GMP quality reports · Training guide

Supplier Qualification Report

Write the supplier qualification report: risk rating, audit outcome and findings, quality agreement, CoA verification by in-house testing and the requalification date.

Writes: GMP 3.2.S.2.3 3.2.P.4
Product type: Small molecule and biologics
Guidance it follows: ICH Q7 7.1 and 13; ICH Q10 2.7 Management of outsourced activities and purchased materials; ICH Q9(R1); EU GMP Chapter 5 (5.27–5.36) and Chapter 7; EU Guidelines on the formalised risk assessment for excipients (2015/C 95/02); 21 CFR 211.84(d), 211.80; FDA Contract Manufacturing Arrangements for Drugs: Quality Agreements (2016); IPEC-PQG GMP Guide
Time to learn: About 20 minutes with the example

Open the tool at https://app.cmcfy.com/app/supplier-qualification.html. This guide is also online at https://cmcfy.com/guides/supplier-qualification.html

1. What this module does

You choose the material type and risk, enter the audit and its findings, and the supplier and in-house results for each lot tested. The tool checks the results and the agreement between them.

It decides whether the supplier is approved, conditionally approved or not approved, and sets the next audit date by risk.

What you get

A Word or PDF report: Supplier qualification report.

2. Before you start

Have these ready. You can still start with the example data and replace it piece by piece.

The material, supplier and risk rationale.
The audit report and CAPA status of findings.
Supplier CoA and in-house results for the verification lots.

Your data stays on your computer. The bar under the title counts every network request the page makes; it stays at 0 because your data never leaves your computer. Download offline copy saves a single file that opens from your own computer with all network access blocked, for air-gapped PCs.

3. Step by step with the example

Open the tool at app.cmcfy.com/app/supplier-qualification.html. The example is loaded when the page opens, so every panel already has realistic data. Follow the steps to see how it works, then replace the example with your own data.

Describe the supplier
Enter the supplier, the material and its type, the risk and its rationale.
Enter the audit and CoA verification
Choose the assessment type and outcome, list the findings, and enter one row per lot and test.
Read the result
The headline gives the decision: "Excipia Chemicals Ltd.: approved".
CoA verification.
Resolve alerts and download
An unacceptable audit, open critical findings or an out-of-specification result is critical. Questionnaire-only assessment of a high-risk supplier, a missing quality agreement and poor CoA agreement are flagged. Then preview and download.

4. Field reference

Every input in the tool, panel by panel. Tables accept rows pasted straight from Excel, comma-separated text, or a loaded file; check the columns after loading a file. Fields marked “when it applies” appear only for the choices that need them.

1 · Supplier and material

Field	What to enter
Supplier and site	Type it in.
Regulations	Choose one: US: 21 CFR 211.84; EU: EU GMP Chapter 5 and the excipient risk guideline; Both US and EU.
Report number	Type it in.
Material	Type it in.
Material type	Choose one: Active substance; Excipient; Primary packaging; Contract service or testing; Other material.
Risk	Choose one: High; Medium; Low.
Risk rationale	Type or paste text.

2 · Audit and documents

Field	What to enter
Audit date	Type it in.
Assessment type	Choose one: On-site audit; Remote audit; Questionnaire only; Third-party audit report.
Audit outcome	Choose one: Acceptable; Acceptable with conditions; Not acceptable.
Findings	A table. Columns: Finding \| Classification (critical/major/minor) \| CAPA status (open/closed). Paste rows from Excel, type comma-separated rows, or press Load file (Excel, CSV, Word, PDF or a scan).
Quality agreement signed	Tick the box if it applies.
Certificates (GMP, ISO, CEP)	Type it in.

3 · CoA verification

One row per lot and test: the supplier's result and your in-house result, with the specification.

Field	What to enter
CoA verification	Use the same test names as the specification. A table. Columns: Lot \| Test \| Specification \| Supplier result \| In-house result. Paste rows from Excel, type comma-separated rows, or press Load file (Excel, CSV, Word, PDF or a scan).
Maximum relative difference between supplier and in-house results (%)	Type a number.

5. Checks and alerts

Calculations and pass/fail outcomes always come from fixed rules, never from AI. The tool checks:

Risk and assessment type: audit for active substances and high-risk materials.
Findings and CAPA, quality agreement.
CoA results within specification and in agreement with in-house testing.

How to resolve alerts

Critical alerts block the download and must be fixed in the data. A failing result can instead be linked to an investigation: type the investigation reference and outcome and press Record.
Major alerts block the download until you fix them or type a justification and press Accept justification.
Minor alerts do not block anything. They are listed in the documents so the reviewer sees them.
Some alerts have an Apply fix button that makes the change for you. Reopen undoes a justification.

Narratives

This module writes: Assessment and decision. Each narrative is written by fixed rules from your data. You can edit it in the box. Rewrite with AI (where your plan includes AI) rewrites it in regulatory style; every number in the text is checked against your data, and a number that does not match is flagged under the box and blocks the download until you correct it. Reset to rule-based text brings back the original.

6. Preview, gap review and download

Press Preview next to a section, or Preview and download all. The document opens in a preview window, exactly as the Word file will read.
The left side lists the review, run on your device: gaps in the data (missing values, open alerts), gaps in the report (missing content the guidance expects, placeholders such as [site] or TBD left in the text) and, if you load the approved protocol under Compare with the protocol, differences from the protocol (requirements, criteria, batches or time points it plans that the report does not show).
Click a finding to jump to the place in the preview. Fix it in the tool, then preview again.
Optional AI review: a second read for contradictions, claims without data and vague wording. The report text is sent to Claude only when you press it, and only where your plan includes AI. Check every AI finding; AI can be wrong.
Press Download Word (.docx) or Download PDF. With several documents open, All as Word (.zip) and All as PDF (.zip) download the set. The download buttons stay disabled while a blocking alert is open; the preview still works.

Documents this module produces

Section	Document
Report	Supplier qualification report

Use Save project to keep your work as a file on your computer, and Open project to continue later. Start blank clears every field; Load example brings the example back. Nothing is stored on CMCfy servers.

7. US and EU submissions

US follows 21 CFR 211.84(d). EU follows EU GMP Chapter 5 (5.27–5.36) and the excipient risk assessment guideline (2015/C 95/02). ICH Q7 7.1 applies to API suppliers.

8. Working with other modules

Excipient suppliers are described in Excipients Writer.

9. Common pitfalls

Reduced testing before the CoA has been verified.
A high-risk supplier approved on a questionnaire alone.

10. Practice exercises

Each exercise starts from the example (press Load example to reset). We run these on every update of this guide, so the result you see should match.

Fail the audit
Set the audit outcome to Not acceptable.
Expected resultThe headline shows the supplier is not approved.