A GMP supplier qualification SOP explains how an organization assesses, approves, and monitors suppliers whose materials or services could affect product quality. Use the template below as a starting point, then adapt it to your products, risks, responsibilities, and applicable requirements; there is no single universally required SOP format.
What a Supplier Qualification SOP Does
A standard operating procedure (SOP) turns supplier oversight into a consistent, documented process. It states who may request a new supplier, what information must be reviewed, when an assessment or audit is appropriate, who approves the outcome, and how supplier status is maintained. The objective is not simply to collect certificates. It is to establish a reasoned level of confidence that a supplier can reliably provide an acceptable material or service.
GMP means good manufacturing practice. The precise rules and terminology differ among products, activities, and jurisdictions, so an SOP should point to the requirements that actually apply to the organization. A supplier qualification procedure supports the manufacturer’s quality system; it does not transfer the manufacturer’s responsibility for the quality of its product to the supplier.
Which Suppliers and Services to Include
Define the SOP’s scope rather than assuming that every vendor needs the same treatment. A supplier may provide a raw material, an active ingredient, a component, packaging, a testing service, a maintenance activity, or another outsourced operation. The relevant question is whether a failure could affect product quality, patient or user safety, data integrity, regulatory compliance, or the continuity of a controlled process.
Some suppliers have a direct quality impact; others have an indirect or minimal one. A supplier of a product-contact component may merit substantial technical review, while a supplier of ordinary office supplies may be managed through routine purchasing controls. A laboratory performing a quality-critical test may need a different assessment from a general courier. The SOP should explain how the organization makes and records these distinctions, including how it handles suppliers that provide several different items or services.
- Materials: ingredients, intermediates, processing aids, and product-contact components.
- Packaging and labeling: items whose identity, protection, or printed information matters to the product.
- Services: testing, calibration, sterilization, storage, transport, or outsourced manufacturing, where applicable.
- Other vendors: suppliers with no meaningful quality impact may follow a simpler purchasing process, as defined by the organization.
Use a Risk-Based Qualification Path
Risk determines the depth of review, not whether the organization documents its decision. A useful assessment considers the material or service’s intended use, how directly it affects the product or process, the severity of a potential failure, the ability to detect a problem before use, and the supplier’s history. The organization may also consider whether the activity is outsourced, whether the supplier is the original manufacturer or a distributor, and whether there are practical alternatives.
For example, a new supplier of a critical starting material could require technical-document review, assessment of manufacturing controls, quality-history review, and an audit when justified by risk. A supplier of a low-impact, non-product-contact item might need identity and purchasing checks but not the same assessment. These are illustrative paths, not universal rules. A written rationale is important when a team selects a lighter or more intensive route.
Set the categories and decision criteria in the SOP or a controlled procedure. Avoid a scoring tool that gives a precise-looking number without explaining what it means. If a score is used, define the inputs, thresholds, required approvals, and actions for borderline results. A risk category should guide review; it should not replace informed quality judgment.
Typical Qualification Workflow
A clear workflow makes it easier to see whether a supplier is merely under consideration, conditionally accepted, or approved for a particular use. One practical sequence is:
- Request and define the need. Record the proposed supplier, item or service, intended use, manufacturing site where relevant, and the internal owner.
- Screen and classify. Check for basic suitability and assign an impact or risk category with a brief rationale.
- Collect evidence. Obtain relevant specifications, quality-system information, certifications where applicable, process details, and available performance history.
- Assess gaps. Review the evidence, request clarification, and determine whether a questionnaire, technical review, audit, sample evaluation, or other activity is warranted.
- Resolve findings. Document deficiencies, corrective actions, owners, and due dates. Determine whether each issue blocks approval or can be managed under defined conditions.
- Approve and communicate status. Record an authorized decision, approved scope, conditions, and effective date in the organization’s controlled records.
- Monitor and re-evaluate. Review performance and significant changes at a frequency appropriate to risk and when events call for reassessment.
Purchasing controls should prevent an unapproved supplier or unapproved site from being used for a controlled purpose. Where urgent or exceptional use is permitted by the organization’s system, the SOP should specify who can authorize it, what safeguards apply, how long the exception lasts, and how the decision is documented. An informal email or verbal assurance should not silently become a permanent approval.
Evidence, Audits, and Approval Decisions
The evidence needed depends on the supplier and the work. It may include a completed questionnaire, relevant quality-system documents, material specifications, test or release information, change-notification practices, complaint or deviation processes, and records showing that the supplier can meet agreed requirements. Request information that helps answer a defined quality question; collecting large volumes of unrelated paperwork can make review less effective.
An audit is one possible assessment tool, not an automatic requirement for every supplier in every situation. The SOP should set criteria for deciding whether an audit is needed and how its scope, findings, and follow-up are handled. Other evidence may be appropriate depending on risk and applicable requirements. A certificate or questionnaire alone may not establish that a specific material, site, or process is suitable for its intended use.
Approval should be specific. A supplier may be acceptable for one site, material, service, or use but not automatically qualified for all its offerings. Record the approved scope and any limitations. Define the decision authority—commonly involving quality and the relevant technical or business function—and ensure that the person requesting a supplier cannot bypass required review. If a decision is conditional, state the condition, responsible owner, deadline, and controls that apply until it is closed.
GMP Supplier Qualification SOP Template
Blank template: Complete the fields, add organization-specific instructions, and route the procedure through the applicable document-control process. Use “not applicable” with a reason where a field does not fit.
| Field | Entry |
|---|---|
| SOP title and document ID | ____________________________ |
| Version and effective date | ____________________________ |
| Purpose and scope | ____________________________ |
| Roles and approval authority | ____________________________ |
| Supplier, site, and item or service | ____________________________ |
| Intended use and quality impact | ____________________________ |
| Risk category and rationale | ____________________________ |
| Evidence and assessment activities required | ____________________________ |
| Assessment findings and corrective actions | ____________________________ |
| Qualification decision, scope, and conditions | ____________________________ |
| Approval names, roles, and dates | ____________________________ |
| Monitoring and reassessment triggers | ____________________________ |
| Record location and retention reference | ____________________________ |
Sample — fictional example only: Supplier: Example Materials Ltd.; site: Sample City; item: product-contact container; intended use: packaging for a controlled product; risk: elevated, because container integrity may affect product protection; assessment: review specifications and quality documents, then document whether further assessment is needed; decision: pending quality approval; restriction: do not purchase for production use until approval is recorded. This illustrates how to summarize a case; it does not prescribe a required risk category or assessment.
Records, Changes, and Ongoing Monitoring
Qualification is a continuing control, not a one-time filing task. Keep enough information to reconstruct what was assessed, what evidence was considered, who made the decision, and which version of the supplier’s information applied. The SOP should identify the record system or location, applicable retention controls, and how records are linked to the supplier, site, material, or service. Follow the organization’s document-control and record-retention procedures rather than inventing a separate retention period in the template.
Define events that trigger a review. Examples include a significant change to the supplier’s site, ownership, manufacturing process, specification, or subcontracting arrangement; repeated quality complaints; adverse delivery or test trends; a relevant audit finding; or a prolonged period without use. The exact triggers and timing depend on risk and the organization’s requirements. A change notification should be assessed before the affected supply is treated as unchanged, where the change could matter to quality.
Monitoring can use meaningful signals such as incoming inspection results, rejected lots, deviations, complaint patterns, delivery performance where relevant, and completion of agreed corrective actions. Monitoring should lead to decisions: continue approval, request action, increase oversight, restrict use, suspend, or disqualify. The SOP should assign responsibility for reviewing these signals and recording the rationale, including when no action is taken.
Common Problems and How to Avoid Them
A frequent weakness is treating a completed questionnaire as proof of qualification. A questionnaire is evidence, but it still needs review against the intended use and risk. Another problem is approving a supplier at company level while overlooking the actual manufacturing site, service location, or subcontractor involved. Identify the relevant scope so that approval is not broader than the assessment.
Teams can also create unnecessary delays by asking every supplier for identical documents or requiring audits without a risk-based reason. At the opposite extreme, a supplier may be selected for business reasons and only later sent through a superficial review. Involve quality and technical reviewers early, make the required evidence clear, and document why the chosen path is adequate.
Finally, avoid status labels that are unclear. “Approved” should not conceal open conditions, expired documents, or an unresolved major concern. Use defined statuses and make them visible to the people who purchase, receive, test, or use the supplied item or service. If a specific situation requires legal or regulatory interpretation, ask a qualified professional.
Frequently Asked Questions
Is there one required GMP supplier qualification SOP format?
No single format applies to every organization or product type. The procedure should meet applicable requirements and clearly describe the organization’s responsibilities, risk-based assessment, approval, records, and monitoring.
Does every GMP supplier need an audit?
Not necessarily. An audit is one assessment option, and whether it is appropriate depends on risk, the work performed, available evidence, and applicable requirements. The decision and rationale should be documented.
Can a distributor be qualified instead of the manufacturer?
A distributor may be part of the supply chain, but the organization should understand who makes or performs the supplied item or service and what controls apply. The appropriate review depends on the product, supply arrangement, and risk.
How often should an approved supplier be requalified?
There is no universal interval suitable for every supplier. Set review timing according to risk and define event-based triggers, such as significant changes or recurring quality problems.
What is the difference between supplier approval and qualification?
Qualification is the documented assessment process and its evidence. Approval is the authorized decision that defines whether, and within what scope or conditions, the supplier may be used.
Can this template be used as-is?
Use it as a drafting aid, not a complete quality system. Add local roles, decision criteria, applicable references, document controls, and process-specific requirements before approval and use.