Supplier Qualification: Moving Beyond the Certificate of Analysis

A certificate of analysis tells you what a supplier says about their material. It does not tell you whether their systems are capable of producing it consistently. That distinction is at the heart of what a compliant supplier qualification program requires.

FDA regulations under 21 CFR Parts 211 and 820, as well as ICH Q10, are clear: manufacturers are responsible for the quality of materials they receive, regardless of what a supplier certifies. A certificate of analysis is a data point. It is not a qualification.

What Supplier Qualification Actually Requires

A qualification program begins before the first purchase order. It starts with a risk assessment: How critical is this material to product quality and patient safety? How complex is the supplier’s manufacturing process? What is their regulatory history?

Based on that assessment, suppliers are typically tiered: High-risk, critical suppliers receive full qualification, which includes an audit, a documented quality agreement, and ongoing monitoring. Lower-risk suppliers may qualify through questionnaires, documentation review, and identity testing of incoming materials.

The key principle is that the depth of qualification matches the risk. A supplier of water for injection requires a different level of scrutiny than a supplier of packaging materials. Treating every supplier identically either over-invests resources or under-protects the product.

The Quality Agreement Is Not Optional

For any supplier of materials that directly affect product quality, a written quality agreement is required. It defines who is responsible for what: testing, release, notification of changes, and handling of nonconformances.

Change notification is where many supplier programs break down. A supplier who changes their manufacturing process, their raw material source, or their testing method without notifying you has changed the basis of your qualification. If you are not aware of the change, you cannot evaluate its impact. If you cannot evaluate its impact, your qualification is no longer valid.

Ongoing Monitoring Is Part of Qualification

Qualification is not a one-time event. It requires periodic review of supplier performance data, including lot reject rates, deviation trends, and audit history. Suppliers whose performance deteriorates need to be re-evaluated. A supplier that was qualified three years ago under different conditions may not meet the same standard today.

The most common gap in supplier programs is treating initial qualification as permanent approval. Regulatory expectations are clear: supplier status must be maintained, not just established.

Building a Program That Holds Up

A supplier qualification program that holds up under inspection has a written procedure, a maintained approved supplier list, documented risk assessments, current quality agreements, and a defined schedule for supplier review. None of those elements is optional, and none of them exists automatically.

Materials drive quality. The programs that control them need to reflect that.