Writing a Supplier Quality Questionnaire

A well-designed supplier questionnaire is the foundation of any credible supplier qualification programme. Used properly, it converts a regulatory expectation into usable risk intelligence, allowing your quality team to decide whether a manufacturer, distributor or service provider is fit to enter your supply chain. Used badly, it becomes a tick-box exercise that satisfies no one and protects nobody.

Why the supplier questionnaire matters under EU GMP and GDP

Both EU GMP Chapter 5 and the GDP guidelines (2013/C 343/01) place clear responsibility on licence holders to qualify the suppliers and customers they deal with. For manufacturers, Chapter 5 requires that starting and packaging materials are purchased only from approved suppliers named in the relevant specification, and that the supply chain is understood and controlled. For wholesale distributors, the GDP guidelines require verification that suppliers and customers hold the appropriate authorisations before any transaction takes place.

The questionnaire is rarely sufficient on its own, but it is almost always the first formal control. It gathers documented evidence, frames the conversation that precedes an audit, and creates an auditable record of the decision to approve. Treat it as the opening move in a relationship, not the whole game.

Anchor the questionnaire in risk, not habit

The most common failing is the one-size-fits-all template sent to every supplier regardless of what they provide. ICH Q9 (Quality Risk Management) is unambiguous that the effort, formality and documentation of quality risk management should be commensurate with the level of risk. An API manufacturer supplying a sterile injectable carries a materially different risk profile from a stationery vendor or a calibration contractor.

Before drafting a single question, classify the supplier by what they actually do and the consequence of failure:

• Direct-impact suppliers — active substances, excipients, primary packaging, sterile components, contract manufacturers and analytical laboratories.
• Indirect-impact suppliers — secondary packaging, logistics and storage providers, calibration and qualification services.
• Low-impact suppliers — consumables and general services with no product-contact or data-integrity exposure.

Use that classification to drive the depth of questioning. A risk-tiered approach keeps your team focused on the suppliers that can genuinely harm the patient, and stops you drowning low-risk vendors in irrelevant questions. Our supplier management service is built around exactly this tiered model.

What a strong supplier questionnaire actually asks

Structure the document so the answers map directly to your approval decision. A robust questionnaire for a direct-impact supplier should cover the following.

Company, licences and regulatory status

Legal entity and manufacturing site addresses, the relevant manufacturing or wholesale dealer authorisations, GMP or GDP certificates with their issuing authority and expiry, and the date and outcome of the most recent regulatory inspection. For manufacturers, ask directly whether the site has ever received a regulatory action such as a statement of non-compliance or an import alert.

Quality management system

Aligned to ICH Q10, confirm the existence of a documented pharmaceutical quality system: change control, deviation and CAPA management, complaints handling, recall procedures, and a self-inspection programme. Ask how management review operates and how quality metrics are escalated. A supplier that cannot describe its own change control is telling you something important.

Data integrity and computerised systems

Build in ALCOA+ expectations explicitly: are records attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available? Probe audit trail functionality, access controls, the segregation of duties between those who generate and those who approve data, and how electronic and hybrid records are managed. Data integrity weaknesses are now among the most frequent and serious MHRA inspection findings.

Premises, manufacturing and contamination control

For sterile and aseptic operations, align questions with Annex 1 — request the contamination control strategy, environmental monitoring approach, and the use of barrier or isolator technology. For all material suppliers, ask about cross-contamination controls, dedicated equipment where required, and pest control.

Outsourcing, subcontracting and supply chain

Few suppliers are self-contained. Ask what activities they subcontract, how they qualify their own suppliers, and whether they will notify you of any change of subcontractor. This visibility into the extended chain is exactly what regulators expect you to control, and it is where many qualification programmes quietly fail.

Design choices that separate a useful questionnaire from a wasted one

The content matters, but so does the engineering of the document itself. A few deliberate choices make the difference between intelligence and noise:

1. Ask for evidence, not assertions. "Do you have a CAPA system? Yes/No" tells you nothing. Require attachment of the procedure index, a sample certificate, or the SOP reference. Closed yes/no questions invite the answer you want to hear.
2. Make the questions specific and answerable. Avoid compound questions that bury two issues in one line. Each item should map to a single, assessable point.
3. Leave room for a reviewer's verdict. Every section needs a space for your assessor to record adequacy, follow-up actions and a risk rating — the questionnaire is a working document, not an archive.
4. Version-control and date it. Questionnaires age. A response from four years ago against a supplier that has since changed ownership is not current evidence.
5. Define what triggers re-issue. State the periodic review interval and the events — change of site, ownership, regulatory action — that force an out-of-cycle reassessment.

A questionnaire that only collects "yes" answers has confirmed nothing except that the supplier knows what you wanted to read.

From completed questionnaire to a defensible approval decision

The return of a completed form is the beginning of the work, not the end. Someone competent must review the responses against your acceptance criteria, challenge gaps and inconsistencies, and decide whether the residual risk justifies an on-site or remote audit. Document that rationale: under ICH Q9 and ICH Q10 your decision must be traceable and risk-based, and an inspector will expect to see the reasoning, not just the outcome.

Tie the result into your wider quality system. Approved suppliers belong on a controlled approved-supplier list; conditional approvals need defined follow-up actions with owners and due dates; rejections need a recorded justification. Then feed the supplier into your ongoing oversight — periodic re-qualification, performance monitoring and, where appropriate, a quality or technical agreement that formalises responsibilities. Examples of how we have structured this end to end appear across our case studies.

Key takeaways

A good supplier questionnaire is risk-tiered, evidence-led and built to support a documented decision — not a generic form despatched to satisfy a procedure. Anchor it in EU GMP, the GDP guidelines and the ICH Q9 / Q10 framework, write questions that demand proof rather than reassurance, and treat the completed document as the trigger for assessment, audit and continuing oversight.

If your supplier qualification process has drifted into box-ticking, or you are building one from scratch ahead of a new product or inspection, our QPs and RPs can help you design questionnaires and qualification workflows that stand up to scrutiny. Explore our full range of consultancy services or get in touch to discuss a supplier questionnaire and qualification programme tailored to your supply chain.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Part II — Active Substances (APIs)
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.