How to Develop a Practical (and Compliant) Vendor Qualification Program

One of the timeless principles of commerce is caveat emptor (Latin for, "let the buyer beware"). Under the principle of caveat emptor, the buyer takes the responsibility for the condition of the items or quality of the services that he or she purchases. Prior to the current consumer protection laws, buyers had no warranties for the goods or services that they purchased. Today, most states require goods to be of "merchantable or sellable quality." As this condition is often next to impossible to define and enforce, buyers are advised to embrace the principle of caveat emptor prior to "signing on the dotted line."

While being conscious of the products and services purchased is good practice for consumers and most businesses, it is a regulatory requirement for pharmaceutical and bio-pharmaceutical manufacturers. For these organizations, the decisions where to purchase raw materials, components, manufacturing and testing equipment, and even consulting services, need to be well informed (and documented). The results of making poor purchasing decisions can lead to situations that impact product quality, regulatory compliance, company profits, and even the reputation of the company.

Vendor qualification and quality systems

The qualification process is defined by the American Society for Quality Control (ASQC) as "the process of demonstrating whether an entity is capable of fulfilling the specified requirement." Vendor qualification is the process by which a vendor is evaluated to determine if it can provide the necessary goods or services to the standards that the purchasing company requires.

Before discussing the best approach to qualifying different types of vendors, it is important to first understand the concept of quality systems. Quality systems are defined as "the processes, organizational structure, procedures and resources that are used to control variables associated with producing a product of consistent quality and that meets predefined specifications." In simpler words, an organization's entire operation is a measure of a product s quality and not simply the testing of its finished product.

This article employs the theme that vendor qualification is not solely an auditing process but rather a quality system in itself for the pharmaceutical or biopharmaceutical organization.

In order to introduce the quality-systems approach to vendor qualification, consider the following simple analogy. Professional football organizations do not sign on prospective athletes purely by the athlete's stated bench press or 40-yard dash statistics (i.e., final test results). There are several factors that are taken into consideration. The team management first determines what specifications the team requires for the open position, including, but not limited to, what the team is willing and able to spend for the position to be filled.

Once these user requirements are defined, candidate athletes are identified. After identifying the top prospect (or prospects) on paper, a selection is made. However, the process is far from over at this point. The selected individual (or individuals) is then physically and mentally evaluated by team doctors to determine his readiness to play professional football for that specific team. Only after successful fulfillment of the team's specific financial, physical, and mental requirements is the player contracted. However, as many are aware, this one-time assessment does not guarantee consistent performance throughout the player's contract. Therefore, the athlete's performance is regularly assessed to ensure continued ability to meets the needs of the team. If the professional cannot meet the team's current requirements, the he is subjected to performance improvement training and risks being traded or released.

Similar to the professional football candidate, a potential vendor should be thoroughly assessed against a company's requirements, compared to other candidate vendors, physically evaluated once selected (and before a contract is signed), and reevaluated as required and as defined on a regular basis. This article presents the Q.U.E.S.T. approach as a simple, effective, and compliant approach to vendor qualification.

Vendor qualification – the Q.U.E.S.T. approach

How does a company qualify a vendor? What approach will give the company the best probability of an accurate vendor assessment, meet current regulatory expectations, and still remain practical? One method is by using the Q.U.E.S.T. Approach (i.e., Question, Understand, Evaluate, Site Audit, and Track) shown in to Figure 1.

Figure 1: The Q.U.E.S.T. approach to vendor qualification.

Q = Question Phase: What a potential vendor needs to supply

The first step in qualifying a vendor is for the pharmaceutical or biopharmaceutical company to document its needs from a vendor of this type. For example, does the vendor need to sell to pharmaceutical or biopharmaceutical firms already? Does the vendor have to have a drug master file registered with the US Food and Drug Administration? Does the vendor have the current ability to supply the required units, resources, etc.? Of course, one of the most important questions is, "What is our budget for this vendor's products or services?" Especially in the current economic environment, many hours, days, and weeks are wasted by defining requirements without a real budget number established upfront. Oftentimes, a company's change-control system is a good place to document/capture this information and overall effort to ensure understanding and commitment by all internal parties involved.

U = Understanding Phase: How vendors meet the requirements

Once the Question Phase is complete, vendors that appear to meet the company's requirements are contacted directly to gauge interest in being a new vendor for the company. The company's requirements (as defined in the Question Phase) are then supplied to those interested vendor organizations. It should be requested that the vendor supply all its administrative information (e.g., key contacts, location(s)), applicable sales and marketing materials, and most importantly, documentation that supports its ability to meet the specified company requirements (including, but not limited to, pricing). At this time, it should also be requested that the vendor send a "sample" of the product or service that it will potentially providing. For example, a lactose supplier should be requested to supply samples of the lactose that it would offer for sale in addition to the certificates of analyses for the lactose. A bioreactor supplier should provide pictures of the vessel along with all the vessel's specifications. Even a consulting or contracting organization should provide samples. These organizations should provide sample resumes of resources that would be involved in the pharmaceutical or biopharmaceutical company's projects.

At least three vendors should provide the information requested in its entirety before moving to the next phase in the vendor qualification process. At this point, it is imperative that each vendor package be thoroughly assessed for adequacy and completeness and be understood with regards to the vendor's ability to meet the company requirements specified.

E = Evaluation Phase: Identification of the best potential vendor

Now that at least three vendors have been identified to meet the company's requirements, it is time for vendor evaluation. First, each vendor is assessed against the company requirements as specified in the Question Phase. All of the potential vendors previously identified will be able to meet each and every requirement specified—vendors that could not meet the requirements have already been eliminated. This evaluation pertains to how well each vendor meets each requirement when compared to the other short-listed vendors. The format of this evaluation can be as simple as a table with columns for the vendor and for the requirements where a simple rating system is applied to each requirement for each vendor.

An example of such a table for the evaluation of an active pharmaceutical ingredient (API) supplier is shown in Table I. Once the ratings are assigned, a simple average can be used to determine the best overall option. Keep in mind that this is not the final step in the process. The Evaluation Phase has only identified and documented the best potential vendor.

Table I: Example API vendor evaluation.

S = Site Audit Phase: Onsite and offsite verifications

The next-to-last phase in the vendor qualification process involves a site audit of the potential vendor's facility. As the cost of an audit is a potentially pricey activity, the site audit maybe performed onsite or offsite depending on the criticality of the potential vendor type and is limited to the best potential vendor identified in the Evaluation Phase. Vendor types need to be divided into critical and noncritical suppliers. A critical vendor is one that supplies goods or services that directly controls or dictates the quality and integrity of pharmaceutical and biopharmaceutical products. A noncritical vendor is one that supplies goods or services that assist and support the quality of these products. As the interpretation of the definitions of critical and noncritical suppliers varies among companies, it is imperative that an approved and controlled company document (or documents) clearly defines which vendor types are deemed critical and which are deemed as non-critical. Examples of critical and noncritical vendor types are listed in Table III.

Table II: Example vendor type criticality assignment.

If the best potential vendor identified in the Evaluation Phase is a potential critical vendor, it is highly recommended that this vendor be subjected to an onsite audit with predetermined (i.e., documented and approved) items requiring onsite verification. The onsite audit procedure should contain clear pass/fail criteria for the onsite vendor audit. An example portion of a form to be completed during the onsite verification for a contract packager is shown in Table III.

Table III: Example onsite verification form – contract packaging facility.

If the best potential vendor identified in the Evaluation Phase is a potential noncritical vendor, the vendor should be subjected to an offsite audit with a separate predetermined (i.e. documented and approved) audit checklist containing predetermined pass/fail criteria for the overall audit. While the verifications maybe similar to that of an onsite audit, the offsite audit relies on verbal discussions, emails, and documentation provided by the potential vendor to determine acceptability of the vendor's practices and quality systems. An example portion of a checklist for an offsite audit for a calibration contractor is shown in Table IV.

Table IV: Example offsite audit checklist – calibration contractor.

Based upon the overall score for both onsite and offsite audits, a potential vendor is either accepted or rejected. If accepted, the vendor is considered qualified. If rejected, the company can either work with the vendor to address the deficiencies and perform a verification audit at a later date (but prior to using the vendor or considering the vendor qualified), or select another potential vendor identified during the Evaluation Phase and subject that vendor to the Site Audit Phase.

T = Track Phase: Monitor and requalify

Once a vendor is qualified, the process does not end. The vendor's performance must be monitored on a continuous basis. The monitoring process involves a review of any problems associated with the good or service supplied by the vendor. A schedule is determined so that each qualified vendor is requalified on a periodic basis (whether a critical or noncritical vendor type) and in accordance with the most recent vendor practices. Similar to regulatory authority audits (e.g., FDA audits), the pharmaceutical or biopharmaceutical company should not only run through the preapproved audit verification steps, but should also revisit items that were found to be deficient during previous audits to make sure that any corrective and preventive actions commitments by the vendor have been implemented satisfactorily. All vendor qualification activities (i.e., qualification, requalification, and disqualification) should be documented in a vendor information file.

Conclusion

Throughout history, the concept of caveat emptor has been the bane of many consumers. Even though there have been some protections provided by legislature, this has not stopped the headaches, the loss of time, and the loss of money from substandard goods or services. Just as an individual consumer has the responsibility for verifying the quality of goods and services he or she plans to purchase, pharmaceutical and biopharmaceutical companies are responsible by regulation as well as through moral obligation to ensure that their vendors will consistently provide raw materials and components, compliance consulting services, manufacturing equipment, etc., that yield safe and effective drugs and other therapeutic products.

Additional Reading

1. Code of Federal Regulations (CFR), Title 21, Food and Drugs, Current Good Manufacturing Practices for Finished Pharmaceuticals (Food and Drug Administration, Department of Health and Human Services, April 1, 2006), Part 211, http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=211, accessed Sept. 18,2009.

2. CFR, Title 21, Food and Drugs, Current Good manufacturing Practices in Manufacturing, Processing, Packing or Holding of Drugs; General (Food and Drug Administration, Department of Health and Human Services, April 1, 2006), Part 210, http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=210, accessed Sept. 18, 2009.

3. George J. Grigonis, Jr., et al., "Technical Report No. 32 – Auditing of Suppliers Providing Computer Products and Services for Regulated Pharmaceutical Operations," PDA Jo. of Pharm. Sci. and Tech. 58 (5), 6–152 (Sept./Oct. 2004).

4. Liz Michalski, "Audits Aren't Enough to Ensure Quality," Pharm. Tech. 25 (4) 74–76 (April 2001).

Nancy Cafmeyer is a project manager and Jonathan M. Lewis* is a principal at Advanced Biomedical Consulting (ABC), PO Box 76405, St. Petersburg, FL 33734, tel. 888.671.4292, fax 888.316.7537, jlewis@advancedbiomedicalconsulting.com

*To whom all correspondence should be addressed.