Anatomy of a Vendor Qualification Program

Pharmaceutical companies are only as compliant as their vendors.  In a contract manufacturing arrangement, the manufacturer is held responsible for any cGMP deficiencies; however, you, as the sponsor or CRO, would be held responsible for your lack of vendor oversight.  Moreover, if your manufacturer fails to meet regulatory standards, you could lose millions in profits and patent exclusivity, damage your company’s reputation, and even jeopardize your entire business.

And that’s why a vendor qualification program is so critical.

There are a number of ways to slice and dice the process, but every robust vendor qualification program will include the following six activities.


1. Develop Service Requirements

In this step, the sponsor outlines all requirements and considerations relevant to vendor selection.  At a minimum, these will include:
  -  Specifications for product, packaging, and labeling
  -  Testing requirements
  -  Budget
  -  Quantities required
  -  Timeframes

2. Cull Vendor List

In this step, you’ll assess whether potential vendors are able to meet the requirements you defined in step 1.  Your QA department will also want to assess the vendors’ compliance status by searching the FDA website for import alerts, recalls, and warning letters.  A questionnaire should be used to collect important information about a vendor such as:
  -  Licensing and certifications
  -  Outsourced operations (and the vendors’ management of their vendors)
  -  CAPA and other QMS components
  -  Company policies (e.g., data retention)


3. Select Vendor

The selection team should include staff members from project management, business development, R&D, procurement, engineering, and quality control.  A broad team will be best able to weigh less tangible factors such as whether you might be able to leverage a vendor for other services down the road, or projected ease of doing business together.

4. Perform Facility Audit

Auditing is a topic unto itself, but I’ll use the space here to address a common question: with ample effort devoted to other qualification activities, is the time and cost of a facility audit warranted?  In a word, yes.  A vendor whose operations appear sound on paper can be masking compliance violations, even extreme ones.  Polaris auditors once found that the product storage area of a manufacturing facility was being used to house the owner’s collection of vintage automobiles.  Not surprisingly, the vendor had failed to mention that in its questionnaire response! No matter how thorough your research or how copious your online communications, there’s no substitute for visiting the facility, assessing its operation firsthand, and meeting the people with whom you will develop your business relationship.  Think Match.com.

5. Develop Quality Agreement

Templates for Quality Agreements abound online, and many include provisions for important communications.  Here’s a list of events about which you should require notification:
  -  Manufacturing deficiencies that may impact your products, even if the deficiencies were
       observed during an inspection of another sponsor’s product.
  -  Any FDA inspection, so you can gauge how often FDA visits the facility.  (The name of the
        inspected product and its sponsor would be kept confidential.)
  -  Key operational changes, such as additional products brought into the line, changes to key
        personnel and suppliers, and changes resulting from stability studies, process improvement
        projects, CAPA investigations, out-of-specification results, customer complaints, recalls,
        adverse event reports.

6. Monitor Qualification Status

“Once qualified, always qualified” would be wonderful, but it’s untrue.  You’ll need to keep current on any acquisitions or management changes that could affect the manufacturing of your products.  You want to monitor the health of the business, as well as any FDA enforcement actions to which the company has been subjected.  A re-qualification process and on-site audit is generally recommended every two years, but that may depend on the quality of the business relationship you’ve had during that time.

There’s a lot riding on your vendors’ ability to achieve, maintain, and demonstrate compliant operations.  For the quality of your product and the future of your business, it’s up to you to make sure they do.

By Laurie Meehan