Evaluation vs qualification
The two words are often used together, and the difference is worth stating:
- Supplier evaluation is the assessment: gathering and reviewing evidence about whether a supplier can meet your requirements.
- Supplier qualification is the documented conclusion that it can, for specific materials or services, under specific controls. It ends with approval and a place on the approved supplier list.
Qualification is not permanent. It must be maintained through monitoring and renewed through re-evaluation.
For a supplier qualification checklist specific to medical device makers, see Medical Device Supplier Qualification and Audit Checklist Under QMSR.
What the rules require
- ICH Q10 section 2.7: before outsourcing or selecting a material supplier, assess “the suitability and competence of the other party,” for example through audits or material evaluations and qualification.
- EU GMP Chapter 5: selection, qualification, approval and maintenance of starting material suppliers “should be documented as part of the pharmaceutical quality system” (5.27), with audits of active substance manufacturers and re-audits “at intervals defined by the quality risk management process” (5.29).
- ISO 13485:2016 clause 7.4.1 (incorporated into FDA’s QMSR since February 2, 2026): criteria for evaluating and selecting suppliers based on their ability to meet requirements, their performance and the effect of the purchased product on the device, with controls proportionate to risk.
- 21 CFR 211.84(d)(2) (US drugs): if you rely on a supplier’s certificate of analysis instead of full testing, you must perform at least one specific identity test and validate the supplier’s results at appropriate intervals. That validation is part of qualification.
The evaluation and qualification process
1. Define requirements and risk
State what you are buying: specification, grade, regulatory status, sterility, packaging. Assign a risk tier based on criticality and patient exposure. The tier decides how deep the evaluation goes.
2. Gather information
| Evidence | Typical content |
|---|---|
| Supplier questionnaire | Quality system, certifications, sites, change control, subcontractors |
| Certificates | GMP certificates, ISO 9001 / ISO 13485, drug master file references |
| Regulatory history | Inspection outcomes, warning letters, import alerts |
| Technical documents | Specifications, manufacturing flow, stability data, TSE/BSE and other statements |
| Supply chain map | Actual manufacturing site; distributors and brokers in between |
3. Assess capability
For higher-risk suppliers, an audit (on-site or remote, depending on risk and regulatory expectations). For lower-risk suppliers, a desk review may be enough.
4. Test material
Full testing of initial lots against your specification, and comparison with the supplier’s CoA. This establishes whether you can later rely on the CoA with reduced testing.
5. Agree
A quality agreement or purchasing agreement covering specifications, change notification, audit rights, complaint handling and responsibilities. FDA’s 2016 quality agreement guidance recommends keeping it separate from commercial terms because FDA may review it during inspections.
6. Approve
Quality approval, documented, with scope (which materials, which sites) and an expiry or re-evaluation date. Add the supplier to the approved supplier list.
7. Maintain and requalify
Monitor performance; re-audit and re-evaluate at risk-based intervals; requalify after significant changes. Disqualify when the supplier no longer meets requirements.
What FDA cited in 2026
FDA’s September 1, 2026 warning letter to Happy Farm Botanicals shows how qualification fails in practice:
- The firm “did not adequately qualify your (b)(4) supplier as the requalification date had lapsed.”
- It relied on supplier CoAs without validating the supplier’s results, and one API lot had only organoleptic testing.
- FDA asked for a comprehensive review of suppliers, including “selection, qualification, and disqualification” provisions, and the SOP for CoA validation.
Evaluation criteria and scoring
A simple, documented scoring model keeps evaluations consistent.
| Criterion | Weight (example) | Evidence |
|---|---|---|
| Quality system and certifications | High | Certificates, audit report |
| Regulatory compliance history | High | Inspection outcomes, regulatory actions |
| Technical capability for the material | High | Specifications, process description, test data |
| Change control and notification | Medium | Questionnaire, quality agreement |
| Supply chain transparency | High for APIs and high-risk excipients | Supply chain map, manufacturer CoAs |
| Delivery and capacity | Medium | Commercial data |
Record the reasoning, not only the score. ICH Q9(R1) highlights subjectivity as a weakness in risk assessments.
Common qualification failures
- Qualification dates that lapse without anyone noticing
- Distributors qualified without identifying the manufacturer
- CoA reliance without initial and periodic verification
- Audits accepted from third parties without assessing their scope and quality
- Qualification based on paperwork only, with no material testing
- No requalification after the supplier changes site or process
Supplier qualification checklist
- Requirements and risk tier defined
- Questionnaire, certificates and regulatory history reviewed
- Actual manufacturing site identified
- Audit performed where the risk tier requires it
- Initial lots fully tested and compared with CoAs
- Quality agreement signed for critical suppliers
- Approval documented with scope and expiry
- Approved supplier list updated
- Requalification date scheduled and tracked
- Disqualification criteria defined
Review qualification files with AskDona
Qualification files are bundles of questionnaires, certificates, audit reports, test data and agreements. AskDona reads them together and flags missing evidence, expired certificates, inconsistent site information and qualifications past their requalification date, each linked to the source page. Run a sample supplier qualification review on a supplier due for requalification. AskDona shows the evidence; your supplier quality team decides.
FAQ
What is supplier evaluation? The assessment of a supplier’s ability to meet your quality, regulatory and supply requirements, using documents, audits and material testing.
What is supplier qualification? The documented approval of a supplier for specific materials or services, following evaluation, with defined controls and a requalification date.
Is an audit always required? No. The depth of evaluation depends on risk. EU GMP expects audits of active substance manufacturers; lower-risk suppliers may be qualified by desk review.
How often should suppliers be requalified? At intervals based on risk and performance, and after significant changes. Do not let requalification dates lapse.
Can we rely on supplier certificates of analysis after qualification? In US drug manufacturing, only with an identity test on each lot and periodic validation of the supplier’s results under 21 CFR 211.84(d)(2).
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| ICH Q10 (FDA) | ICH guideline | Section 2.7 |
| EU GMP (EudraLex Vol. 4), Chapter 5: Production | EU GMP guideline | EU GMP 5.27 and 5.29 |
| EU GMP (EudraLex Vol. 4), Chapter 7: Outsourced Activities | EU GMP guideline | Chapter 7 |
| ISO 13485:2016, Medical devices: Quality management systems | International standard | ISO 13485 7.4.1 |
| 21 CFR Part 211 (eCFR) | US regulation | 211.84(d) |
| FDA warning letter, Happy Farm Botanicals (Sept 1, 2026) | FDA warning letter | Lapsed qualification; CoA validation |
| FDA Law Blog, FDA issues final quality agreement guidance (2016) | Law firm blog | Quality agreements |
| RQA, FDA Q9(R1) Quality Risk Management | Professional association news | Subjectivity |