Over the past decade, supply chains within the pharmaceutical industry have become increasingly complex. This is a result of a growing outsourcing trend, combined with a supplier base that is more and more spread from a global perspective.
This situation makes API manufacturers more dependent on their suppliers and also more vulnerable to supplier related risks. These risks are not only limited to quality or compliance issues, also business continuity or reputational risks can be a result of poor supplier management. To manage such risks,
risk management (see also ICH Q9) is becoming an integral part of today’s supplier management
processes.
In addition, regulatory agencies nowadays focus more on how suppliers are managed, and
pharmaceutical customers of API producers expect their API manufacturers to have adequate supplier qualification and evaluation programs in place.
This guide provides a framework for API manufacturers to implement an adequate, robust, risk-based supplier management process. Such a Supplier Management can be looked at from different angles, e. g. from a commercial, compliance, business continuity… perspective. This guideline looks at supplier
management primarily from a quality perspective (i.e., materials or services potentially affecting quality). However, it also briefly touches, for the materials or services in scope, other non-quality related aspects (e. g. REACH, carbon footprint, CSR…). The reason is that in many cases different aspects cannot be seen independently when it comes to fulfilling the objective of having a reliable and stable supply base.
This document’s objective is to provide guidance and suggest a harmonized approach within the API industry on how to manage suppliers of materials and services in an adequate and compliant manner.
The intention is to establish a supplier management framework that is not only compliant with the official requirements, but also covers other supplier management related aspects that play a role in real life, e. g. when dealing with suppliers that are reluctant to sign quality agreements or to accept physical audits. Although these other aspects are important, little detail is covered in official guidances, a gap which this ‘best practices’ guide is aiming to fill.
Throughout this document, the term “Supplier” will be used to refer both to material suppliers as well as service providers (service suppliers).
The guide is based on the experience and best practices of the authors while working in the API
industry. It has no legal base nor is it endorsed by any official regulatory body. It is therefore not a replacement of any official guideline but reflects APIC’s position on the topic.
In general, this guide focusses on supplier management of suppliers used for commercial production.
The same approach can be applied also for suppliers used during earlier development stages, although (following the risk-based approach) the API manufacturer might define less strict requirements. It is the common expectation that the level of detail and requirements increase with the process
development (e.g., preclinical, phase I, phase II, phase III), as such, not all the activities below
mentioned may apply to all development stages.
The supplier management process typically involves input from different departments (e. g. R&D,Procurement, HSE). It is essential however that the Quality Unit oversees all quality and compliance related aspects and has the exclusive authority to approve or reject suppliers.
Supplier Management
During the Supplier Management Life Cycle, four stages can be defined:
- Selection Phase
- Qualification Phase
- Operational Phase
- Termination Phase
The Selection and Qualification phases apply to all new supplier (manufacturer)/material or service
combinations. This means it also applies to existing (qualified) suppliers/manufacturers from which a
new material or service is intended to be purchased. During these phases it is recommended to work
with a multi-disciplinary team (i.e., typically Quality Assurance, Procurement, SHE, etc.) to ensure that required aspects are covered initially during the project.
The Operational phase applies to all suppliers of materials or services that are qualified.
The Termination phase can apply to either a specific supplier, or an individual material or service from a specific supplier.
From the qualification phase onwards, it is important that all activities are documented. In addition,
change control is recommended to ensure proper management of the necessary steps. The level of detail of the change control depends on the criticality of the material / service / supplier /
manufacturer and risk involved.
Selection Phase-
Procurement (Sourcing) department usually is the department that is responsible for providing (a list of) potential suppliers, e. g by using their internal or external databases.
Define the Product / Service Requirements-
In order to allow Procurement to initiate the selection, the users of the material or service must provide the corresponding requirements (user requirements), these should contain:
- Material specifications (ideally fully finalized, alternatively R&D draft versions) and, as needed,corresponding methods or service (user) requirements
- Specific standards or specific constraints related to quality, safety, specific legislation related to the product or service (requirement for quality certifications, licences, permits, Reach,)
or any other constraints (e.g., limitation to subcontracting Cascades.)
Request for information – Request for proposal – Request for quotation (RfX)
During this stage typically standard documentation packages are requested, based on the defined product/service requirements. Besides pure commercial items (such as price, payment terms, minimum order quantity, price revisions, incoterms…) the requests will typically include one or more of the following items:
- Information related to Sustainability / CSR / EHS (as selection criterium, not necessarily for formal qualification).
- Legal compliance information
- Supply chain information (traders or intermediate parties involved?), if traders are involved,clarify their activities (do they have open product handling, e. g. repacking?). Request the identity of manufacturers and subcontractors that may be involved in the product or service
- Route of transport and transport related information: shipping risk assessments e. g. in case of temperature / humidity sensitive materials Supplier’s core business, industries served
- Financial status of the supplier
- Capacity & capability, delivery performance
- Supplier’s knowledge about the product of interest – manufacturing experience, quantities produced, batch size, importance of product within supplier’s portfolio.
- REACH aspects
- Official or draft specifications, to confirm that the material complies with the requirements expected,
- Willingness to accept API manufacturer’s qualification procedure (e. g. questionnaires,statements, spec agreements, cleaning certificates in case of deliveries in bulk, audits, quality agreements)
- High level info on Supplier’s GMP compliance / Quality system / performance adequacy /regulatory status/track record (can be verified, e. g. via warning letters).
Evaluation of the information (Pre-qualification assessment)
The information received in the RfX package needs to be thoroughly evaluated by the relevant
stakeholders (incl. quality department), in order to:
- Increase confidence that the new source will pass the next stages
- Identify any potential risks
- Decide on eventual additional actions, requirements or questions.
- Assess the necessity of an on-site visit, taking into account the answers of the RfX and the criticality of the product/service.
At the end of this stage a decision will be taken to initiate the formal qualification of a specific supplier.
This decision is made involving all relevant stakeholders.
Qualification Phase-
It is important to emphasize that a supplier is never qualified on its own, but always in combination with the material or service and their respective uses. This means, one must consider both material /service-related aspects as well as supplier specific related ones.
If the supplier is not the manufacturer, the basic aim should be to know and qualify the manufacturer.
However, based on the criticality of the material it may be sufficient to limit the qualification to the level of the supplier. In that case an assessment of the supplier’s own supplier management system would be expected.
In any case for materials or services that are highly critical (see table 1), the qualification should include the manufacturers, as required by ICH Q7. The same applies to most of the medium critical materials.
In any case for materials or services in the criticality category “High” (as defined in table 1), the qualification should include the manufacturers, as required by ICH Q7.
The outcome of the qualification phase will determine the suitability of the supplier for use by the API manufacturer (go/no go-decision). The qualification and its outcome should be formally documented.
The qualification phase should basically cover two aspects:
- Initial assessment of material or service to evaluate the quality of the material or service provided and the impact thereof on the quality of your API
- Evaluation of the suppliers’ facilities and/or QMS to assess whether the supplier can
consistently supply material or service with the required quality Both aspects need to be considered in parallel during the qualification phase.
Criticality Assessment of the material or service
The criticality of the material or service to be provided will determine the level of qualification
requirements. Therefore, the API manufacturer needs to determine the criticality of each material or service based on its intended use. Typically, this results in a categorisation of materials and services as first input for determining the level of qualification. Important aspects to consider are the GMP compliance and registration requirements. In contrast to non-registered materials, registered
materials already have very clear guidelines that should be met (e. g. compliance to GMP, requirement to audit etc).
Detailed Definition of Qualification Requirements
The requirements to qualify a new supplier/material (or service) combination are determined based at minimum on the criticality of the materials or service (as indicated in Table 1). Additional factors
that may impact the level of qualification can be:
- Complexity of material in terms of how it is produced
- Level of release testing (acceptance on CoA vs own release testing)
- Usage of the material (early or late in the synthesis) or service: increased level of control closer to the final API stage (cfr. ICH Q7 principle)
The requirements should be documented and approved by the Quality Unit. The qualification plan contains the actions to be completed, e. g. one or more of the following:
(1) Conduct a fit-for-use / fit-for-purpose (FFU/FFP) assessment: - Documented evidence that the material or service intended to be purchased is suitable for the intended use. In case of materials the fit-for-use/fit for purpose typically involves a degree of testing of the material.
For services the fit-for-purpose or fit-for-use assessment of services is in general based on auditing or evaluation of documentation (depending on the criticality).
(2) Request statements related to the attributes or compliance of the product or service e. g.:
- BSE/TSE
- GMO
- Residual solvents
- Metals (ICH Q3D)
- Potential genotoxic impurities (PGI)
- Nitrosamines statements or assessments
- other information: e.g., route of synthesis, pesticides, melamine, toxic compounds
- Training certificates or CVs of involved service providers
- Accreditation of a lab for a specific test
- Legal approval for handling/storage specific substances (e.g., narcotics)
(3) Assess the supplier’s (manufacturer’s) suitability, e.g. - Questionnaires
- Audit
(4) Establishment of contracts or agreements, e.g. - Specification Agreement
- Quality Agreements
- User requirements
It is recommended that the API manufacturer sets up a table (or a matrix, a flow or a diagram) of qualification requirements depending on the criticality level of the material / service that is purchased.
Specific additional requirements can be added on a case-by-case basis: e.g., cleaning certificate or evidence of process validation.
In the specific case of outsourcing GMP activities, the qualification activities must include guarantees (and / or evidence) to keep complete oversight by the API manufacturer over the activities performed by the service or material supplier (see quality agreement chapter).
Once the qualification criteria specific to the material or service in scope have been defined, it is also important to consider certain additional aspects (both quality and non-quality) related to the supplier,as these aspects may alter (increase or decrease) the criticality. Examples can be:
- Reputation of the supplier
- Location of supplier
- Experience /maturity
- Complexity of the process used by the particular supplier (e.g., continuous single step vs multiple batch process, dedicated or multipurpose)
- Complexity of the supply chain (e.g., multiple intermediate parties involved).
Execution & outcome of the Qualification
Once all the required information has been collected and the qualification activities have been defined, these will be executed – in accordance with the plan -, evaluated and documented.
The results of the qualification activities should be documented and approved by the Quality Unit. This approval is the prerequisite to use the supplier and to place orders. Such an approval is often transferred into an ERP system to ensure appropriate ordering, release and use of material.
In addition, an overview of all qualified suppliers should be available, either as a list of approved suppliers or through a secured electronic system.
In case the supplier or service provider is going to be part of a regulatory filing, it is good practice to share this information with the respective supplier or service provider.
In exceptional cases, it may not always be possible to have all requirements finalized or signed prior to the ordering and /or using the material/service. It is important that these cases have to be treated with care and are justified with a written risk assessment, clearly identifying the missing items, typically approved by senior management. In any case, all required documents and actions must be completed before releasing the API.
Operational Phase
Once the supplier is qualified, the period of active use starts. During this Operational Phase, a Supplier Monitoring Program needs to be established in order to maintain the qualified status. A Supplier Monitoring Program consists of periodically re-evaluating
- the supplier risks, based on the performance of a supplier and supplier intrinsic risks (see
paragraph 3.3) - the validity of supplier related documentation (e.g. agreements) and / or audit status
The frequency at which the evaluation should be repeated is based on the criticality of the material or
service (as defined in chapter 2.2.1), and the supplier risk that came out of the exercise (see table 4).
It is important to note that certain specific events (e.g. certain complaints, deviations, changes, audit
observations) occurring between fixed re-evaluation moments can trigger an immediate evaluation of
the supplier qualification status and/or risk level.
The supplier performance evaluation may consist of - Quality aspects (e. g. material or service quality, audit outcome, compliance issues, deviation response, RFT%)
- Other performance aspects (e. g. supply chain issues, on time deliveries)
Many companies translate the outcome of a supplier evaluation into a supplier (risk) score whereby the scoring system consists of a numerical evaluation of different parameters reflecting both supplier
performance as supplier intrinsic risks The very first moment to define a risk score is immediately after qualification, whereby the score will in that case be based on the supplier intrinsic risk as there is in
principle no real operating experience yet to evaluate the performance .
In case of negative performance within the assessment period, shorter review frequencies can be implemented as a risk mitigation measure. Severe negative performance will lead to termination (see
chapter 2.4). In case the concerned source is the only qualified one and discontinuation would have severe effects on the availability of a medicine to patients, the API manufacturer needs to implement
further measures for short-term mitigation of the risks. This could be e. g. additional controls of material or services, or intensified consulting to improve the quality systems of the supplier.
The Supplier Monitoring activities can be done separately by the Quality Unit or as a joint exercise together with other units, nevertheless it should be documented and approved by the quality function.
Potential activities resulting from the supplier evaluation or rating could include:
- Adapting the audit frequency (or other applicable assessment)
- Increase quality oversight (e. g. by (Q-)visits, meetings, person-in-plant)
- If reduced testing is applied, the frequency of full testing may be adapted
- In case of immediate risks, a specific risk mitigation plan should be established
Supplier evaluation can also trigger a temporary blocking of certain supplier. Examples may be: - Dormant suppliers (e. g. no current purchase, price/competitiveness reasons, replaced by alternative suppliers, material or service no longer used): it should be decided if the supplier remains in a qualified state or should be inactivated to avoid unnecessary ‘maintenance’
activities (e. g. monitoring and re-qualifying). These suppliers may become active again after re-evaluation or re-qualification. - Suppliers having issues that have not been resolved, e.g., implementation of an audit CAPA,general compliance issue (e. g. import alert, environmental issue).
In case of blocking due to quality issues, the potential impact on all related materials on stock, in transit, or already shipped to a customer should be assessed. It is a good practice to include possible criteria to reactivate the supplier or service provider. This assessment must be approved and
documented by the Quality Unit. All concerned departments and sites need to be informed of the temporarily blocking of a supplier / service provider.
After the periodic re-assessment is completed, the qualified status is maintained.
Termination Phase
The active qualification status of a supplier / service provider may be terminated or not re-assigned
for several reasons, e. g.:
- The supplier has discontinued the production of the material / provision of the service
- The API manufacturer has discontinued the use of the material, supplier or service
- The supplier has serious issues (e. g. quality related issues with no proper CAPA measures,
negative audit output, supply chain issues, breach of agreed Quality requirements)
In case of disqualification due to quality issues, the potential impact on all related materials on stock,in transit, or already shipped to a customer should be assessed. This assessment must be approved
and documented by the Quality Unit.
All concerned departments and sites need to be informed of the disqualification of a supplier / service provider.
Be aware that even in case of discontinuation of business it may be necessary to continue access to
retain samples, manufacturers documentation or other information.