the country and role it declares. It does not replace any of the verification above.

• Start from the product or dosage form: Finished Dosage Forms, then narrow by country, for example finished dosage forms made in India.
• For other supplier types, browse Active Pharmaceutical Ingredients, Excipients & Additives, Packaging Materials and Contract & Outsourcing Services.
• Open the company profile and compare what it declares with the documents you request: legal entity, site, role, and listed products.
• Treat the data as a starting list. In PharmaCountry's own October 2026 snapshot, only 51.3% of finished dosage manufacturer profiles (2,780 of 5,415) named a specific dosage form, and records enter the database from several kinds of source. That is a finding about this database, not about the market; see the Global Finished Dosage Manufacturing Landscape 2026 report.

Important. A company profile or listing on PharmaCountry is not a GMP approval, a qualification or a verification of the supplier's licences, and should not be used as one. Qualification remains the responsibility of the buyer's quality unit.

Suppliers can help buyers by keeping their profile specific: the legal entity, manufacturing sites, roles, dosage forms or product categories, and contact details.

Frequently asked questions

What is pharmaceutical supplier qualification? It is the documented process by which a pharmaceutical company decides whether a supplier of materials or services is suitable for a stated use, based on evidence proportionate to risk, and keeps that decision under review.

Is a GMP certificate enough to approve a pharmaceutical supplier? No. A certificate is useful evidence, but it may not cover your product, the site that supplies you, or the supplier's supply chain. Read its scope, date and conditions, and verify it with the issuing authority.

Should a buyer qualify a distributor or the original manufacturer? Often both. A distributor can be an appropriate supplier, but you may still need to know who manufactures the material, at which site, and which steps (repackaging, storage, transport) the distributor controls.

When should an active-substance supplier be audited? That depends on risk and on the requirements of your market. In the EU context, EMA states that paper-based assessment cannot replace on-site audits of active-substance suppliers (EMA Q&A). Have your QA or regulatory function confirm what applies to you.

What should a pharmaceutical supplier questionnaire include? Legal entity and site details, role, manufacturing and subcontracted activities, quality-system overview, regulatory status, change-notification and complaint procedures, and capacity. A questionnaire alone does not establish suitability.

How often should supplier qualification be reviewed? At a defined interval set by risk, and whenever a trigger occurs, such as a site change, a serious quality event, or a change in intended use.

What is the difference between supplier qualification and supplier performance monitoring? Qualification decides whether a supplier may be used for a stated scope. Monitoring tracks quality, delivery and responsiveness afterwards and can trigger re-qualification.

Does a contract manufacturer need a quality agreement? Responsibilities between the parties should be defined and documented. In the US, FDA guidance describes quality agreements for contract drug manufacturing; the EU expects a written contract. A template does not replace due diligence.

Limitations and editorial notes

• This guide is general educational information. It is not legal, regulatory or quality advice, and it does not replace the requirements that apply to your product, your market and your quality system.
• Requirements differ by jurisdiction. EU and US examples are labelled as such and should not be read as universal.
• A checklist cannot guarantee compliance. Have your quality or regulatory function review the approach for your products.
• How this guide was prepared. It was written by PharmaCountry Research from the primary documents listed under Sources, and each regulatory statement was checked against the linked text on 12–13 October 2026. It has not been reviewed or endorsed by a regulator or by any named external expert. Guidance is revised over time, so confirm the current edition of each document before relying on it.

Last updated: 13 October 2026.

Sources for the regulatory framing

• European Medicines Agency — Guidance on good manufacturing practice and good distribution practice: Questions and answers
• ICH — Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients (Step 4, November 2000)
• U.S. FDA — Contract Manufacturing Arrangements for Drugs: Quality Agreements (November 2016)
• European Commission — EudraLex Volume 4: EU Guidelines for Good Manufacturing Practice, including Part I, Chapter 5 (Production) and Chapter 7 (Outsourced activities)
• European Commission — Guidelines of 19 March 2015 on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients of medicinal products for human use
• European Commission — Guidelines on Good Distribution Practice of medicinal products for human use (2013/C 343/01)
• European Commission — Guidelines of 19 March 2015 on principles of Good Distribution Practice of active substances for medicinal products for human use (2015/C 95/01)
• U.S. FDA — Drug Master Files (DMFs)
• EDQM — FAQ: Is a certificate of suitability equivalent to a GMP certificate? and Is a certificate of suitability equivalent to a certificate of analysis?
• EMA — EudraGMDP database and EDQM — Certification database