What supplier risk assessment means in life sciences
In general business, supplier risk assessment covers financial health, geopolitical exposure, cyber security and continuity of supply. Those matter in pharma and medical devices too. But regulators add a dimension other industries do not have: the risk that a supplier’s material or service harms patients.
Regulations expect supplier controls to be proportionate to risk:
- ICH Q10 section 2.7 requires companies to assess “the suitability and competence of the other party” before outsourcing or selecting suppliers, and to monitor them afterwards.
- ISO 13485:2016 clause 7.4.1, incorporated into FDA’s QMSR since February 2, 2026, requires supplier controls proportionate to the risk associated with the medical device.
- EU GMP Chapter 5 says re-audit intervals for active substance suppliers should be “defined by the quality risk management process.”
A lesson in why it matters: DEG and EG
In 2022 and 2023, diethylene glycol (DEG) and ethylene glycol (EG) contamination of oral liquid medicines was linked to more than 300 deaths in at least seven countries, according to FDA. In May 2023, FDA issued guidance on testing high-risk components such as glycerin, propylene glycol and sorbitol solution. The guidance expects the identity test for each lot to include a DEG and EG limit test, with samples from all containers, and it noted that a certificate of analysis “was often a copy of a COA on the letterhead of the distributor.”
The lesson for supplier risk assessment is that the supply chain behind a supplier matters as much as the supplier. Distributors, brokers and repackers add risk if you cannot trace the material back to its manufacturer.
Risk factors to assess
| Factor | Questions | Higher risk when |
|---|---|---|
| Material criticality | Does the material affect a CQA or device safety? | API, sterile component, critical device part |
| Patient exposure | Route of administration, dose, population | Parenteral, pediatric, high daily intake |
| Contamination potential | Microbial, TSE, DEG/EG, nitrosamines, elemental impurities | Known contamination history for this material class |
| Supply chain transparency | Direct from manufacturer or via distributors? | Brokers, repackers, unknown origin |
| Supplier compliance history | Inspections, warning letters, import alerts, audit findings | Recent regulatory action or unresolved findings |
| Quality system maturity | Certifications, audit results, CAPA effectiveness | No relevant GMP or ISO 13485 system |
| Change control | Does the supplier notify changes? | No change notification agreement |
| Single source | Alternatives available? | Sole source, long qualification lead time |
| Geography and continuity | Location, capacity, financial stability | Concentrated in one region; capacity constraints |
The EU model: formalized risk assessment for excipients
The EU’s 2015 Guidelines on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients give a useful template for any material type. Marketing authorization holders had to complete these assessments by March 21, 2016. The guidelines require:
- Assessing risk “from its source” through to the final dosage form, covering TSE, microbial and endotoxin contamination and impurities (section 2.3)
- Considering “the pharmaceutical form and use of the medicinal product containing the excipient,” its function and daily intake (section 2.4)
- Classifying risk and defining the GMP controls needed, then performing a gap analysis of the excipient manufacturer, with outcomes ranging “from acceptance through control to unacceptable” (section 3.5)
- Ongoing review through defect tracking, trend analysis, audits and questionnaires (section 4.1)
Scoring and tiering
A practical approach:
- Score inherent risk of the material or service (criticality, exposure, contamination potential).
- Score supplier risk (compliance history, quality system, supply chain transparency).
- Combine into a tier: for example high, medium, low.
- Assign controls by tier.
| Tier | Typical controls |
|---|---|
| High | On-site audit before approval and at short intervals; full testing or validated CoA reliance with identity testing every lot; quality agreement; change notification; close performance monitoring |
| Medium | Audit or detailed questionnaire; periodic audits; reduced testing with CoA verification at defined intervals |
| Low | Questionnaire and certificates; incoming inspection; periodic review |
ICH Q9(R1) cautions against high subjectivity in risk scores. Document the reasoning behind each score, not just the number.
What supplier risk management software does
The software market splits into two families:
| Type | Focus | Typical data |
|---|---|---|
| Supply chain risk platforms | Continuity, financial, geopolitical, ESG, cyber | News feeds, financial data, sanctions lists, logistics events |
| Supplier quality management (SQM) systems | Qualification, audits, nonconformances, SCARs, quality agreements | Your own QMS records and supplier documents |
Life sciences companies usually need the second, and benefit from the first for critical suppliers. Useful features: risk scoring with documented rationale, links to audit and nonconformance records, regulatory status monitoring (warning letters, import alerts), change notification tracking and re-evaluation scheduling.
Common weaknesses
- Risk assessed once, at approval. Risk changes when the supplier, material or market changes.
- Distributor treated as manufacturer. The actual manufacturing site is unknown.
- Scores with no rationale. A “medium” rating nobody can explain.
- Controls not linked to tier. High-risk suppliers audited no more often than low-risk ones.
- Regulatory signals missed. A supplier receives a warning letter and nobody notices.
Supplier risk assessment checklist
- Material criticality and patient exposure assessed
- Contamination risks specific to the material class considered (for example DEG/EG)
- Supply chain traced to the actual manufacturer
- Supplier compliance history checked, including regulatory actions
- Risk tier assigned with documented reasoning
- Controls (audit, testing, agreements) linked to tier
- Re-assessment triggered by changes and performance signals
- Periodic review scheduled
Assess supplier risk with AskDona
Supplier risk assessments rely on documents: questionnaires, certificates, audit reports, CoAs and quality agreements. AskDona reads them together and flags inconsistencies, such as a manufacturing site in a CoA that differs from the one in the questionnaire or a quality agreement without change notification terms, with links to the source pages. Run a sample supplier risk assessment on a high-risk material. AskDona shows the evidence; your supplier quality team decides.
FAQ
What is a supplier risk assessment? An evaluation of how likely a supplier is to cause quality, compliance or supply problems, and how severe the consequences would be, used to decide what controls to apply.
What are the main supplier risk factors in pharma? Material criticality, patient exposure, contamination potential, supply chain transparency, compliance history and quality system maturity.
Is supplier risk assessment required? Yes, in effect. ICH Q10, EU GMP and ISO 13485 all require supplier controls based on risk.
What is supplier risk management software? Software that scores and monitors supplier risk. Some focus on supply continuity; supplier quality systems focus on qualification, audits and nonconformances.
How often should supplier risk be reassessed? At defined intervals and whenever the supplier, material, performance or regulatory status changes.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| ICH Q10 (FDA) | ICH guideline | Section 2.7 |
| ISO 13485:2016, Medical devices: Quality management systems | International standard | ISO 13485 7.4.1 |
| EU GMP (EudraLex Vol. 4), Chapter 5: Production | EU GMP guideline | EU GMP Chapter 5 |
| FDA, Testing of Glycerin, Propylene Glycol, Sorbitol Solution and Other High-Risk Drug Components for DEG and EG (May 2023) | FDA guidance | DEG/EG guidance |
| EU Guidelines on formalised risk assessment for excipients (2015/C 95/02) | EU guideline (Official Journal) | Excipient risk assessment |
| RQA, FDA Q9(R1) Quality Risk Management | Professional association news | Subjectivity in risk scores |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR date |