Pharma vendor selection should be decided by documented evidence of GMP suitability for the intended use, not by price, capacity or commercial preference alone. Before contracting, define what the proposed supplier will provide, assess the GxP criticality of that activity or material, request proportionate evidence, apply pre-agreed disqualifiers and scoring criteria, and record a cross-functional approval decision. This is the selection stage only: the selected candidate must then enter formal supplier qualification and onboarding. Read GuideGxP’s supplier qualification and vendor assurance guide for that subsequent lifecycle activity.
For EU GMP operations, Chapter 7 states that outsourced activities must be defined, agreed and controlled, and that the contract giver is ultimately responsible for ensuring control. Chapter 5 requires manufacturers to ensure that materials are purchased from approved suppliers. FDA’s quality-agreement guidance explains FDA’s current thinking on how owners and contract facilities can define their respective responsibilities; it is guidance, not a legally binding rule. ICH Q10 is an international consensus guideline describing a pharmaceutical quality system that extends across outsourced activities and purchased materials. The scorecard and gate below are GuideGxP implementation advice: adapt them to your product, market, quality system and risk assessment.
1. Start with intended use, not a supplier questionnaire
A generic vendor questionnaire can conceal the risk that matters. Begin with a concise requirement statement agreed by Quality, the technical owner and Procurement. It should identify the material, service or operation; the product and patient impact; the intended markets; the proposed site or sites; expected volumes; and the point at which the vendor’s output enters your controlled process.
Classify the proposed relationship by its intended use and GxP criticality. Examples include critical starting or packaging materials, contract manufacture, contract testing, sterilisation, storage or distribution, and critical technical services. The classification is not merely a Procurement category: it determines what evidence is needed before a candidate can be selected and how much uncertainty the business can reasonably accept.
Set selection requirements before seeing proposals
- Quality and regulatory fit: the applicable GMP context, product-specific requirements, site capability and market needs.
- Technical fit: process, analytical, containment, sterility assurance or other capability relevant to the proposed use.
- Data and records: the ability to generate, review, retain and provide reliable records needed for your activity.
- Supply continuity: capacity assumptions, lead times, geographical dependencies, single points of failure and contingency approach.
- Commercial model: quoted price, change-related costs, transfer costs, logistics, quality oversight and the financial effect of foreseeable disruption.
Do not treat a vendor’s self-description as proof. At selection, the aim is to establish whether there is enough credible evidence to proceed to qualification, not to declare a supplier qualified prematurely.
2. Build a minimum due-diligence data room
Request the same core evidence from comparable candidates and maintain version control of what was received, when it was reviewed and by whom. This creates a defensible comparison and avoids allowing a polished sales response to outweigh missing quality evidence.
Minimum evidence request
- Legal entity, relevant operating site or sites, scope of the proposed supply or service, and named quality contact.
- Relevant quality-system overview and available evidence supporting GMP capability for the proposed activity.
- Site, equipment, laboratory or service capability information relevant to the intended use.
- High-level description of document control, deviation handling, change control, CAPA and training arrangements.
- Data governance information proportionate to the activity, including how original records, corrections, access and review are controlled.
- Complete disclosure of proposed subcontracted activities, subcontractor locations and the vendor’s oversight model.
- Capacity, supply-chain and business-continuity information relevant to the forecast and product risk.
- Commercial proposal showing assumptions, exclusions, lead times and quality-related charges or dependencies.
- Declaration of actual or potential conflicts of interest for people participating in the selection decision.
EU GMP Chapter 7 says the contract giver should assess the legality, suitability and competence of the contract acceptor to carry out the outsourced activities. That expectation should shape the evidence request. It does not mean that a certificate, presentation or commercial reference alone demonstrates suitability for your particular intended use.
3. Use disqualifiers first, then a weighted scorecard
A weighted score can help compare viable candidates, but it should never convert a fundamental GMP concern into an acceptable result. Establish non-compensable disqualifiers before scoring. Examples of selection-stage disqualifiers may include inability to support the required intended use, refusal to disclose material subcontracting, unresolved concerns about the credibility of data supplied, or a proposal that cannot meet an essential legal, quality or technical requirement. These are example decision rules, not regulator-set disqualifiers.
The following matrix is illustrative GuideGxP advice only. The weights, rating definitions and approval threshold must be set by your organisation; they are not EU GMP, FDA or ICH acceptance limits. Use a consistent rating scale, record the evidence supporting each rating, and identify uncertainties rather than silently assuming they are favourable.
| Criterion | Illustrative weight | Selection-stage evidence to examine | Example decision question |
|---|---|---|---|
| GMP and quality-system suitability | 25% | Quality-system overview, relevant scope and issue-management approach | Is there credible evidence that the candidate can support this intended use? |
| Technical and operational capability | 20% | Relevant process, test, sterilisation or service capability; capacity assumptions | Can the work be performed as proposed at the identified site? |
| Data integrity and records | 15% | Record lifecycle, review, access and correction controls proportionate to the activity | Can required quality evidence be generated and relied upon? |
| Subcontracting and oversight | 10% | Declared subcontractors, responsibilities and oversight arrangements | Is the actual supply chain visible and controllable? |
| Supply continuity | 10% | Capacity, dependencies, continuity planning and logistics assumptions | What could interrupt supply, and how would it be managed? |
| Risk-adjusted total cost | 10% | Quoted price plus transfer, oversight, logistics, change and disruption considerations | Is the commercial case sound after foreseeable quality and continuity costs? |
| Collaboration and governance fit | 10% | Responsiveness, escalation model and willingness to define responsibilities | Can the parties govern the relationship effectively? |
Risk-adjusted total cost is not a formula imposed by GMP. It is a practical way to stop a low unit price obscuring likely costs of technology transfer, additional oversight, delayed release, investigations, supply interruption or change management. Keep its assumptions visible and avoid presenting speculative values as facts.
4. Test the areas that most often distort a selection decision
Data integrity
Ask how the candidate controls the records that will support your batch, test, service or release decisions. Focus on the proposed activity: who creates records, who reviews them, how corrections are attributable, how access is managed, and how records will be available to the contract giver where needed. A vague assurance that systems are compliant is weaker than a clear, reviewable explanation of controls and responsibilities.
Subcontracting
Undeclared or poorly explained subcontracting can invalidate a comparison because the evaluated candidate may not be the party actually performing the critical work. EU GMP Chapter 7 requires outsourced activities to be defined, agreed and controlled. At selection, obtain a clear map of proposed subcontracted steps and decide whether each is acceptable for the intended use. Do not allow a later commercial change to introduce a different critical performer without Quality review.
Continuity, independence and conflicts
Selection should examine reliance on a single site, specialist, utility, route or external provider where that reliance could affect availability. It should also separate evidence review from commercial advocacy. Require participants to declare conflicts, document how they are managed, and ensure Quality has a meaningful role in evaluating GMP suitability. A preferred incumbent or an urgent business need may explain why a candidate is being considered, but cannot override an identified suitability concern.
5. Hold a documented approval gate
The gate is a decision meeting, not a retrospective signature chase. Quality, Procurement, the technical owner and relevant functions such as QC, Manufacturing, Validation, Supply Chain, Regulatory Affairs or QP should review the same evidence pack. The exact attendees should reflect the proposed activity and your governance model.
Decision-gate agenda
- Confirm intended use, criticality and selection requirements.
- Confirm declared sites, scope and subcontracting model.
- Review disqualifiers, open questions and evidence gaps.
- Review scorecard rationale and risk-adjusted commercial assumptions.
- Compare continuity risks and proposed mitigations.
- Declare and manage conflicts of interest.
- Decide: do not select, select conditionally for qualification, or select for progression to formal qualification.
- Assign owners and due dates for all hand-off actions.
The approval memo should state the decision, candidates considered, intended use, criticality rationale, evidence reviewed, disqualifier outcome, scorecard summary, material uncertainties, conflicts declared, conditions attached and named approvers. It should be clear that selection approval is not supplier approval for use in GMP operations.
6. Inspection-ready selection and hand-off checklist
- Requirement statement and intended-use classification are approved before comparison.
- Comparable candidates received a proportionate, controlled evidence request.
- Evidence is indexed, dated and linked to reviewer conclusions.
- Non-compensable disqualifiers were defined and assessed.
- Scorecard weights and rating rationale are documented as internal decision criteria.
- Data-integrity and record-access questions were considered for the proposed activity.
- All subcontracted activities and relevant sites were disclosed and assessed.
- Continuity dependencies and commercial assumptions are visible in the decision record.
- Conflicts of interest were declared and managed.
- The approval memo identifies conditions, owners and due dates.
- The selected candidate is handed to formal qualification; no GMP use is authorised merely by this selection decision.
FAQ
Can Procurement select the lowest-cost GMP vendor?
Procurement can assess commercial value, but commercial preference cannot override GMP suitability for the intended use. Quality and technical evidence must be part of the documented decision.
Does a high score qualify a supplier?
No. A scorecard is a selection aid. Formal qualification, appropriate controls and any necessary agreements remain separate activities.
Are scorecard weights mandated by EU GMP or FDA?
No. The illustrative weights in this article are GuideGxP implementation advice. EU GMP Chapter 7 sets expectations for control of outsourced activities; FDA’s quality-agreement document is guidance; ICH Q10 is a consensus guideline.
Primary sources and how to use them
- EU GMP Chapter 5: Production — including expectations concerning materials and approved suppliers.
- EU GMP Chapter 7: Outsourced Activities — the primary EU GMP reference for defining, agreeing and controlling outsourced activities.
- ICH Q10 Pharmaceutical Quality System — international consensus guidance on a quality system across the product lifecycle, including outsourced activities and purchased materials.
- FDA: Contract Manufacturing Arrangements for Drugs: Quality Agreements — FDA guidance on delineating manufacturing activities and responsibilities between owners and contract facilities.
Turn the method into an audit-ready system
Operational Guide to the Role of the QA Manager in the Pharmaceutical Industry is an optional GuideGxP operational resource for deeper methods, checklists and ready-to-adapt tools. It is not regulator-endorsed.
