Building and Maintaining an Approved Supplier List

An approved supplier list is one of the most scrutinised documents in any pharmaceutical quality system, and one of the most frequently misunderstood. Far from being a static spreadsheet of names, it is the controlled record that demonstrates every material, service and activity flowing into your product comes from a source you have formally evaluated, qualified and continue to monitor. Get it right and it becomes the backbone of your supplier oversight; get it wrong and it is one of the first weaknesses an inspector will expose.

What an approved supplier list actually is

Under EU GMP Chapter 5 and Chapter 7, manufacturers and importers must qualify their suppliers of starting materials, primary packaging and outsourced activities before use, and maintain evidence of that approval. The approved supplier list (ASL) is the single, controlled register that proves which suppliers have passed that qualification and remain authorised for supply. For licence holders operating under a Wholesale Dealer's Authorisation, the equivalent obligation sits in the MHRA-enforced GDP guidelines, where you must verify that you obtain product only from authorised suppliers and supply only to authorised customers.

Critically, the ASL is not the qualification itself. It is the summary output of a qualification process, and it must be traceable back to the underlying evidence: questionnaires, audit reports, quality agreements, licences and risk assessments. An entry on the list without that supporting trail is an assertion, not a control.

Building the list: qualification before approval

A supplier earns a place on the list only after a documented qualification appropriate to the risk they present. The depth of that assessment should be driven by ICH Q9 (Quality Risk Management), not by convenience. A supplier of a sterile active substance demands a different level of scrutiny from a supplier of secondary cartonboard.

The core qualification steps

1. Identify and categorise the supplier by what they provide and the risk it carries to product quality and patient safety.
2. Assess through a supplier questionnaire, review of GMP or GDP certificates and licences, and where justified an on-site or remote audit.
3. Define expectations in a written quality or technical agreement that sets out responsibilities, specifications and notification duties.
4. Approve formally, with the qualification reviewed and signed off by the quality unit before the supplier is added.

Risk-tiering matters here. Tier your suppliers so that high-risk sources receive periodic on-site audits and tight monitoring, while low-risk, stable suppliers can be qualified and reviewed more proportionately. Our supplier management service helps quality teams design tiering that an inspector will accept as both rational and defensible.

What every approved supplier list entry should contain

A list that simply names companies is not fit for purpose. Each entry should carry enough controlled data to make the approval status unambiguous and auditable.

• Supplier identity: legal name, site address and the specific manufacturing or distribution site, not just the head office.
• Scope of approval: the exact materials, products or services the supplier is approved to provide, by name and where relevant by specification or licence number.
• Qualification basis: reference to the audit, questionnaire and risk assessment that justify approval, with dates.
• Status and validity: approved, conditionally approved, suspended or disqualified, with the date of the last review and the next review due.
• Licence and certificate references: relevant MIA, WDA, GMP certificate or written confirmation, with expiry dates tracked.

Restricting the scope of approval is essential. A supplier qualified for one excipient is not automatically approved for another, and the list must make that boundary explicit so that procurement cannot order outside what was assessed.

Maintaining the list: governance, change control and data integrity

An approved supplier list is a living document, and its value collapses the moment it falls out of date. Maintenance is where most organisations are caught out at inspection, typically through expired certificates, suppliers used after a change of site, or a list that no longer matches what is actually being purchased.

Keep it controlled and current

Manage the ASL under formal document control and change control as part of your ICH Q10 pharmaceutical quality system. Additions, scope changes, suspensions and removals must follow a defined procedure with quality unit approval, version control and a clear audit trail of who changed what and when. The record must satisfy ALCOA+ expectations: attributable, legible, contemporaneous, original and accurate. A shared spreadsheet that anyone can edit without trace will not withstand a data integrity challenge.

Trigger reviews, not just calendar checks

Schedule periodic re-qualification on a risk basis, but do not rely on the calendar alone. Significant deviations, complaint trends, recalls, failed deliveries, a change of manufacturing site, or an adverse regulatory inspection should all trigger an immediate review of a supplier's status. Where a supplier fails, the list must be capable of recording suspension or disqualification promptly so that no further material is accepted from a source you no longer trust. Feeding audit and performance outcomes back into the list, as illustrated in our case studies, is exactly the closed loop the MHRA expects.

Common pitfalls and how to avoid them

The same weaknesses recur across audits and inspections. Most are avoidable with disciplined governance.

• The orphan spreadsheet: an ASL maintained outside the QMS, uncontrolled and disconnected from the qualification records that justify it.
• Scope creep in procurement: buyers ordering materials or sites not covered by the approval, because the list is not specific enough or not enforced.
• Expired evidence: GMP certificates, licences and written confirmations that have lapsed while the supplier remains marked as approved.
• No off-boarding: disqualified or dormant suppliers left on the active list, creating ambiguity about who may actually be used.
• One-size qualification: applying the same shallow assessment to every supplier regardless of the risk they carry.

The fix is integration. When your quality and compliance services tie the list directly to qualification, change control and supplier monitoring, the document stops being an administrative afterthought and becomes genuine evidence of control.

Key takeaways

A robust approved supplier list is risk-tiered, scope-specific, fully traceable to its qualification evidence, and maintained under proper change control. Anchor it in ICH Q9 and ICH Q10, hold it to ALCOA+, align it with EU GMP and the GDP guidelines, and make sure every entry tells an inspector precisely who is approved, for what, and on what basis.

• Qualify before you approve, and tier the depth of qualification by risk.
• Capture scope, status, validity and qualification basis against every entry.
• Govern the list under document and change control, not a free-for-all spreadsheet.
• Trigger reviews on events, not just dates, and off-board failed suppliers promptly.

If you need experienced QPs and RPs to build, rationalise or defend your approved supplier list, explore our supplier management service or get in touch with our team to discuss your supply chain.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Part II — Active Substances (APIs)
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.