Supplier Risk Assessment: A Practical Method

A defensible supplier risk assessment is the foundation of any credible supply-chain control programme, yet too many sit in a spreadsheet that nobody revisits until something goes wrong. Done well, it tells you precisely where to spend your limited audit days, which suppliers warrant tighter oversight, and how to justify those choices to an MHRA inspector or a customer's auditor. This article sets out a practical, risk-proportionate method you can run with the resources you actually have.

The approach below is grounded in ICH Q9 quality risk management and the supplier-qualification expectations of EU GMP Chapter 5 and Chapter 7, and it works equally well for an importer qualifying overseas sites or a CMO managing its own raw-material chain.

Why supplier risk assessment matters more than the audit certificate

A signed audit report and a valid GMP certificate tell you a supplier was acceptable on a single day. They say very little about the standing risk that supplier represents to your product, your patients and your licence. Regulators have made clear that the manufacturing-authorisation holder remains accountable for materials and outsourced activities regardless of how reputable the supplier appears.

The purpose of a structured assessment is therefore not to generate paperwork but to direct attention. With a hundred suppliers and a finite number of auditor days, you cannot treat them all alike. A good assessment ranks them so that your highest-risk relationships receive the deepest scrutiny, and your lowest-risk ones are not over-audited at the expense of the rest.

Build the criteria before you score anything

The most common failure mode is to invent the scoring scale while halfway through the supplier list, which guarantees inconsistency. Agree your criteria first, document them in a procedure, and apply them uniformly. A robust supplier risk assessment usually weighs two dimensions: the intrinsic criticality of what the supplier provides, and the likelihood that it will fail to meet specification.

Criticality factors

• Material type and use — an active substance or a sterile-product component carries far more weight than an outer carton.
• Route of administration and patient population — parenteral and paediatric products demand a lower risk tolerance.
• Position in the process — materials added after the last sterilising or purification step deserve particular attention.
• Substitutability — a sole-source supplier of a hard-to-replace material is a continuity risk as well as a quality one.

Likelihood and history factors

• Regulatory standing — current GMP or GDP certification, inspection history and any regulatory actions.
• Performance data — rejection rates, out-of-specification results, complaints and on-time delivery.
• Complexity and geography — long, multi-tier or cross-border chains introduce more points of failure.
• Change and deviation behaviour — does the supplier notify you of changes before they reach you, as your quality agreement requires?

Keep the scale simple. A three-by-three or five-by-five matrix that resolves to high, medium and low risk bands is far more useful than a falsely precise numerical model whose weightings you cannot defend. Under ICH Q9, the formality of the method should be proportionate to the risk; resist the urge to over-engineer.

Translate risk bands into proportionate controls

A score is worthless unless it changes what you do. The output of the assessment must map directly to a defined level of oversight, so that the rationale for an on-site audit versus a questionnaire is explicit and consistent.

1. High risk — on-site audit before approval and at a defined frequency thereafter, a signed quality (technical) agreement, formal change notification, and routine performance review.
2. Medium risk — a postal or remote assessment supported by documented evidence, with an on-site audit triggered by adverse trends or significant change.
3. Low risk — questionnaire and documentary review on a longer cycle, with reliance on goods-in checks and performance monitoring.

The point of risk-ranking suppliers is not to audit fewer of them; it is to make sure the audits you do run are aimed at the things most likely to harm a patient.

Where you place reliance on a third-party audit or a certification scheme, record why that reliance is justified and confirm the scope genuinely covers your material. A clear, well-run supplier qualification and ongoing supplier management programme is what turns these bands into a living system rather than a one-off exercise.

Keep the assessment alive: review triggers and re-scoring

Risk is not static, and an assessment frozen at the point of approval will quietly drift out of date. Build explicit re-evaluation triggers into your procedure so that the score moves when reality does.

• A confirmed quality defect, recall or significant deviation linked to the supplier.
• A change of manufacturing site, ownership, sub-contractor or critical process.
• An adverse inspection outcome, certificate suspension or regulatory action.
• A deteriorating trend in rejections, complaints or delivery performance.

Even without a trigger, every supplier should be re-assessed on a periodic cycle whose length reflects its risk band. The product quality review is a natural place to surface supplier performance data and feed it back into the next assessment, closing the loop between monitoring and qualification. This continual-improvement cycle is exactly the behaviour ICH Q10 expects of a mature pharmaceutical quality system.

Common pitfalls that undermine credibility

Inspectors and customer auditors tend to probe the same weaknesses, and most are easily avoided once you know to look for them.

• Scoring without evidence. A risk rating that cannot point to the data behind it will not survive challenge. Apply ALCOA+ thinking to the assessment record itself, not only to manufacturing data.
• One-size-fits-all questionnaires. A generic checklist sent to every supplier produces generic answers; tailor the depth to the criticality.
• Orphaned actions. Risks identified but never tracked to closure are worse than risks never identified, because they prove you knew.
• Ignoring the lower tiers. Your direct supplier may be sound while a sub-tier source is not; the chain is only as strong as its weakest visible link.

Key takeaways

A practical supplier risk assessment is methodical, evidence-based and proportionate. Define your criticality and likelihood criteria up front, score consistently against them, and translate the resulting risk bands into a clear, documented level of oversight that an inspector would recognise as rational. Then keep it alive with explicit review triggers and a periodic re-scoring cycle so it reflects real performance rather than a historical snapshot.

If you would like a second pair of eyes on your supplier-qualification programme, or support running risk-based audits across a complex chain, see how we have helped other quality teams in our case studies, explore our wider services, or get in touch for a confidential conversation about your supply chain.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Part II — Active Substances (APIs)
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.