News Hub

LPC Snapshot Dec 2021 - Vendor Qualification Under FDA Regulations and ICH/ISO Guidelines

Vendor Qualification Under FDA Regulations and ICH/ISO Guidelines




All contract service organizations and vendors who supply the cGMP facility with critical supplies, reagents, and equipment must be qualified. This helps to ensure all products have been manufactured in a way that prevents the introduction of adventitious agents or toxic impurities and ensures final product safety, effectiveness, and consistency. However, setting up a supplier/vendor qualification system could be daunting as the regulations are spread out between code of federal regulations (CFRs), ICH, and ISO guidelines.

21 CFR 820 and 211

The FDA (21 CFR 820.50) unequivocally requires qualification, evaluation, and monitoring of vendors utilized in cGMP production facilities but does not provide details on qualifying vendors. The FDA expects cGMP manufacturers to show due diligence in the evaluation and maintenance of supply chains. FDA 21 CFR 211 requires vendor qualification as a part of the validation process, and typically it is accomplished by composing a checklist to assess vendors for their ability to fulfill lab requirements.

The following requests are typically made during new vendor qualification:

  • Summary of their Quality Systems Program
  • FDA registration number and accreditation certificates
  • SOP Table of Contents
  • Summary of their Personnel Training Program
  • Information about Customer Service Hotline
  • Summary of Deviation Management
  • Information on any Recalls in the past two years
  • Testing protocols
  • Test equipment certificates
  • For 510K supply/reagents, cross-reference letter(s)
Once all the information is acquired and vetted, the vendor can be qualified or disqualified. In the case of a qualified vendor, a written agreement must be established where the manufacturer clearly establishes their expectations such as the periodic review of vendor's quality documents (CoA, sterility testing, Safety Data Sheet (SDS), QC assay results, turnaround time and hours of operations, and reporting format, if applicable. Changes to the written agreements can be managed upon contract renewal or via contract amendment. Once agreements are signed, vendor conformance with pre-established acceptance criteria can be assessed by analytical testing of random reagent lots. The ongoing monitoring of established vendors can be performed by on-site audit, phone interview, or having them complete a questionnaire. The monitoring exercise can be set up on a periodic basis, usually once every one or two years.


ICH Q10 describes one comprehensive model for an effective pharmaceutical quality system based on International Organization for Standardization (ISO) quality concepts, including applicable cGMP regulations. ICH Q10 provides an excellent framework that can be used to incorporate supply chain quality elements into the cGMP facility Quality manual. A critical aspect under ICH is engagement with the external environment to monitor the supply/demand of critical reagents commonly used in pharmaceutical industries. This can be accomplished by reviewing current events, including market trends and instability in politically charged regions. Online tools can also be used to gather data and monitor the impact on the supply chain, such as setting up Google alerts, observing Reddit or Trade Press.

ISO 9001:2015

The ISO 9001:2015 standard requires an organization to establish criteria to assess its suppliers. One of its key points is to assess the vendor's financial stability. For this reason, most of the cGMP facilities in the USA require new vendors to submit a W-9 form which is used to ensure the entity has a Taxpayer Identification Number and is in good standing with the IRS. This check is essential to mitigate the risk by ensuring the company is on solid footing and would not go under due to minor economic turbulence.

Conclusion: By implementing a robust supply chain quality system, GMP facilities can ensure that qualified vendors are reliable, safe, and in compliance with federal, state, and local regulations.