How to Prepare a Vendor Qualification File That Passes Regulatory Review

Every pharmaceutical manufacturer, marketing authorisation holder, and medical device company operates within a supply chain. Raw materials, excipients, packaging components, contract manufacturing services, laboratory testing services, and software systems all come from external suppliers. Every one of those suppliers introduces a degree of risk into the quality system and into the products that ultimately reach patients. The vendor qualification file is the documentary evidence that your organisation has assessed, approved, and is actively monitoring that risk.

Regulatory inspectors across FDA, MHRA, EMA, TGA, and other global authorities examine vendor qualification files as a window into the maturity of an organisation’s quality culture. A well-constructed vendor qualification file tells an inspector that the organisation understands its supply chain risks, has made evidence-based decisions about supplier approval, and has systems in place to detect when a supplier’s performance deteriorates. A poorly constructed file tells them the opposite, and it frequently triggers a deeper examination of the entire supplier management programme.

This guide explains what a vendor qualification file must contain, how to structure it for different supplier categories, what regulators specifically look for during inspection, and where the gaps most commonly appear in files that fail regulatory review.

Read More: Your CMO Has a GMP Certificate. Here’s Why That’s Not Enough for Your Next MHRA Inspection

Why Vendor Qualification Is a Regulatory Priority in 2026

Vendor qualification has been a GMP requirement for decades but its prominence as an inspection focus area has increased substantially in recent years following a series of high-profile supply chain failures that resulted in patient harm and large-scale product recalls.

The contaminated heparin crisis, the diethylene glycol and ethylene glycol contamination events affecting glycerol and propylene glycol in multiple countries, and the nitrosamine contamination issues that affected sartan and other product classes all traced back, in part, to inadequate supplier oversight. These events demonstrated that a supplier who has been approved and used for years can introduce a new risk without the MAH or manufacturer detecting it in time if the qualification and monitoring programme is not sufficiently robust.

In 2026 the specific regulatory signals driving inspector focus on vendor qualification include:

• Updated EU GMP Annex 8 guidance on sampling of starting and packaging materials, which introduced enhanced requirements for supplier qualification of high-risk excipients following the glycerol contamination incidents
• FDA continued emphasis on API supplier qualification for finished dose manufacturers following multiple enforcement actions where finished product manufacturers failed to adequately qualify their API sources
• MHRA inspection findings highlighting weaknesses in the qualification programmes of pharmaceutical wholesalers and distributors for their transport and storage service providers under GDP requirements
• EMA and PIC/S guidance on the qualification of contract testing laboratories, which has become an area of significant scrutiny as more manufacturers outsource analytical testing to third parties
• ICH Q3D elemental impurities guidance creating new supplier qualification obligations for manufacturers to understand the elemental impurity risk profile of their raw material supply chain

Understanding Supplier Risk Classification: The Foundation of the Qualification Programme

Before building individual vendor qualification files, an effective supplier management programme begins with a risk-based classification of the supplier population. This classification determines the depth and frequency of qualification activity required for each supplier and is itself a document that regulators will examine to assess whether the organisation’s approach to supplier risk is proportionate and evidence-based.

A risk-based supplier classification typically considers:

• The impact of the supplied material or service on product quality and patient safety: An API manufacturer whose material goes directly into the finished product without further purification carries fundamentally different risk from a supplier of printed cardboard outer cartons. The qualification programme should reflect this difference explicitly.
• The degree of regulatory oversight the supplier is subject to in their own operations: A contract manufacturer operating under a GMP licence and subject to regular regulatory inspection carries lower inherent risk than an unregulated chemical supplier in a jurisdiction with limited regulatory oversight capacity.
• The supply chain complexity for the material: Materials that pass through multiple intermediaries between the original manufacturer and the pharmaceutical site introduce chain of custody risks that require specific qualification controls such as confirmation of the material’s authentic origin.
• The historical performance of the supplier: A supplier with a track record of consistent quality, reliable supply, and proactive communication of changes warrants less intensive qualification activity than a new supplier or one with a history of quality incidents.
• The criticality of the material to the manufacturing process: A starting material for which no qualified alternative supplier exists represents a supply continuity risk as well as a quality risk and this dual risk profile should be reflected in the qualification requirements.

Most pharmaceutical quality systems use a three-tier classification:

• Critical suppliers: those whose materials or services have a direct and significant impact on product quality or patient safety, requiring the most intensive qualification including on-site audit
• Major suppliers: those with indirect but meaningful quality impact, requiring qualification documentation review and potentially a questionnaire-based assessment
• Minor suppliers: those with low quality impact, requiring a basic approval process without formal audit

The specific criteria for each tier should be defined in the supplier management SOP and applied consistently. Regulators will examine whether the classification applied to specific suppliers is logically consistent with the criteria defined in the SOP. A contract testing laboratory classified as minor when it is performing release testing for finished products is an inconsistency that will generate an inspection finding.

What a Vendor Qualification File Must Contain

The specific contents of a vendor qualification file vary depending on the supplier’s risk classification and the nature of the material or service supplied. However, a complete vendor qualification file for a critical supplier typically contains the following elements, each of which serves a specific regulatory purpose:

• Supplier information record: The basic identity of the supplier including legal name, registered address, manufacturing or service site address if different, contact details for quality and regulatory functions, and the scope of supply covered by the qualification
• Risk assessment document: A documented assessment of the quality and supply chain risks associated with this specific supplier, including the criteria applied and the risk tier assigned, completed before qualification activities begin
• Supplier questionnaire and response: A structured questionnaire covering the supplier’s quality management system, regulatory compliance history, manufacturing and testing capabilities, change notification procedures, and any relevant certifications or regulatory approvals. The completed and signed response from the supplier should be retained in the file.
• GMP or quality certification: A current copy of the supplier’s GMP licence, ISO 13485 certificate, ISO 9001 certificate, or other quality certification relevant to the nature of their operations. Critically, the file should contain a process for monitoring the expiry date of these certificates and renewing them before they lapse.
• Audit report: For critical suppliers, a formal on-site audit report documenting the findings of a supplier audit conducted by qualified personnel. The audit should have been conducted within a defined period before approval and the report should follow a consistent format across the supplier audit programme.
• Certificate of analysis review: For material suppliers, a review of the supplier’s certificate of analysis format and content confirming that it meets your specifications and provides the analytical data required for incoming material release decisions.
• Material specification or service agreement: A documented specification for the material supplied or a service level agreement for the service provided, signed by both parties, that defines the quality requirements the supplier is expected to meet.
• Pharmacovigilance or quality agreement: For suppliers providing services with GMP, GDP, or GvP implications, a formal quality agreement defining the responsibilities of each party, the communication protocols for quality events, and the change notification requirements.
• Approved supplier status record: A formal record of the decision to approve the supplier, signed by an authorised quality function representative, confirming that all required qualification activities have been completed and the supplier is approved for the defined scope of supply.
• Change notification history: A log of all notifications received from the supplier of changes to their processes, facilities, materials, or regulatory status, along with the assessment and disposition of each notification by the receiving organisation.
• Ongoing monitoring records: Records of periodic review activities including re-qualification audits, certificate of analysis trend reviews, incoming material testing results, supplier deviation records, and performance metric data.

The Supplier Audit: What Regulators Expect and What Is Commonly Missing

For critical suppliers the on-site audit is the centrepiece of the qualification process and the element that receives the most regulatory scrutiny. A vendor qualification file that contains a questionnaire response and a GMP certificate but no audit report for a critical API supplier is one of the most common major findings in supplier qualification inspections globally.

The audit report in a complete vendor qualification file should demonstrate:

• That the audit was conducted by personnel with appropriate GMP knowledge and audit training, with their qualifications documented
• That the audit covered all areas relevant to the quality of the supplied material or service, not just the areas the supplier was willing to open for inspection
• That findings were classified by severity and communicated to the supplier in writing
• That the supplier’s corrective action responses to audit findings were received, reviewed, and accepted before the supplier was approved or reapproved
• That the audit was conducted within the timeframe required by the site’s supplier management SOP and that the next audit date has been scheduled

One piece of information that is often missing from supplier audit reports but that adds significant value is a documented assessment of the supplier’s change notification culture. An audit that only assesses technical compliance without examining how the supplier manages and communicates changes to the customer misses one of the most practically important aspects of the supplier relationship. Suppliers who do not proactively notify customers of changes to their processes, materials, or regulatory status are a persistent source of supply chain quality failures.

A unique and frequently overlooked element that distinguishes a genuinely robust vendor qualification file from an adequate one is the inclusion of a supply chain mapping exercise for critical materials. This documents not just the direct supplier but the full upstream supply chain, identifying the original manufacturer of the material, any intermediaries or distributors through which it passes, and the controls in place at each step to ensure the material’s authenticity, integrity, and quality are maintained throughout the chain. FDA investigators examining API supplier qualification files for finished dose manufacturers increasingly expect to see evidence that the manufacturer understands and has assessed the full upstream supply chain, not just the immediate supplier relationship.

Contract Testing Laboratories: A Frequently Underqualified Supplier Category

Contract testing laboratories represent one of the most consistently underqualified supplier categories in pharmaceutical quality systems. This is partly a historical artefact of the perception that a laboratory performing testing is different from a supplier providing materials, and partly a result of the practical challenge that many sites use a large number of different laboratories for different testing purposes and applying full critical supplier qualification to each one is resource-intensive.

The regulatory position is clear. A contract testing laboratory performing GMP-relevant testing, including release testing, stability testing, method validation, or environmental monitoring analysis, is a critical outsourced activity and must be qualified to a standard consistent with that criticality. The qualification file for a contract testing laboratory should include:

• Confirmation of the laboratory’s GMP or ISO 17025 accreditation status and the scope of that accreditation
• An on-site audit of the laboratory’s quality management system, data integrity controls, instrument qualification programme, and method validation documentation
• A quality agreement defining responsibilities for test method transfer, out-of-specification investigation, result reporting timelines, and data retention
• A review of the laboratory’s data integrity programme, including the controls in place for computerised systems, audit trail review, and access control management
• Reference standard and reagent qualification procedures confirming that the laboratory’s analytical inputs meet the standards required for reliable results

One aspect of contract laboratory qualification that is rarely addressed in vendor qualification files but that represents a genuine quality risk is the qualification of the laboratory’s sample handling and storage procedures. A laboratory that generates accurate analytical results but routinely stores samples at incorrect temperatures, misidentifies samples during accessioning, or fails to maintain chain of custody documentation introduces a risk of result unreliability that has nothing to do with the analytical method itself.

Ongoing Monitoring: Where Qualification Programmes Most Commonly Fail

Initial qualification of a supplier is necessary but not sufficient. The most common finding in supplier management inspections globally is not that initial qualification was absent but that the ongoing monitoring programme is inadequate, inconsistently applied, or documented in a way that does not demonstrate active oversight.

Ongoing supplier monitoring should include:

• Periodic re-qualification audits: Conducted at a frequency defined by the supplier’s risk classification, with higher-risk suppliers audited more frequently. The re-qualification audit should assess not only the supplier’s current compliance status but also how they have managed any changes since the last qualification.
• Certificate of analysis trend review: A systematic review of incoming material certificates of analysis over time to detect trends in test results that might indicate gradual process drift at the supplier site, even when individual results remain within specification.
• Incoming material testing: A risk-based incoming material testing programme that supplements the reliance on supplier certificates of analysis with independent testing, particularly for high-risk materials or suppliers with a limited performance history.
• Supplier deviation and complaint tracking: A formal record of all quality issues associated with each supplier, reviewed periodically to assess whether the pattern of issues represents a systemic supplier quality problem that warrants escalation or re-qualification.
• Change notification assessment: A documented review of all change notifications received from the supplier, including the impact assessment conducted and the disposition decision, to demonstrate active management of supply chain change risk.
• Annual supplier performance review: A structured annual review of each approved supplier’s performance against defined quality metrics, documented in the vendor qualification file, that forms the basis for the risk classification review and the scheduling of future qualification activities.

How Quality and Vigilance Supports Vendor Qualification Programme Development

At Quality and Vigilance we work with pharmaceutical manufacturers, MAHs, CMOs, and medical device companies to build vendor qualification programmes that meet the expectations of FDA, MHRA, EMA, TGA, and other global regulators. Our team brings hands-on experience of supplier qualification inspections across multiple regulatory frameworks and understands the difference between a qualification file that looks complete and one that will withstand the scrutiny of an experienced regulatory inspector.

We support organisations with supplier risk classification framework development, vendor qualification SOP review and gap assessment, supplier audit services for critical and major suppliers, quality agreement drafting and review, contract testing laboratory qualification, and full vendor qualification file review against current regulatory expectations.

Contact Quality and Vigilance today to assess the robustness of your vendor qualification programme and ensure your supplier files are ready for regulatory review.