How to Verify API Suppliers: Manufacturer, Supply Chain and Technical Checks
To verify an API supplier, define the exact material and market requirements; identify the original manufacturer and every site or intermediary; map the physical and commercial supply chains; reconcile specifications, batch data, packaging and stability support; and confirm that the candidate can supply the required grade through the proposed commercial route. This first-stage review establishes the source that will undergo GMP and regulatory verification in Part 2.
An API supplier should not advance merely because it offers an attractive price, provides a certificate of analysis or presents itself as an established pharmaceutical company. Before GMP certificates, CEPs or Drug Master Files can be evaluated meaningfully, the buyer must know exactly who manufactures the API, what material is being offered and how it will reach the buyer.
This is the foundation of API supplier verification: a documented desktop assessment of source identity, traceability and technical suitability. It does not approve the supplier, replace a GMP audit or demonstrate that a commercial batch will meet the buyer’s requirements.
Five foundations of a verifiable API source
Resolve these questions before relying on regulatory documents or committing resources to audit and sampling.
These are eligibility questions, not scoring categories. A commercial advantage cannot compensate for an unidentified manufacturer, an undisclosed processing site or a fundamentally unsuitable API grade.
Define the API and Market Requirements
Verification should begin with an approved requirement profile—not with documents submitted by the first company that answers an inquiry. Two suppliers can offer material under the same API name while proposing different salts, polymorphs, particle-size grades, manufacturing routes, impurity controls, packaging systems and regulatory support.
The initial profile should define enough information to ensure that every candidate is being assessed against the same intended use.
| Requirement area | What should be defined |
|---|---|
| Material identity | API name, salt or other form, CAS number, compendial status, sterile status and any required physical grade |
| Product-specific attributes | Particle size, polymorphic form, microbiological quality and other characteristics that can affect processing, stability, bioavailability or performance |
| Specification | Applicable monograph, buyer limits, required tests, analytical expectations and relevant impurity controls |
| Intended use | Finished product, dosage form, route of administration and development or commercial stage |
| Target markets | Countries, applicants and the expected CEP, ASMF, DMF, full-dossier or local regulatory route |
| Supply need | Development and commercial volumes, batch-size expectations, packaging, lead time and remaining retest period at receipt |
Terms such as “USP grade,” “Ph. Eur. grade” and “pharmaceutical grade” are not complete requirements. A pharmacopoeial monograph provides an important public standard, but the finished product may require tighter impurity limits, a defined particle-size distribution, a particular polymorph or additional microbiological controls.
The intended regulatory route must also be identified early. A source that can support one market may not possess the document, access rights or manufacturing arrangement needed for another. Part 2 explains how to verify the specific CEP, ASMF, DMF and GMP evidence offered by the candidate.
Identify the Supplier and Original API Manufacturer
The commercial contact may be the original manufacturer, a group company, an authorized distributor, an independent trader, an agent, a repacker or a company that performs additional processing before delivery.
None of these models is automatically unacceptable. Risk arises when the roles are unclear or when the commercial presentation creates the impression that one company performs activities actually carried out by others.
Classify each company by its actual role
| Role | What must be established |
|---|---|
| Original API manufacturer | Legal identity, manufacturing site, API confirmation, relevant operations and regulatory-document alignment |
| Contract or physical-processing site | Whether the site performs synthesis, testing, milling, micronization, sterilization or another operation affecting the API |
| Testing laboratory, repacker or relabeller | Responsibilities, site controls, batch traceability, packaging effect and relationship with the manufacturer |
| Authorized distributor or agent | Current manufacturer authorization, covered products or territories and access to original quality and regulatory information |
| Independent trader or broker | Complete source disclosure, traceability and ability to transmit quality, complaint, recall and change information |
ICH Q7 expects agents, brokers, traders, distributors, repackers and relabellers to maintain traceability and transfer quality and regulatory information between the original manufacturer and the customer. It also expects the original manufacturer’s identity and batch number to be provided. ICH Q7, sections 17.2 and 17.6
A distributor can therefore be an acceptable commercial partner, but “authorized distributor” should be treated as a relationship to verify—not a title to accept at face value.
Map the Complete API Supply Chain
The buyer should be able to follow the material from the original manufacturing process to the container that will arrive at its site. Recording only the final synthesis location is not enough.
Map every operation capable of affecting identity, purity, physical properties, packaging or traceability, including synthesis, purification, drying, milling or micronization, sterilization, testing, batch release, repackaging, relabelling, warehousing and transport.
Separate commercial flow from physical flow
- Commercial flow: who sells, purchases, invoices, imports and holds title to the API
- Physical flow: who manufactures, samples, tests, releases, stores, transports, opens, processes, repackages or relabels it
A batch may be sold through several companies without leaving the original manufacturer’s sealed container. Conversely, a single intermediary may open, divide and relabel it. The second arrangement normally creates greater direct quality risk even though fewer companies appear in the commercial chain.
Reconcile the documents with the material route
The quotation, manufacturer declaration, supply-chain statement, GMP evidence, regulatory dossier, original and reissued CoAs, labels, packaging specifications, quality agreements and shipping records should describe the same source.
If the quotation identifies Company A, the CoA identifies Company B and the GMP certificate covers Company C, the candidate has not been verified until the relationships and operations are documented.
For every relevant stage, record:
- Legal entity and exact site address
- Operation performed
- Batch-number relationship
- Document issued
- Contractual and quality responsibility
- Whether the operation is included in the proposed regulatory arrangement
Test traceability with one batch
Ask the candidate to demonstrate how a representative batch would be traced from the original manufacturer to the buyer. The example should connect the original batch number, any later lot or package number, the original CoA, additional laboratory results, packaging, dispatch records, storage locations and quantity reconciliation after any repackaging or division.
A generic process diagram may look convincing while concealing the fact that batch-level traceability cannot be produced. WHO guidance similarly emphasizes documented supplier approval, change control and traceability throughout the supply chain. WHO good trade and distribution practices for pharmaceutical starting materials
Build a Controlled Evidence Package
A supplier questionnaire is a collection tool, not proof that every answer is correct. Each material claim should be connected to evidence with a known issuer, owner, version, date, scope and verification route.
The initial package normally includes:
- Legal-entity, site and manufacturer-relationship records
- Manufacturer specification, representative commercial-batch CoAs and a high-level manufacturing and testing-site statement
- Relevant impurity, nitrosamine, elemental-impurity and residual-solvent information
- Physical-grade, packaging, storage, stability and retest support
- Supply-chain, contractor, traceability and business-continuity information
- Exact identities of the GMP and regulatory documents to be assessed in Part 2
For every critical document, record its title or number, issuer, owner, legal entity, site, API and activity scope, version, date, verification source, reviewer and conclusion. “On file” is not a meaningful status when the team cannot establish which version was reviewed or whether it represents the proposed supply arrangement.
Verify Technical Fit Before Requesting Samples
The desktop technical review does not prove batch conformity. Its purpose is to determine whether the offered material is scientifically and regulatorily plausible for the intended use—and whether enough controlled information exists to design representative sample testing later.
Compare the three specifications
Reconcile the applicable pharmacopoeial or public standard, the manufacturer’s release specification and the buyer’s proposed product-specific specification.
| Attribute | Central verification question |
|---|---|
| Identity and form | Do the documents describe the same salt, hydrate, solvate, stereochemical and physical form? |
| Assay and water | Are the analytical basis, correction factors, methods and limits compatible? |
| Related and mutagenic impurities | Do the controls reflect the actual process and product-specific risk? |
| Nitrosamines, solvents and elements | Are plausible process, recovery, catalyst and contamination sources addressed? |
| Physical attributes | Are particle size, polymorphic form, bulk density or other relevant characteristics defined and controlled? |
| Microbiological quality | Are microbial limits, specified organisms or endotoxins appropriate for the intended use? |
| Packaging and retest period | Does the proposed commercial container and retest period match the supported process, grade and storage conditions? |
Pharmacopoeial compliance should be treated as a minimum framework when process- or product-specific risks require additional controls.
Review batch data for consistency
Compare several recent and representative commercial-batch CoAs where available. Check whether all required tests are reported, methods and specification versions are consistent, results appear plausible, batch-to-batch variability is understood and the testing and release sites match the proposed chain.
A distributor-issued CoA should preserve the original manufacturer and batch identity and remain traceable to the original certificate. Repeated results at reporting limits do not by themselves prove falsification, but they may justify questions about method capability, rounding and access to the underlying data.
Connect impurity and physical-grade risks to the manufacturing route
A generic declaration that an API “complies with ICH” is not a process-specific impurity assessment. The buyer needs sufficient non-confidential knowledge of starting materials, reagents, solvents, catalysts, recovered materials, potential carryover, degradation products, nitrosamine risks and the controls applied during manufacture and release.
Physical properties require the same source alignment. Determine where milling, micronization, granulation, sterilization or another treatment occurs; which methods and sampling plans control it; whether commercial-scale consistency has been demonstrated; and whether the packaging, stability and regulatory evidence apply after processing.
A standard API covered by a regulatory dossier and a separately micronized version of the same API may not represent the same qualified source.
Confirm packaging, stability and retest support
The proposed commercial container should match the stability-supported system or be scientifically justified as equivalent or better. Review the primary container, liners and seals, protection from moisture or light, storage and transport conditions, stability batches, manufacturing and packaging sites, test trends and proposed retest period.
Pay particular attention when the material is repackaged, sterilized, micronized or otherwise processed after the stage represented by the available stability data. A label date cannot be evaluated separately from the process, grade and container to which the supporting evidence applies.
Technical output
The conclusion should state whether the material is technically aligned for later sampling, aligned with defined questions, not yet established or fundamentally unsuitable. It is a readiness conclusion—not approval of the API or supplier.
Screen Operational Suitability
A technically credible source can still fail as a dependable commercial option. Before regulatory verification and audit, confirm that the candidate can plausibly support the intended development, filing, launch and routine supply.
| Area | What should be established |
|---|---|
| Capacity and batch size | Realistically available capacity and compatibility with development, validation and commercial quantities |
| Lead time and inventory | Manufacturing, testing, release and transport timing, plus where stock is held and under whose quality system |
| Continuity | Critical raw-material, utility, equipment, site and logistics dependencies |
| Change and regulatory support | Responsible contacts, notification capability and support for authority questions and lifecycle filings |
| Commercial basis | Comparable grade, specification, quantity, packaging, Incoterms, testing obligations and regulatory-access costs |
Commercial criteria can compare candidates that satisfy mandatory identity and technical requirements. They should not be averaged with a critical quality or traceability failure. The cheapest quotation may create the highest total cost when it requires additional testing, regulatory remediation, repackaging or repeated investigation.
Complete the Source Profile Before Regulatory Verification
The output of Part 1 should be one controlled description of the proposed API source. Another qualified reviewer should be able to identify:
- The exact API, form, grade and preliminary buyer specification
- The intended product, applicant and target markets
- The original manufacturer and every relevant manufacturing, processing, testing and packaging site
- Every distributor, agent or other intermediary
- The commercial and physical supply routes
- The representative technical, packaging and batch evidence reviewed
- Known mismatches, unanswered questions and responsible follow-up owners
- The exact GMP records, CEP, ASMF, DMF or other regulatory documents claimed by the candidate
If manufacturer identity, site roles, traceability or fundamental technical suitability remains unresolved, pause the candidate before proceeding. A GMP certificate or regulatory dossier cannot repair uncertainty about what material it is supposed to support.
The next stage verifies whether the GMP position is credible and whether the proposed CEP, ASMF or DMF is current, correctly scoped, accessible and aligned with this source profile.
Continue to Part 2
Verify the official GMP position, regulatory history and the practical usability of the source’s CEP, ASMF or DMF.
Part 2 completes desktop verification and produces the advance, conditional advance, pause or reject decision before audit and representative sampling.