Supplier Qualification vs Supplier Audit: What Is the Difference

Two Related but Distinct Activities

Supplier qualification and supplier audit are often used interchangeably, but they are different activities with different purposes. Qualification is the process of determining whether a supplier is suitable to supply. An audit is one method used to make that determination, but it is not the only one, and it is not the same thing as qualification.

Understanding the difference matters because regulators expect both to be done properly, and because confusing them can lead to gaps in oversight.

What Supplier Qualification Is

Supplier qualification is the overall process of evaluating a supplier and deciding whether to approve them. It includes gathering information, assessing risk, reviewing documentation, and applying controls. Qualification is a decision, and it should be documented.

Qualification typically includes:

Risk Assessment

Assessing the risk the supplier poses based on the materials or services supplied, the criticality to the product, and the supplier’s compliance history.

Documentation Review

Reviewing the supplier’s quality documentation, certifications, and regulatory status.

Questionnaire

Sending a questionnaire to gather information about the supplier’s systems and capabilities.

Audit

Conducting an audit where the risk justifies it. The audit is one input to qualification, not the whole of it.

Quality Agreement

Establishing a written agreement that defines responsibilities and communication.

Approval Decision

Documenting the decision to approve, approve with conditions, or reject.

What a Supplier Audit Is

A supplier audit is an independent review of a supplier’s facilities, systems, and practices against GMP requirements. It is a method of gathering evidence. It can be used for qualification, for ongoing oversight, or for for cause investigation.

An audit is not a qualification. A supplier can be qualified without an audit if the risk is low and other controls are sufficient. A supplier can be audited and still not be qualified if the audit reveals problems that cannot be resolved.

The Regulatory Context

ICH Q7 and Supplier Qualification

ICH Q7 requires API manufacturers to audit critical suppliers and maintain documented qualification programs. The qualification program includes risk assessment, documentation review, and audits where appropriate.

EU GMP Chapter 7 and Outsourced Activities

Chapter 7 of EudraLex Volume 4 requires the contract giver to ensure that outsourced activities comply with GMP. Qualification and ongoing oversight are part of that responsibility.

FDA 21 CFR 211.84 and Supplier Evaluation

Suppliers of components must be evaluated and approved. The evaluation can include questionnaires, audits, and performance monitoring, depending on risk.

ICH Q10 and External Provider Management

ICH Q10 treats external providers as part of the pharmaceutical quality system. Their performance must be monitored and managed, which includes qualification and ongoing oversight.

When to Audit and When Not To

Audit When Risk Is High

Critical suppliers, single source suppliers, and suppliers of materials with direct product impact should generally be audited.

Audit When Documentation Is Insufficient

If questionnaires and documentation do not provide enough evidence, an audit may be needed.

Audit When Issues Arise

For cause audits are appropriate when a supplier has a quality issue, a regulatory observation, or a significant change.

Do Not Audit When Risk Is Low and Other Controls Are Sufficient

Low risk suppliers may be qualified through questionnaires and performance monitoring without an audit. The decision should be documented.

Common Mistakes

Treating a Questionnaire as a Qualification

A questionnaire is an input, not a qualification. The decision to approve must be documented separately.

Treating an Audit as a Qualification

An audit provides evidence. The qualification decision must still be made and documented.

Not Reassessing Qualification

Qualification is not a one time event. It should be reassessed when the supplier changes, when issues arise, or at defined intervals.

Not Linking Qualification to Ongoing Oversight

Qualification should be followed by ongoing monitoring. A supplier that was qualified five years ago and not reviewed since is not under control.

Introducing GxP Cellators for Supplier Qualification and Audits

GxP Cellators provides supplier and vendor GMP audits that verify your raw material, component, and service providers meet GMP requirements. We audit API manufacturers, excipient suppliers, primary packaging manufacturers, and contract service providers. Audits are conducted before qualification, periodically during the supplier relationship, and when significant changes occur.

We also help companies build supplier qualification programs, including risk classification criteria, audit schedules, questionnaire templates, and performance monitoring. Our audits evaluate supplier quality systems, manufacturing controls, documentation practices, and data integrity.

Our auditors bring regulatory inspection and industry quality experience across FDA, EMA, Health Canada, MHRA, WHO, and PIC/S frameworks. We deliver clear, prioritized reports with practical remediation guidance.

Get Qualification and Audits Right

Visit https://www.gxpcellators.com/gmp-auditing/ for service details. Email or use https://www.gxpcellators.com/contact/ to discuss your supplier program.

Frequently Asked Questions About Supplier Qualification and Audits

Is an audit required for every supplier?

No. Audits are required where risk justifies them. Low risk suppliers may be qualified through questionnaires and performance monitoring. The decision should be risk based and documented.

Can a supplier be qualified without an audit?

Yes, if the risk is low and other controls are sufficient. The qualification decision and the rationale should be documented.

What is the difference between qualification and approval?

Qualification is the process of evaluating a supplier. Approval is the decision to use them. Qualification leads to approval, but they are not the same step.

How often should qualification be reassessed?

At defined intervals and when significant changes occur. Many companies reassess every two to three years, or sooner if issues arise.

What should a quality agreement include?

Responsibilities for production, quality control, deviations, changes, complaints, recalls, and audits. It should also specify communication channels and timelines.

Can you help us build a supplier qualification program?

Yes. We design risk classification criteria, audit schedules, questionnaires, and performance monitoring. We can also train your team to maintain it.

How do I request a supplier audit?

Email or use https://www.gxpcellators.com/contact/. Service details are at https://www.gxpcellators.com/gmp-auditing/.