attributes (CQAs) that must be monitored throughout the vendor qualification lifecycle.

Assess the impact of each identified risk on product quality and compliance.

Classify risks and decide on mitigation strategies for critical and high-impact vendors.

Document the findings in a formal risk assessment report that will provide a clear justification for qualification decisions made later in the process. This documentation serves as key evidence in the vendor qualification records.

Step 2: Vendor Selection and Audit Preparation

After defining the user requirements and assessing risks, the next step is to select potential vendors for qualification. Vendor selection criteria should include quality history, manufacturing capabilities, technical expertise, compliance record, and financial stability. Use these criteria to compile a list of qualified candidates for the vendor pool.

Following the creation of the vendor pool, schedule formal audits to evaluate the vendors’ compliance with GMP standards and their ability to meet the URS requirements. Preparation for the vendor audit involves several tasks:

• Develop an audit protocol detailing the scope, objectives, and methodology of the audit.
• Assign auditors with appropriate qualifications and experience.
• Gather background information on vendor operations, including previous compliance history and any corrective actions taken.

During the audit, focus on the vendor’s quality management system, manufacturing processes, and product testing methodologies. Relevant documents to request include SOPs, training logs, and deviation reports. Document all findings in a formal audit report, ensuring that any identified deficiencies are addressed in a timely manner through corrective and preventive actions (CAPA).

Step 3: Qualification Testing and Documentation

Upon successful completion of the audit process and approval of potential vendors, the next step is conducting qualification testing. Depending on the nature of the materials or services supplied, this may include Performance Qualification (PQ) testing, where vendors must demonstrate their capability to deliver product or service consistently as per defined specifications.

It is essential to define a robust testing protocol to validate that the vendor’s products conform to established specifications. Key considerations include:

• Establishing acceptance criteria based on the original URS.
• Selecting a statistically valid sampling plan to ensure representative results.
• Documenting all tests and results thoroughly to provide evidence of compliance.

Quality control is vital during this phase, and openness to collaboration with the vendor can lead to improved testing methodologies and outcomes. Clear documentation of the qualification tests and outcomes must be compiled into a qualification report that outlines the testing process, results, and any deviations or additional actions required.

Step 4: Performance Qualification (PQ) and Process Verification

Once qualification testing is completed, organizations must carry out Performance Qualification (PQ) activities. The purpose of PQ is to confirm that the vendor’s processes and outputs meet the requirements and that they can consistently deliver quality products. This is where organizations will engage in statistical analysis and process verification, which will typically follow the ”

Common PQ activities may include:

• Process characterization: Evaluate vendor processes to define the operating ranges and influence of variables on product quality.
• Routine monitoring: Implement methods for periodic verification of product quality through continuous or periodic testing.
• Evaluation of stability: Review long-term stability data to ensure that product integrity is maintained over time.

Document the entire PQ process thoroughly, providing a clear audit trail that can demonstrate compliance with all regulatory expectations. The PQ report should include statistical justifications for the processes, along with any relevant process capability studies.

Step 5: Continued Process Verification (CPV)

Following the completion of PQ, the focus shifts to Continued Process Verification (CPV). CPV is a critical component that ensures ongoing product quality and compliance as vendor operations are confirmed against regulatory requirements. Per ICH Q8–Q10, CPV is about gaining assurance through the continued monitoring of manufacturing processes post-qualification. Key questions must be answered in this phase: How do we ensure that the vendor’s output remains consistently compliant and of high quality?

To achieve this, organizations should implement routine monitoring of vendor performance and product quality while establishing a defined schedule for regular reviews. Typical activities include:

• Review of key performance indicators (KPIs) and quality metrics to gauge vendor compliance.
• Regular updates to the risk assessment based on ongoing findings and vendor performance.
• Frequency of audits to monitor compliance, which may increase or decrease based on performance trends.

Documentation plays a vital role in CPV as it captures ongoing compliance evaluation, vendor performance reports, and actions taken in response to any non-conformance issues. This documentation provides continued evidence of a vendor’s capability and compliance with FDA requirements for software validation and other regulatory expectations.

Step 6: Revalidation and Requalification

The final phase in the vendor qualification process is revalidation and requalification, which are necessary to ensure that vendor suppliers continue to meet predefined quality standards. Regulatory changes, process modifications, or significant deviations observed during CPV warrant a reassessment of the vendor’s qualification status.

Key activities during the revalidation phase may include:

• Conducting periodic re-audits to reassess vendor compliance and capabilities.
• Reviewing vendor performance data and any regulatory or environmental changes that could impact quality.
• Updating URS and risk assessments based on the data collected during CPV.

Compile all revalidation activities in a comprehensive report demonstrating continued compliance and capability of the vendor’s systems and processes. This report will be integral in maintaining vendor relationships and ensuring aligned practices across different sites, ultimately supporting global compliance with validation requirements.

In conclusion, tracking vendor qualification status across sites involves diligent planning, compliance assessment, and continuous monitoring. Regulatory literature provides guidance on best practices, including FDA requirements for software validation, and the pharmaceutical industry must adhere closely to these standards to ensure ongoing compliance and quality assurance throughout the supply chain.