How to Qualify API Suppliers: GMP Audit, Sample Testing and Final Approval
API supplier qualification—sometimes called API vendor qualification—is the documented, risk-based process of establishing that a defined API source can meet GMP, technical, regulatory and quality requirements in routine commercial supply.
A verified API supplier is still only a candidate. Desktop evidence may establish who manufactures the material, which sites and intermediaries are involved, and whether the GMP and regulatory position is sufficiently credible to justify further work. It cannot demonstrate that the manufacturer’s systems operate effectively or that material from routine commercial production will meet the buyer’s requirements.
In practice, qualification should carry the verified candidate record into a risk-based GMP audit, resolution of findings through corrective and preventive action (CAPA), representative sampling and analytical testing, a working quality agreement, and one final source-approval decision. These activities answer different questions and cannot substitute for one another. Approval applies to the defined API source and intended use—not to the supplier’s general reputation.
The starting point is the candidate decision record created during desktop verification. It should already identify the sites, regulatory position, residual risks and questions assigned to audit or sample testing. If manufacturer identity, supply-chain traceability, regulatory-document usability or technical suitability remains materially unresolved, return to How to Verify an API Supplier: GMP, Regulatory and Supply-Chain Checks rather than using the audit to compensate for incomplete verification.
Plan the GMP Audit Around the API and Its Risks
The GMP audit should be designed around the API, the operations that affect it and the risks identified during desktop verification—not simply around the report already available or the least expensive option.
Three questions determine the approach: which sites must be assessed, whether the assessment should be on-site, remote or hybrid, and whether it will be conducted by the buyer or a qualified third party.
These decisions must also reflect the intended market. ICH Q7 supports a risk-based supplier-evaluation strategy and does not impose an on-site audit in every situation. EU expectations are more explicit: manufacturers and distributors of active substances should be audited, and EMA states that paper-based assessments cannot ordinarily replace an on-site audit of an active-substance supplier. ICH Q7 Questions and Answers, European Commission, EU GMP Chapter 5
A regulatory inspection or valid GMP certificate can inform audit priority, but it does not replace evaluation of the proposed API, manufacturing areas, physical grade, processing sites and supply arrangement.
Audit the operations that can affect the API
The organization selling the material is not necessarily the organization that must be audited.
The scope should follow the activities that can affect API identity, quality, purity, physical characteristics or traceability. In a straightforward arrangement, this may mean auditing one site that performs the final synthesis, purification, testing and packaging. In a more complex arrangement, separate micronization, contract-testing, sterilization, repackaging or storage facilities may also require assessment.
The depth of assessment should correspond to each site’s role. The original manufacturer should be examined against the applicable API GMP requirements. A distributor or warehouse requires greater attention to traceability, storage, transport, tamper evidence and communication with the manufacturer.
Auditing a distributor cannot establish that the original manufacturer complies with GMP. Likewise, an audit of the main synthesis site does not automatically cover a separately operated micronization or testing facility.
The audit scope should follow the API’s actual operations—not the supplier’s organizational chart.
Select an on-site, remote or hybrid assessment
An on-site audit normally provides the strongest evidence because auditors can compare procedures with actual facilities, practices and records. It is particularly important for an initial qualification involving a critical API, a complex or multipurpose facility, significant contamination or impurity risks, a complicated outsourced process, or a history of serious regulatory or data-integrity concerns.
Remote assessment is more suitable for preparatory document review, interviews, CAPA follow-up and interim reassessment. It can also help focus a later site visit. However, it limits the auditor’s ability to observe routine behaviour, select records independently and follow unexpected evidence through the facility.
A hybrid audit can therefore be useful: routine documents are examined remotely, while the on-site portion concentrates on manufacturing areas, warehouses, laboratory data, material flows and high-risk records.
| Circumstance | Generally appropriate approach |
|---|---|
| Initial qualification of a critical or technically complex API source | Comprehensive on-site audit |
| Stable source supported by a recent credible audit or inspection | Focused or hybrid reassessment, where regulations permit |
| Temporary inability to access the site | Remote interim assessment with a defined on-site follow-up |
| Serious compliance, quality or data-integrity concern | For-cause on-site audit |
The format should never be upgraded in description. A questionnaire remains a questionnaire, and a video meeting does not become equivalent to direct site observation merely because it is called a remote audit.
Evaluate third-party audits before relying on them
A qualified third party may conduct the audit when the buyer lacks local resources, language capability or specialist expertise, but responsibility for the qualification decision remains with the buyer.
Reliance requires more than an audit certificate or summary rating. The full report should cover the correct site, API and activities and identify the auditors, duration, areas examined, access restrictions, findings, CAPA and final assessment. Responsible quality personnel must have enough access to understand why the conclusion is credible.
The buyer must also evaluate auditor competence and independence. General pharmaceutical-audit experience may not be sufficient for sterile APIs, biological processes, complex chemistry, highly potent materials or laboratory data-integrity systems.
EMA’s current guidance specifically addresses contractual arrangements, auditor competence, scope and duration, CAPA follow-up and potential conflicts of interest when third-party reports are used. The resulting audit strategy should record why the evidence is applicable and which limitations require follow-up. EMA GMP and GDP audit guidance
Conduct the Audit Around Evidence—Not the Checklist
An API manufacturer may have well-written procedures, an impressive site presentation and a complete set of certificates. The audit must connect those documents to actual facilities, records, decisions and data to determine whether the controls work in practice.
The risks identified during desktop verification should determine where this examination begins. If the proposed API has a complex impurity profile, the audit should spend more time on process controls, changes and analytical data. If micronization is outsourced, the transfer of material and quality responsibilities between the sites becomes a priority. If previous inspections raised data-integrity concerns, the laboratory evidence requires greater depth.
ICH Q7 provides the GMP framework, but the audit should not give equal attention to every section merely to produce a complete-looking report. Greater effort should be directed toward the systems capable of affecting the proposed API and supply arrangement. ICH Q7
Build the audit around selected evidence trails
Pre-audit document review can save time, but it should prepare the investigation rather than replace it.
Before the audit, the team should identify evidence trails relevant to the known risks. A recently released commercial batch will usually provide the principal trail; where appropriate, a batch associated with a deviation, specification failure, process change, reprocessing operation or customer complaint can show how the manufacturer responds when something does not proceed as planned.
For a selected batch, the auditor should be able to move from material receipt and production records through equipment use, in-process results, deviations, laboratory data, quality-unit release and distribution. This is one connected examination of whether the batch can be reconstructed—not a separate checklist for each department.
The agenda should allow enough time in the warehouse, manufacturing areas, quality-control laboratory and quality unit. If the supplier refuses access to a relevant area, record or electronic system, the limitation should be documented and considered in the audit conclusion. It should not be quietly compensated for by reviewing additional procedures.
Follow the API through the site and its quality systems
The facility tour should follow the actual movement of the API and its materials, beginning with receipt and quarantine and continuing through production, testing, packaging, storage and dispatch.
The objective is not to inspect housekeeping in isolation. The auditor should compare what is observed with the approved process, site information, regulatory documents and batch records.
| Area examined | Central audit question | Examples of connected evidence |
|---|---|---|
| Materials and traceability | Can every critical material and processing step be traced to an approved source? | Receipt records, labels, status controls, supplier approval and batch reconciliation |
| Manufacturing and validation | Does the process operate within approved and scientifically justified controls? | Batch records, critical parameters, yields, deviations, validation and reprocessing history |
| Contamination and impurity control | Are carryover, cross-contamination and process-related impurities adequately controlled? | Facility design, equipment use, cleaning evidence, process knowledge and analytical controls |
| Laboratory and data | Are reported results supported by complete and reliable data? | Raw data, calculations, instrument records, audit trails, investigations and release decisions |
| Quality management | Does the system detect, investigate and prevent recurring problems? | Deviations, CAPA, changes, complaints, recalls and product-quality reviews |
| Outsourced activities | Does the manufacturer retain effective oversight of contractors? | Qualification records, agreements, data exchange, performance review and change communication |
The value of the table is in the connections between these areas. A change in a starting material may affect process performance and the impurity profile. That change should therefore be visible not only in the purchasing system, but also in change control, validation assessment, analytical evaluation and regulatory communication.
Similarly, an out-of-specification result should not be examined only as a laboratory event. The audit should establish whether the investigation considered manufacturing history, other batches, stability data, related methods and the possibility of a wider system failure.
Reconstruct reported results from the underlying data
Laboratory review deserves particular attention because the certificate of analysis (CoA) depends on the integrity of the data supporting it.
The auditor should select reported results and trace them back through the original records. This may include the sample identity, preparation records, instrument sequence, raw data, calculations, metadata, audit trail, review and final entry on the certificate of analysis.
The purpose is not to search for one missing signature. It is to determine whether the result can be reconstructed and whether all relevant data—including repeated, aborted or invalidated analyses—were retained and scientifically evaluated.
FDA guidance emphasizes that CGMP data must be reliable and accurate and that management is responsible for establishing a quality culture in which data-integrity problems can be identified and reported. FDA Data Integrity and Compliance With Drug CGMP
A manufacturer may have a detailed data-integrity procedure and still operate weak controls. Conversely, an isolated documentation error does not automatically establish deliberate manipulation. The auditor should evaluate the evidence, recurrence, potential impact and management response before reaching a conclusion.
Evaluate whether the systems work together
A compliant-looking document should not be evaluated in isolation.
For example, a deviation may appear properly closed, but repeated occurrence of the same problem may show that the CAPA was ineffective. A process change may have been approved internally, but the absence of customer notification may reveal a failure in the quality agreement. An annual product-quality review may have been completed on time, but it provides little assurance if adverse trends were not recognized or investigated.
The central question is whether the manufacturer detects problems, investigates them scientifically, assesses their wider impact, implements proportionate corrective action and confirms effectiveness. These connections often reveal more than a numerical audit score.
Each finding should distinguish an objective GMP deficiency from an auditor preference by stating the evidence, applicable requirement and potential effect on API quality or data reliability. At the closing meeting, factual misunderstandings may be corrected, but significant findings should not be weakened merely to obtain agreement.
The final report should state what was and was not examined, any access restrictions, the deficiencies identified and the overall conclusion. EMA similarly expects API audit reports to describe the relevant sites, activities, high-risk areas, evidence, finding classifications and manufacturer responses rather than provide only a generic compliance statement. EMA GMP and GDP audit guidance
Turn Audit Findings Into a CAPA Decision
The audit report should not end with a list of observations and a numerical score. It should explain whether the deficiencies identified affect confidence in the manufacturer, the API or the data supporting its release.
The same visible error can have very different significance. A missing signature on one controlled record may be an isolated documentation lapse. Repeated missing review signatures across production and laboratory records may indicate that the quality system is not functioning as described.
The auditor must therefore evaluate the cause, extent and potential consequence of each finding—not merely count how many were recorded.
Classify findings according to risk
Companies and regulatory authorities may use slightly different definitions, but the classification system should be established before the audit and applied consistently.
| Classification | Practical interpretation | Likely qualification effect |
|---|---|---|
| Critical | A failure that creates an unacceptable risk to API quality or patient safety, materially undermines data reliability, or involves serious falsification or concealment | Qualification normally stops until the issue is fully investigated, remediated and independently verified |
| Major | A significant GMP weakness that could affect quality, consistency, traceability or the effectiveness of an important system | Progression is paused or strictly conditioned until an acceptable response and required evidence are obtained |
| Minor | A limited departure that does not presently indicate a significant quality or system failure | May be addressed within an agreed CAPA period while other qualification work continues |
Classification should reflect the complete evidence. Several related minor findings may reveal a major system weakness, while one apparently isolated data-integrity finding may be critical if it prevents confidence in other records.
The absence of a confirmed defective batch does not automatically make a finding minor. If the manufacturer cannot demonstrate that its data are complete and reliable, the buyer may be unable to determine whether affected batches met specification at all.
EMA expects audit reports to identify deficiencies clearly, define their criticality and explain the classification system used. EMA GMP and GDP audit guidance
Evaluate the complete CAPA logic
A supplier response should do more than promise a revised procedure or additional employee training.
An acceptable response must connect the immediate problem to its underlying cause and demonstrate how recurrence will be prevented.
| CAPA element | Question the reviewer should be able to answer |
|---|---|
| Immediate control | What was corrected or contained as soon as the problem was identified? |
| Root cause | Why did the failure occur, and is the explanation supported by evidence? |
| Extent and impact | Which other batches, products, records, systems or customers may be affected? |
| Corrective action | What system change will address the cause rather than only the visible symptom? |
| Effectiveness | How and when will the manufacturer demonstrate that the action worked? |
For example, “the analyst was retrained” is rarely a complete response to repeated unofficial testing. The investigation should determine why the system permitted the practice, whether other analysts or products were affected, whether original data were retained, and whether supervisory and computerized controls were adequate.
The CAPA reviewer should distinguish between a submitted plan, actions that have been implemented and actions shown to be effective. Accepting the plan does not mean the finding is closed.
Evidence of completion may be reviewed remotely when the issue is documentary and limited. More serious or systemic findings may require examination of new operating records, an independent data review, additional testing or a follow-up audit at the site.
ICH Q7 states that audit findings and corrective actions should be documented and that agreed actions should be completed in a timely and effective manner. ICH Q7
Decide whether the audit supports further qualification
Once the report and supplier response have been evaluated, the audit should receive one controlled conclusion.
| Audit conclusion | Appropriate meaning |
|---|---|
| Satisfactory | The evidence supports an acceptable level of GMP confidence, and no unresolved finding prevents qualification from continuing |
| Satisfactory with defined actions | No unacceptable uncontrolled risk remains, but specified actions must be completed by agreed decision gates |
| Unsatisfactory | The deficiencies, unreliable evidence, restricted access or inadequate response prevent reliance on the site |
“Satisfactory with defined actions” is not appropriate when a critical issue remains open or the available data are too unreliable to assess impact. Each condition should identify the action, evidence, owner, deadline and the decision gate before which it must be resolved.
An unsatisfactory audit may lead to rejection or to a pause while substantial remediation is completed. The buyer should then determine whether documentary evidence is sufficient or a new on-site audit is required. Commercial urgency may influence timing, but it should not change the finding classification or the evidence required to control the risk.
The audit conclusion determines whether qualification may continue. Representative material must still be evaluated before the source can be approved.
Obtain Representative API Samples
A qualification sample should represent the API source that the buyer intends to use—not merely demonstrate the best material the supplier can prepare.
This distinction matters because a small sample may come from a development batch, a specially selected container or material produced before the current process and supply route were established. It may meet every test performed and still provide little evidence about routine commercial supply.
The sampling plan should therefore begin with provenance. The buyer should know which manufacturer and site produced the batch, whether it was made at the intended scale and through the proposed process, where any physical processing or repackaging occurred, and how the sample reached the testing laboratory.
Make the sample represent the proposed commercial source
Where commercial-scale material exists, the qualification sample should ordinarily come from a released batch manufactured through the same sites, process, grade and packaging arrangement proposed for supply. The batch should not be chosen solely by the supplier’s sales team without an understood selection rationale.
If only development or pilot material is available, it may still support formulation or method work. It should be identified as such and should not by itself establish that the future commercial material has been qualified. Confirmation with appropriately representative production material will still be required.
The commercial route also matters. A sample collected directly at the manufacturing site can support assessment of the manufacturer’s material, but it does not test the effects of a distributor’s storage, repackaging or transport. Where intermediaries physically handle the API, the qualification programme may need evidence from material that has travelled through the proposed route.
| Weak sampling evidence | More reliable qualification evidence |
|---|---|
| Unlabelled powder supplied by a commercial contact | Sealed, identified sample linked to a released manufacturer batch |
| Sample described only as “standard grade” | Exact form, grade, physical processing and specification confirmed |
| Special laboratory or pilot batch presented as commercial material | Routine production batch, or a clearly controlled plan for later commercial-batch confirmation |
| Sample sent outside the proposed supply route with no explanation | Provenance and route documented, with additional route-specific evaluation where needed |
Preserve identity and chain of custody
The sampling record should make it possible to reconstruct the sample’s movement from the batch and container selected through receipt by the testing laboratory. The record should connect the original manufacturer, batch number, sampling location and date, responsible sampler, container and seal information, quantity taken, packaging, transport conditions and condition on receipt.
Sampling should be performed under an approved procedure by appropriately trained personnel using suitable equipment and controls. The plan should consider whether the batch is homogeneous, how many containers make up the batch or shipment, whether sampling can expose the material to contamination or moisture, and whether the sample quantity supports the planned tests and necessary retention.
The number of containers and the sampling pattern should be scientifically justified. A convenient grab sample from the top of one drum is not automatically representative of a multi-container batch.
WHO guidance similarly treats sampling as a controlled operation requiring a defined plan, suitable containers, identification, storage and transport that preserve sample integrity. WHO guidelines for sampling of pharmaceutical products and related materials
After receipt, the sample should remain controlled under the laboratory’s procedures. Damaged seals, inconsistent labels, unsuitable transport conditions or discrepancies between the sample and certificate of analysis should be investigated before testing begins.
Choose batches according to risk—not a universal number
There is no single number of sample batches that proves an API supplier is qualified. The appropriate selection depends on the API, process, intended product, stage of development, known variability and available commercial history.
One batch may be enough for early method or formulation work, but it provides limited evidence of consistency. For a critical API or a new source, qualification will generally be stronger when material from more than one independently produced batch is evaluated. The batches should provide meaningful variation rather than multiple samples from the same production event presented as separate evidence.
Selection may consider different production campaigns, dates, equipment trains or relevant processing arrangements where these can affect the API. When extensive historical batch data are available, they should be considered alongside—not substituted blindly for—the buyer’s controlled sample evaluation.
The rationale should be documented. “Three batches” should not become an automatic rule applied without understanding what those batches represent.
Keep qualification sampling separate from incoming release
A sample used to qualify the source does not eliminate the controls required when commercial shipments begin.
Incoming-material requirements vary by jurisdiction and company procedure. In the United States, FDA explains that representative samples under 21 CFR 211.84 are generally expected to be taken from containers after receipt; pre-shipment or “piggyback” samples ordinarily do not satisfy that requirement. FDA also permits the manufacturer to determine the number of containers sampled when the plan is scientifically sound and representative. FDA questions and answers on component sampling
The qualification sample and the first received commercial shipment should therefore be treated as related but different evidence. The first supports the decision to proceed with the source. The second confirms that the material actually delivered through the approved route is correctly identified, intact and suitable for release under the applicable procedure.
A passing result is meaningful only when the buyer can establish exactly what was sampled and why it represents the proposed source.
Perform Analytical and Technical Sample Qualification
The receiving laboratory is not simply checking whether the supplier’s certificate of analysis says “passes.” It must determine whether representative material meets the buyer’s controlled requirements and whether the methods used can produce reliable, comparable results.
This stage should begin with the specification and risks established during verification. It should not reopen the documentary assessment or create a new test list after the sample results are known.
Use the agreed specification and suitable analytical methods
The testing plan should identify the specification, method and acceptance criteria applicable to each result. A supplier may report against a pharmacopoeial monograph or its own specification while the buyer’s regulatory filing or product requires additional or tighter controls. Qualification testing should therefore cover the buyer’s complete approved requirement—not only the tests selected for the supplier’s certificate of analysis.
The receiving laboratory must also establish that each analytical procedure is suitable in its own environment. Depending on the method and intended use, this may involve documented method transfer, verification or validation. Instruments, reference standards, sample preparation, calculation basis and system-suitability requirements must be sufficiently aligned for the results to be interpreted correctly.
ICH Q2(R2) defines the objective of analytical procedure validation as demonstrating that the procedure is fit for its intended purpose. The extent of work may vary, but the scientific justification should be documented. ICH Q2(R2)
Two laboratories can test the same batch and obtain different numerical results without either result being fraudulent or technically invalid. Different chromatographic conditions, reference standards, integration practices, moisture corrections or calculation bases may introduce systematic differences. These possibilities should be understood before the buyer compares its results with the supplier’s certificate.
Read the results as a material profile—not a collection of passes
Compliance with the specification is essential, but pass/fail statements alone can conceal meaningful differences between sources or batches.
| Evidence layer | What the evaluation should establish |
|---|---|
| Identity and general quality | The material is the intended API and meets the applicable assay, purity and other release requirements |
| Impurity profile | Observed impurities are consistent with the proposed route, adequately controlled and not suggestive of an undisclosed process difference |
| Physical characteristics | The form, particle properties and other relevant attributes match the grade required for the finished product |
| Risk-specific controls | Microbiological, residual-solvent, elemental, mutagenic or other tests are applied where justified by the API, process and intended use |
| Batch and CoA comparison | Results are reasonably consistent across representative batches and differences from the supplier’s data are understood |
| Product-specific suitability | Material attributes do not create unacceptable risk to formulation, processing, stability or finished-product performance |
A result can remain within specification and still deserve investigation. A consistent shift in assay, water content, particle-size distribution or an individual impurity may reveal a method bias, a process difference or variability that matters to the finished product.
The evaluation should therefore compare numerical results and patterns across batches, not merely count how many tests passed. Where the API is replacing an established source, comparison with the current source may also be necessary. Meeting the same pharmacopoeial monograph does not guarantee identical behaviour in blending, granulation, compression, dissolution or stability.
Not every theoretical impurity needs to be tested in every qualification sample. Additional testing should be driven by process knowledge, documentary risk assessment and intended use. The purpose is to challenge relevant risks—not to generate a large analytical package without a scientific question.
Investigate discrepancies before reaching a conclusion
When the buyer’s result differs materially from the supplier’s certificate, neither laboratory should be assumed wrong without investigation.
The investigation should first confirm sample identity and integrity, method versions, reference standards, preparation procedures, calculation and reporting bases, and the raw data supporting both results. Resampling or retesting may be appropriate when scientifically justified, but testing should not continue selectively until a passing result appears.
An isolated and explained method difference may be manageable through method alignment or an agreed correction. An unexplained discrepancy, recurring atypical pattern or failure to provide underlying data weakens confidence in both the material and the supplier’s CoA system.
The analytical conclusion should distinguish among three outcomes. Material may be considered analytically qualified when representative samples meet the controlled requirements and significant differences are understood. It may be restricted to development use when only pilot material is available or commercial-batch confirmation remains outstanding. It should not be qualified when results fail, important discrepancies remain unresolved, or product-specific attributes are unsuitable.
Analytical qualification also does not automatically justify reduced incoming testing. Where a manufacturer intends to rely on supplier CoA results, the applicable regulatory framework and internal procedure determine how analytical reliability must be established and periodically reconfirmed. FDA, for example, requires appropriate validation of supplier test results at suitable intervals when a US drug-product manufacturer relies on those results instead of performing every specified test. FDA questions and answers on component testing
Analytical qualification is complete only when the buyer understands what was tested, why the methods are suitable, how the batches compare and whether the observed material attributes are acceptable for the intended product.
Finalize Quality Responsibilities and Approve the Exact API Source
A satisfactory audit and acceptable sample results provide the evidence needed to consider approval. They do not by themselves define how the supplier and buyer will control the relationship after commercial supply begins.
Before final approval, the parties must convert the commitments made during qualification into workable responsibilities. Otherwise, the supplier may pass the initial assessment while later changing a site, process, test method, distributor or packaging arrangement without the buyer receiving the information needed to protect the product and regulatory filing.
Convert commitments into a working quality agreement
The quality agreement should identify the API, grade, sites and parties to which it applies. It should use the same manufacturer and supply-chain identities established during verification; a generic agreement with a corporate group or distributor may leave the actual manufacturing responsibilities uncontrolled.
The document does not need to reproduce every GMP requirement. Its purpose is to make the interfaces between the parties clear.
| Control area | What the agreement should establish |
|---|---|
| Scope and release | Applicable API, grade, sites, specification, certificate of analysis, testing responsibilities and release status |
| Changes and regulatory support | Which manufacturing, material, method, specification, site or regulatory-document changes require notification, assessment or prior agreement |
| Quality events | Communication and investigation of deviations, atypical or out-of-specification results, complaints, defects, recalls and relevant regulatory actions |
| Outsourced operations and supply chain | Approved contractors, distributors, processors and repackagers, together with controls on introducing or changing them |
| Records and oversight | Audit access, document and sample retention, access to supporting data, responsible contacts and timelines for critical communications |
Change control deserves particular care. A statement such as “the supplier will notify significant changes” is incomplete unless the parties understand what significant means, who evaluates regulatory and technical impact, and how much notice is required.
The agreement should distinguish changes requiring advance information from those that require the buyer’s approval before implementation. The commitments must also be realistic. A distributor cannot promise direct control over the manufacturer’s process unless that obligation is supported by its own agreement with the original manufacturer.
Where the commercial supplier is a distributor, the quality arrangement must preserve communication across the complete chain. Relevant information should move from the manufacturer to the distributor and buyer, while complaints, investigations and regulatory questions must be capable of moving back to the responsible manufacturer without distortion or delay.
ICH Q7 similarly expects quality or regulatory changes to be communicated through the supply chain, including by agents, brokers, distributors, repackers and relabellers. ICH Q7
Commercial terms such as price, payment, forecasts and liability may remain in the supply contract. The quality agreement should not be weakened to resolve a commercial negotiation, and the commercial contract should not authorize substitutions or changes that bypass quality and regulatory assessment.
EU GMP Chapter 5 states that appropriate aspects of production, testing, control, handling, labelling, packaging, distribution, complaints, recalls and rejection procedures should be documented in a formal quality agreement or specification. European Commission, EU GMP Chapter 5
Make one integrated source-approval decision
The final review should bring the evidence together without converting it into an average score. A strong result in one area cannot cancel a mandatory failure in another.
| Decision | Appropriate meaning |
|---|---|
| Approved | Verification, audit, representative-material evaluation and required agreements support use of the defined source |
| Approved with defined limitations | No unacceptable risk remains, but use is restricted—for example to development, a named product or market, or enhanced testing of initial commercial batches |
| Paused | Approval cannot be granted until specified evidence, CAPA, regulatory access or contractual controls are completed |
| Rejected | The source is unsuitable, evidence is unreliable, serious risk remains uncontrolled or the supplier will not accept essential responsibilities |
Approval with limitations must not be used to carry an unresolved critical audit finding or failed analytical result into commercial use. Its restrictions should be explicit, enforceable and visible in the purchasing and material-control systems.
The decision should apply to the exact source evaluated: the API and grade, original manufacturer, manufacturing and processing sites, specification, regulatory route, distributor and commercial supply chain. A change to one of those elements may require assessment before the approval can be extended.
Quality, technical, regulatory, procurement and legal functions may all contribute evidence, but the authorized quality process should control the approval status. The final record should explain the decision, any limitations, the controls for initial commercial receipts and the point at which continued suitability will be reviewed.
Once approved, the source should be entered into the controlled supplier and material systems with enough detail to prevent purchasing from an unapproved site, grade or intermediary under the same company name.
Approval should remain subject to continuing oversight. Incoming test results, agreement with supplier CoAs, deviations, complaints, regulatory developments and change notifications should be reviewed for signals that the original qualification assumptions are no longer valid.
Reaudit and requalification intervals should be risk-based rather than automatic. A stable source may justify a longer interval, while serious quality events, material changes or declining performance may require immediate reassessment.
When a change affects the approved API, grade, site, process, specification, regulatory document or supply route, the buyer should determine whether the existing approval remains valid, requires additional evidence or must be suspended.
Frequently Asked Questions About API Supplier Qualification
What are the main steps in API supplier qualification?
The process begins with desktop verification of the supplier, original manufacturer, supply chain, technical fit and regulatory support. A candidate that advances then moves through a risk-based GMP audit, CAPA resolution, representative sampling, analytical and technical qualification, a quality agreement and approval of the exact API source. Ongoing monitoring and event-based requalification maintain that approval after commercial supply begins.
Is an on-site audit always required to qualify an API supplier?
Not under every framework or circumstance. ICH Q7 supports a risk-based supplier-evaluation strategy, while EU requirements place more explicit audit obligations on manufacturers using active substances. EMA states that remote or paper-based assessments may support the audit programme but cannot ordinarily replace an on-site audit of an active-substance supplier. The intended market and applicable legal responsibilities must therefore be considered.
How many API batches should be tested during supplier qualification?
There is no universal number. The selection should reflect the API’s risk, process variability, intended product and available manufacturing history. One batch may support early development, but qualification of a critical or new commercial source will generally be stronger when independently produced, representative batches are compared. The rationale matters more than automatically requesting “three batches.”
Does a passing API sample mean that the supplier is approved?
No. A passing result applies only to the sample and tests performed. Final approval also depends on verified provenance, an acceptable GMP audit, resolution of material findings, usable regulatory support and defined quality responsibilities.
Can the buyer rely on the supplier’s certificate of analysis after qualification?
Only when permitted by the applicable regulatory framework and supported by evidence that the supplier’s results are reliable. Initial comparison, periodic confirmation and continuing review of discrepancies are normally required. Qualification of the source does not automatically eliminate identity testing or other incoming controls required for each received batch.
From Candidate to Approved API Source
The completed qualification record should leave no ambiguity about the exact API source approved. The audit report, representative-sample results, CAPA assessment and quality agreement should support one traceable decision.
Candidate discovery may begin in the GXgate Pharmaceutical Directory, but source approval does not: every listed company must still pass the verification and qualification process described in this series.