Supplier and External Provider Quality
Domain 5 - Supplier and External Provider Quality
This domain tests how you qualify, contract with, and monitor suppliers and outsourced providers. Expect questions on risk-based qualification, quality agreements, incoming sampling, and ongoing performance monitoring.
Core rules
- ICH Q10 chapter 7 requires the manufacturer to ensure outsourced activities and purchased materials conform to defined requirements; the contract giver retains responsibility for the product.
- Qualification is risk-based: material criticality, supplier history, regulatory status, complexity, and single-source status determine whether you need a questionnaire, certificate review, sample testing, or an on-site audit.
- A written quality agreement defines responsibilities: specifications, testing, deviations, change notification, complaints, recalls, audit rights, and records retention.
- 21 CFR 211.84 requires identity testing of each component lot and a sampling plan justified by appropriate criteria; the widely used √n + 1 container rule is a common interpretation, not a substitute for statistical justification. Reduced testing depends on a qualified supplier and periodic full testing.
- Ongoing monitoring uses scorecards: on-time delivery, CoA accuracy, complaints, deviations, recall history, change notifications, and audit findings. A certificate of analysis is evidence but does not transfer responsibility.
Worked example
An excipient from a single source shows two out-of-specification identity results in a year, late change notifications, and a recent ownership change. Risk rating: high (critical excipient, single source, poor performance, organisational change). Response: on-site audit within the quarter, full identity testing of every lot until performance recovers, a renegotiated quality agreement with a change-notification clause naming the excipient, and a business continuity review. A commodity supplier with three clean years may move to questionnaire plus periodic CoA verification, with full testing reinstated annually.
Traps that cost marks
- Relying on the supplier's CoA without any qualification or periodic verification.
- Treating a distributor as the manufacturer when the audit needs to reach the production site.
- Having only a commercial contract and no quality agreement.
- Applying the same audit frequency to all suppliers regardless of risk.
- Omitting change-notification rights, which is where many supplier failures begin.