Supplier Qualification Programmes That Survive an Inspection: Risk Tiering, Quality Agreements and Audit Depth

Supplier qualification is where quality systems quietly fail. The programme usually looks complete on paper. There is an approved supplier list, a folder of certificates of analysis, a questionnaire from three years ago, and an audit schedule that slipped. Then an inspector asks a simple question: why is this supplier approved, and what evidence supports the level of oversight you apply to them? At that moment the difference between a documented programme and a collection of documents becomes obvious.

The stakes have risen. Supply chains are longer, more materials arrive through brokers and distributors, and more manufacturing steps are outsourced. Regulators have responded by tightening expectations on traceability, on written agreements, and on the evidence behind reduced testing. This guide sets out how to build a supplier qualification programme that holds up under a Health Canada, FDA or EU inspection, using three design decisions: risk tiering, quality agreements, and audit depth.

The guidance below applies across sectors. Drug fabricators work under Part C, Division 2 of the Food and Drug Regulations. Cannabis licence holders work under Part 5 of the Cannabis Regulations. Food businesses work under the Safe Food for Canadians Regulations. Medical device manufacturers work under ISO 13485 and Health Canada's quality management system guidance. The regulatory hooks differ. The design logic does not.

What is a supplier qualification programme?

A supplier qualification programme is the documented system by which an organization decides which suppliers it will buy from, how much oversight each supplier receives, and what evidence justifies that decision. It covers selection, approval, ongoing monitoring, periodic re-evaluation and disqualification. It matters because regulators hold the receiving company responsible for the quality of everything that enters its process, regardless of who made it. Companies should tier suppliers by risk, put a written agreement in place for each material or service, and match audit depth to tier.

EU GMP Chapter 5 (Production), in operation from 1 March 2015, states the expectation plainly. Paragraph 5.27 requires manufacturers to document the selection, qualification, approval and maintenance of suppliers, with supervision proportionate to the risks posed by the materials, and notes that purchasing directly from the material manufacturer is preferred where possible. That single sentence contains the whole programme: document it, and scale it to risk.

The four questions every programme must answer

1. Who is the actual manufacturer? Not the distributor, not the broker, the manufacturer. ICH Q7 requires that where the supplier is not the manufacturer, the manufacturer's name and address are documented.
2. What is the risk of this material or service? Risk drives everything downstream.
3. What have we agreed in writing? Specifications, notification of change, audit rights, deviation reporting, and record retention.
4. What evidence do we hold that the supplier still performs? Testing data, audit reports, complaint history, on-time and in-specification performance.

Why supplier qualification is the finding inspectors reach for first

Supplier controls attract findings because they are easy to test and hard to fake. An inspector can pull a material lot, trace it to a certificate of analysis, ask which vendor certification agreement supports reduced testing, and check whether the required identity test was performed. Three documents, five minutes, and the programme either stands or it does not.

Health Canada's risk classification guide for drug GMP observations (GUI-0023) shows how seriously these gaps are treated. The guide classifies observations as Risk 1, meaning a situation likely to result in a product that may present an immediate or latent health risk, Risk 2, meaning a situation that may result in a drug not consistently meeting its marketing authorization, and Risk 3, a departure from GMP that is neither critical nor major. Under raw material testing, the examples are instructive.

• Risk 1 (critical): the supplier provided no certificate of analysis and the Canadian fabricator did not test the material. Falsified or misrepresented analytical results also sit at Risk 1.
• Risk 2 (major): reduced testing applied without proper vendor certification. Insufficient raw material testing. Specifications incomplete or not approved by quality control. Inadequate or absent sampling methods.
• Risk 3 (other): lots approved for confirmatory testing used without quality control authorization.

Read those together and a pattern appears. The critical finding is not testing at all. The major finding is claiming a shortcut you have not earned. Most companies are not at risk of the first. Many are at risk of the second.

Step 1: Risk tiering, or how to decide how much oversight each supplier gets

Risk tiering is the practice of sorting suppliers into defined categories that determine the level of qualification, monitoring and audit each one receives. It matters because oversight is a finite resource, and spreading it evenly means the critical supplier gets the same attention as the cardboard vendor. Companies should define tiers in a written procedure, assign every supplier to a tier with a recorded rationale, and re-score on a fixed cycle. Inspectors do not object to a supplier receiving light oversight. They object when nobody can explain why.

ICH Q9(R1) Quality Risk Management, adopted on 18 January 2023, gives the formal grounding. It establishes that formality in quality risk management is not a binary concept, and that varying degrees of formality may be applied. Three factors drive how much formality is appropriate: uncertainty, meaning lack of knowledge about hazards and harms; importance, meaning how consequential the decision is for product quality; and complexity of the process or subject area. A supplier of a critical active substance from an unfamiliar jurisdiction scores high on all three. A supplier of shipping cartons does not.

Building the tier model

Score each supplier on the factors that genuinely change patient or consumer risk:

• Material criticality. Does the material enter the product, contact the product, or stay outside it? Active substances, excipients, primary packaging and processing aids sit in descending order.
• Process impact. Does a failure show up in finished product testing, or does it pass undetected?
• Supply chain complexity. Direct from manufacturer, or through one or more brokers, distributors or repackers?
• Regulatory history. GMP certificates, inspection outcomes, recalls, warning letters.
• Substitutability. Sole source suppliers carry higher risk because you cannot walk away.
• Performance history. Out of specification results, deviations, late notifications, complaint volume.

A worked three-tier model

A tier is not permanent. Build defined triggers that force an immediate re-score: a change of manufacturing site, a change of ownership, a regulatory action, a confirmed out of specification result, a recall, or two related deviations in a rolling twelve months.

Step 2: Quality agreements that actually allocate responsibility

A quality agreement is a written document that defines which party performs and which party is accountable for each GMP activity in an outsourced or supply relationship. It matters because responsibility that is not written down is disputed at exactly the wrong moment, usually during an investigation. Companies should hold a current, signed quality agreement with every Tier 1 and Tier 2 supplier, separate from the commercial contract. A quality agreement does not transfer legal responsibility, and regulators are explicit about that.

The FDA's guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements, issued in November 2016, is the clearest statement of the principle. The guidance states that each party engaged in the manufacture of a drug is responsible for ensuring compliance with CGMP for the manufacturing activities it performs, and that no party to a quality agreement may delegate any of its responsibilities to comply with CGMP through the quality agreement or any other means. It also confirms that the owner's quality unit remains legally responsible for approving or rejecting drug products manufactured by the contract facility, including final release, consistent with 21 CFR 211.22(a).

What the agreement must cover

• Purpose and scope. What services, what products, what sites.
• Definitions. Precise meaning of terms, so that batch, deviation and significant change mean the same thing to both parties.
• Resolution of disagreements. The escalation route when quality opinions differ.
• Manufacturing activities. The heart of the agreement, covering quality unit responsibilities, facilities and equipment, materials management, product specific considerations, laboratory controls, documentation, and change control.
• Life cycle and revisions. How the agreement is reviewed, revised and kept current.

EU GMP takes the same position from a different angle. Chapter 5, paragraph 5.28 requires that quality requirements be formally discussed and agreed with suppliers in documented quality agreements covering production, testing, handling, labelling, packaging, distribution, complaints, recalls and rejection procedures. Chapter 7, on outsourced activities, in force since 31 January 2013, requires a written contract in which the Contract Giver assesses the legality, suitability and competence of the Contract Acceptor, provides the information needed to perform the work safely, monitors performance and reviews records. The Contract Acceptor must hold adequate premises, equipment, knowledge and personnel, must not subcontract without prior written approval, must not make unauthorized changes, and must accept that its activities may be inspected.

The clauses most often missing

• Change notification with a defined window. A clause saying the supplier will notify of changes is unenforceable. State the categories of change (site, process, specification, method, raw material source, subcontractor) and a notification period in days before implementation.
• Deviation and out of specification reporting. Health Canada expects a vendor certification agreement to require the supplier to inform the fabricator of any significant deviation during manufacturing. Put a clock on it.
• Certificate of analysis content. Health Canada expects the certificate to present actual numerical results and to reference the batch number, the raw material specifications and the validated test methods used. A certificate that says only that the material conforms is not a certificate of analysis.
• Audit rights, including for cause. Include the right to audit subcontractors.
• Subcontracting. No subcontracting without prior written approval, and full disclosure of the actual manufacturing site.
• Record retention, access, termination and transition. Define years and format, and state what happens to open batches and retained samples when the relationship ends.

Our article on who is accountable when a contract manufacturer fails goes deeper on the accountability split between owner and contract facility.

Step 3: Audit depth, or matching the audit to the tier

Audit depth is the scope, duration and method of the assessment you apply to a supplier, from a questionnaire through to a multi-day on-site GMP audit. It matters because an audit that is too shallow provides false assurance, and one that is too broad wastes resources you need elsewhere. Companies should define, in procedure, which audit type each tier receives, and what evidence is acceptable in place of an on-site visit. Inspectors will test whether the audit actually examined the systems that matter for the material you buy.

EU GMP Chapter 5, paragraph 5.29 sets the benchmark for active substances. Audits must confirm compliance with GMP and good distribution practice, must be of appropriate duration and scope, and must consider cross-contamination risks. Reports must clearly document findings and deficiencies, corrective actions must be implemented, and follow-up audits must be scheduled in line with quality risk management. The manufacturing authorization holder verifies compliance directly or through a contracted party.

The audit ladder

Health Canada's interpretation under GUI-0001 accepts both routes for active pharmaceutical ingredients: reports from qualified authorities, regulatory bodies or organizations such as EDQM or WHO showing compliance with ICH Q7, or on-site audits conducted by qualified personnel. For other raw materials, the expectation is regular on-site audits by qualified personnel.

Reliance on someone else's audit is permitted, but it is not a free pass. EU GMP Annex 16, in force since 15 April 2016, allows the Qualified Person to rely on audits conducted by third parties, while requiring that a written final assessment and approval of third party audit reports has been made, and that where outsourced activities have a critical impact on product quality, the QP reviews the audit outcome before certifying the relevant batches. Annex 16 also makes clear that while tasks may be delegated to appropriately trained personnel or third parties, the QP must have ongoing assurance that this reliance is well founded. Canadian quality assurance persons face the same logic even where the legal wording differs: you may use another party's work, but you own the conclusion.

What a Tier 1 audit must actually look at

Do not accept a generic GMP audit report for a specific material. The audit should cover the material you buy: its process train, the equipment it shares, the analytical methods used to release it, the change control history for that product, the deviation record, the subcontractors involved, and the data integrity controls around the results printed on your certificate of analysis. Our guidance on CAPA and root cause investigations applies directly to supplier findings, which are frequently closed with a corrective action that never touches the cause.

Reduced testing: the rules you cannot skip

Reduced testing is the practice of accepting a supplier's analytical results in place of performing the full range of tests yourself. It matters because it is the single largest cost saving in materials management and the single most common source of major findings. Companies must earn it through defined qualification evidence, keep an identity test in place regardless, and revalidate the supplier's reliability at defined intervals. Applying reduced testing without the qualification evidence behind it is a major observation in Canada and a data integrity concern everywhere.

The three major frameworks converge on the same architecture: Health Canada under GUI-0001 (C.02.009 and C.02.010), the FDA under 21 CFR 211.84, and ICH Q7 section 7 for active pharmaceutical ingredients.

Two practical points follow. First, the identity test is never optional. Health Canada is explicit that it cannot be waived under a reduced testing programme, and the FDA requires it as the precondition for accepting a supplier's report of analysis. Second, the broker problem is real. If your material passes through a distributor who repackages or relabels it, the certification chain breaks and Health Canada's position is that the broker's certification is generally unacceptable. Map your supply chain to the actual manufacturing site before you design your testing plan, not after.

How supplier control differs by sector

The principle is constant. The regulatory instrument is not.

Pharmaceuticals and active pharmaceutical ingredients

Part C, Division 2 of the Food and Drug Regulations, interpreted through GUI-0001, is the controlling framework in Canada, with ICH Q7 governing APIs. EU manufacturers add Chapter 5, Chapter 7 and Annex 16. This is the most prescriptive environment and the one where reduced testing rules bite hardest. See our pharmaceutical regulatory support overview for how licensing and quality obligations interact.

Cannabis

Part 5 of the Cannabis Regulations (SOR/2018-144) does not prescribe a supplier qualification programme in the detailed terms the Food and Drug Regulations use for drugs. That absence is a trap, not a relief. Health Canada's Good production practices guide for cannabis still creates real supplier obligations: pest control products must be registered for use on cannabis under the Pest Control Products Act, and where a licence holder uses a third party analytical testing facility it must confirm the facility holds a valid Health Canada licence for analytical testing, assess the facility's method validations for suitability and keep records of that assessment, and provide the specifications before composition testing is performed. Under section 88, the quality assurance person approves methods and procedures before implementation and approves cannabis before it is made available for sale. In practice, that means the QAP owns supplier decisions whether or not a regulation names them.

Natural health products

NHP site licence holders operate under the GMP requirements of the Natural Health Products Regulations, and the same logic applies to raw material identity, specification and supplier evidence. Botanical raw materials add a specific challenge: identity is a species question, not just a chemical one, and adulteration risk in the botanical supply chain is well documented. Our natural health product licensing team sees more supplier findings on botanical identity than on any other NHP topic.

Food and beverage

Under the Safe Food for Canadians Regulations, supplier control is delivered through the preventive control plan. The CFIA describes a Supplier Food Safety Assurance Program as one type of control measure, built on six elements: product specifications, supplier selection, a signed supplier agreement, a current supplier list, verification activities, and programme maintenance. The CFIA expects verification at least annually, including inspection or testing of incoming materials and on-site audits of suppliers, with the depth depending on the size and complexity of the business and the hazards that present a risk of contamination. That is risk tiering in food safety language. Our food safety and HACCP compliance practice builds these programmes into existing preventive control plans.

Medical devices

Health Canada's guidance on the control of products and services obtained from suppliers, adopted 31 May 2010, expects manufacturers to assess both business capability and operational capability, with the extent of evaluation and acceptance activity performed in proportion to the identified risk. It expects controls to be established through contractual arrangements, purchase orders or interface agreements that specify product requirements, acceptance criteria, change control processes, traceability, complaint handling, CAPA responsibilities and record retention. It also expects manufacturers to plan and perform periodic supplier re-evaluations regardless of whether problems have been identified, and warns that failure to provide access to objective evidence could result in a major noncompliance. This aligns with the purchasing requirements of ISO 13485:2016, clause 7.4, under which evaluation and selection criteria must be proportionate to the risk associated with the device.

Compliance checklist

Use this as a self-assessment before your next inspection or audit.

Programme design

• A written procedure defines supplier tiers, scoring factors and the evidence required at each tier
• Every supplier on the approved supplier list carries a recorded tier and a documented rationale
• Defined triggers force immediate re-scoring: site change, ownership change, regulatory action, confirmed out of specification result, recall, repeat deviations
• The actual manufacturing site is identified for every material, not just the distributor

Agreements

• A signed, current quality agreement exists for every Tier 1 and Tier 2 supplier
• Change notification clauses list change categories and a notification window in days
• Deviation and out of specification reporting obligations carry a defined timeframe
• Certificate of analysis content is specified: numerical results, batch number, specification reference, validated methods
• Audit rights extend to subcontractors, and subcontracting requires prior written approval
• Record retention periods and access rights are stated

Testing and release

• A specific identity test is performed on every lot received, with no exceptions
• Reduced testing is applied only where a signed vendor certification agreement and audit evidence exist
• Full confirmatory testing was completed on the first three consecutive lots from each certified vendor
• The ongoing confirmation schedule is defined, scheduled and being met
• Full testing resumes automatically after a significant supplier process change

Audit programme

• Audit type is mapped to tier in procedure, and auditors are qualified with the qualification documented
• Audit reports document findings and deficiencies clearly, with corrective actions tracked to closure
• Third party audit reports carry your own written assessment and approval
• Follow-up audit intervals are set by risk, not by habit

Monitoring

• Supplier performance metrics are trended: out of specification rate, deviation count, on-time notification, complaint volume
• Supplier performance is a standing agenda item in management review
• Disqualification criteria and the process for removing a supplier are documented

Common mistakes

• Treating the approved supplier list as the programme. The list is an output. The programme is the reasoning behind it. If you cannot produce a tier and a rationale for each entry, you have a list, not a programme.
• Reduced testing without the paperwork. Companies adopt reduced testing based on a good commercial relationship, not a signed vendor certification agreement plus three fully tested consecutive lots.
• Qualifying the distributor instead of the manufacturer. The certificate arrives with the distributor's letterhead, the audit was of the distributor's warehouse, and nobody has ever seen the manufacturing site.
• Generic audits for specific materials. A GMP audit report that never mentions your material, its process line, or its analytical methods does not qualify that material.
• Change notification clauses with no teeth. Without categories and a timeframe, you learn about the change when the material fails.
• Letting the audit schedule slip without a risk decision. A missed audit is not automatically a finding. A missed audit with no documented risk assessment and no interim assurance is.
• Closing supplier findings with a letter. Ask for the investigation, the root cause, the action and the effectiveness verification.
• No route back down. Programmes often define how a supplier gets approved and never define how one gets disqualified. Write the exit.
• Ignoring service providers. Contract laboratories, calibration providers, sterilization services and pest control contractors are suppliers. They belong in the tiering model.
• Assuming a certificate means what it says. Health Canada expects actual numerical results referenced to validated methods. A conformance statement with no numbers tells you nothing and defends nothing.

Frequently asked questions

What is the difference between a quality agreement and a supply agreement?

A supply agreement is commercial: volume, price, delivery, liability. A quality agreement is technical: who performs each GMP activity, who approves what, how changes and deviations are communicated, and what records are kept. They should be separate documents, because quality terms need to change on a quality timeline, not a contract renewal timeline. The FDA's 2016 guidance on quality agreements recommends this separation and sets out the sections a quality agreement should contain.

Can we rely on a supplier's certificate of analysis instead of testing?

Partly, and only after you qualify them. The FDA permits acceptance of a supplier's report of analysis in lieu of other testing, provided you conduct at least one specific identity test yourself and you establish the reliability of the supplier's analyses through appropriate validation of their results at appropriate intervals. Health Canada requires a written vendor certification agreement, full confirmatory testing on the first three consecutive lots, and a specific identity test on every lot received. ICH Q7 requires full analyses on at least three batches before reducing in-house testing, and a full analysis at appropriate intervals thereafter.

How often should suppliers be audited?

There is no universal interval. EU GMP requires that audits be of appropriate duration and scope and that follow-up audits be scheduled in line with quality risk management. In practice, most Canadian companies audit Tier 1 suppliers on a two to three year cycle, with shorter intervals where risk or performance justifies it and immediate for cause audits after significant events. Document the basis for whatever interval you choose. The interval is defensible when the reasoning is written down.

Can we accept a third party audit report instead of auditing ourselves?

Yes, with conditions. EU GMP Annex 16 permits the Qualified Person to rely on audits conducted by third parties, but requires a written final assessment and approval of those reports, and requires the QP to review audit outcomes for critical outsourced activities before certifying batches. Health Canada accepts reports from qualified authorities, regulatory bodies or organizations such as EDQM or WHO for API suppliers, showing compliance with ICH Q7. In all cases, you must assess the report's scope and adequacy and record that assessment. Buying a report is not the same as reading and accepting it.

Do cannabis licence holders need a formal supplier qualification programme?

The Cannabis Regulations do not prescribe one in the detailed way the Food and Drug Regulations do for drugs, but supplier obligations still exist. Pest control products must be registered for use on cannabis, third party analytical testing facilities must be verified as licensed and their method validations assessed, and the quality assurance person must approve methods and procedures and approve cannabis before sale. A documented supplier programme is also required in practice for any producer pursuing EU-GMP certification or export markets.

What is the single most common supplier finding?

Applying reduced testing without the qualification evidence to support it. Health Canada's GUI-0023 lists reduced testing performed without proper vendor certification as a Risk 2, or major, observation. The cure is simple and unglamorous: sign the agreement, test three consecutive lots in full, keep the identity test on every lot, and schedule the ongoing confirmation.

How MFLRC can help

MF Licence and Regulatory Consultants builds and repairs supplier qualification programmes for regulated manufacturers across Canada, the United States and Europe. Our work in this area typically covers:

• Gap assessments. We test your current programme the way an inspector would: pull a lot, trace the certificate, find the agreement, check the identity test, and report where the chain breaks.
• Risk tiering models. We build the scoring model, apply it across your supplier base, and document the rationale so every entry on your approved supplier list can be defended.
• Quality agreement drafting and review. Templates by tier and sector, with the change notification, deviation reporting, certificate content, audit rights and subcontracting clauses that findings usually expose.
• Supplier and contract manufacturer audits. On-site and remote audits by qualified auditors, with reports written to withstand regulatory scrutiny, plus assessment of third party audit reports you already hold.
• SOP development. Supplier qualification, vendor certification, incoming material control, and reduced testing procedures written to Health Canada, FDA and EU expectations.
• QAP services. Approved Quality Assurance Person support for cannabis and other licensed operations, including supplier approval decisions.
• Inspection readiness and remediation. Mock audits, CAPA support, and response drafting when a supplier finding has already landed. See our guidance on responding to a Form 483 or Health Canada observation.
• Ongoing compliance support. Our quality assurance and compliance support and post-licensing compliance services keep the programme current between inspections.

Need help building a supplier qualification programme that holds up under inspection? Contact MFLRC for expert guidance tailored to your products, your markets and your supply chain.

Conclusion

Supplier qualification is not a filing exercise. It is a set of decisions about how much you trust each organization that feeds your process, and how much evidence you hold to justify that trust. The three design choices in this guide, risk tiering, quality agreements and audit depth, are the ones inspectors probe, because they are the ones that determine whether the certificate in your file means anything.

The programmes that survive inspections share a simple quality: every level of oversight has a written reason behind it. The tier has a rationale. The agreement has clauses that can be enforced. The audit examined the material you actually buy. The reduced testing rests on three fully tested lots and a signed certification agreement, and the identity test never stopped. None of that is expensive. It is just deliberate.

Start with the list. Pick five suppliers at random, and see whether you can answer the four questions for each one within ten minutes. Whatever you cannot answer is your next project, and it is cheaper to find it yourself than to have it found for you. If you also want to test the procedures underneath the programme, our breakdown of the 10 SOPs every licensed facility gets wrong covers supplier and materials control among them.

Sources and references

• Health Canada, Good manufacturing practices guide for drug products (GUI-0001), interpretation of C.02.009 and C.02.010, raw material testing and vendor certification.
• Health Canada, Risk classification guide for drug good manufacturing practices observations (GUI-0023).
• Health Canada, Good production practices guide for cannabis.
• Justice Canada, Cannabis Regulations (SOR/2018-144).
• Health Canada, Quality Management System, Medical Devices: Guidance on the Control of Products and Services Obtained from Suppliers, adopted 31 May 2010.
• FDA, 21 CFR 211.84, Testing and approval or rejection of components, drug product containers, and closures.
• FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements, Guidance for Industry, November 2016.
• European Commission, EudraLex Volume 4, GMP Chapter 5: Production, in operation from 1 March 2015.
• European Commission, EudraLex Volume 4, GMP Chapter 7: Outsourced Activities, in force 31 January 2013.
• European Commission, EudraLex Volume 4, Annex 16: Certification by a Qualified Person and Batch Release, in force 15 April 2016.
• ICH, Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, section 7 Materials Management and section 17.
• ICH, Q9(R1) Quality Risk Management, adopted 18 January 2023.
• CFIA, Supplier Food Safety Assurance Program.
• ISO, ISO 13485:2016 Medical devices, Quality management systems.