Pharma
- What applies
- EU GMP Part I Chapter 5 governs procurement of starting materials, Chapter 7 outsourced activities; principles: Directive (EU) 2017/1572.
What does procurement consulting deliver when life sciences companies have to ensure GMP compliance and quality standards in regulated procurement?
Our procurement consulting embeds regulatory requirements into the procurement processes: risk-based supplier selection, quality agreements and auditable tendering and contract management. The most common audit finding is a supplier switch without a clean change control path: a cost-driven decision meets a quality agreement nobody updated.
Overview
Which compliance risks arise in regulated procurement?
Procurement made auditable in line with EU GMP Guide Part I Chapters 5 and 7 as well as ISO 13485:2016
Last updated: September 18, 2026
In life sciences, procurement is not a purely operational function but a quality-relevant one. The EU GMP Guide (EudraLex Volume 4) requires that starting materials be sourced only from qualified suppliers and that outsourced activities be governed by contract.
- Supplier switch without a complete change control process. When a qualified supplier is replaced without the change running through change management, this results in a GMP finding under Part I, Chapter 5 of the EU GMP Guide.
- Missing or outdated quality agreement with critical suppliers. The EU GMP Guide, Part I, Chapter 7 requires a written contract for outsourced activities that clearly defines the GMP responsibilities of the contract giver and the contract acceptor.
- Purely cost-driven procurement decisions without a risk assessment of supply compliance, even though ICH Q10 expects risk-based supplier management as part of the pharmaceutical quality system.
- Gaps in the supplier audit program: critical suppliers are not audited at all or too rarely. For medical devices and IVD, ISO 13485:2016 requires documented criteria for the selection, evaluation and monitoring of suppliers based on risk.
Industries
What this means in your industry
Biotech
- What applies
- EU GMP Part I Chapters 5 and 7 and ICH Q10 apply as in pharma.
MedTech
- What applies
- ISO 13485:2016 Clause 7.4 governs purchasing under the MDR (EU) 2017/745; the FDA adopts it via 21 CFR Part 820.
IVD
- What applies
- Under the IVDR (EU) 2017/746, the same Clause 7.4 of ISO 13485:2016 governs purchasing.
Services
How we support you
Procurement process design & SOP development
Design of auditable procurement processes from requirement definition through tendering and supplier selection to change control when switching suppliers. Deliverable: an SOP set that evidences every process step in line with EU GMP Guide Part I, Chapters 5 and 7, including the link to supplier qualification.
Supplier risk assessment & categorization
Risk-based categorization of the supplier portfolio into critical, important and standard suppliers following the approach of ICH Q10. Deliverable: a supplier matrix that justifies audit frequency and monitoring depth per category and derives the audit plan.
Procurement KPI system & process metrics
Building a procurement performance system with on-time delivery, quality metrics, supplier ratings and compliance status. Deliverable: a metric set as the basis for data-driven procurement decisions and the periodic supplier evaluation.
How we work together
What it comes down to
In regulated procurement, the real lever sits upstream of the order, not in the negotiation. A procurement decision is often made on price, yet it only becomes GMP-relevant through the supplier and the outsourced activity behind it.
The clean path runs exactly the opposite way to standard purchasing: first the risk categorization of the supplier, which under ICH Q10 determines audit frequency and monitoring depth.
Then the quality agreement per EU GMP Guide (EudraLex Volume 4), Part I, Chapter 7, which clearly assigns the GMP responsibilities. And only then the commercial contract. Reverse this sequence and you are negotiating terms before it is even established which quality obligations the supplier can actually bear.
The most expensive bottleneck arises when switching suppliers. A qualified supplier is replaced, but change management per Part I, Chapter 5 does not run alongside, and the quality agreement stays at its old version.
We couple the procurement process to change control and to supplier qualification, so that a switch does not surface only in the audit but runs through the documented path.
A missing signature or an open item in the audit program is cheap to correct at that stage; in the regulatory audit the same gap becomes a finding.
Our approach
Our approach
Step
Result
01
Current-state assessment of procurement processes
Findings list: where the procurement process deviates from EU GMP Guide Part I, Chapters 5 and 7 as well as ISO 13485:2016, and which findings are critical.
02
Supplier risk categorization
Supplier matrix with critical, important and standard suppliers and the audit frequency and monitoring depth derived from it.
03
Quality agreements
Signature-ready quality agreements for the critical suppliers with clearly assigned GMP responsibilities under Chapter 7.
04
Processes & SOPs
Approved SOP set that maps tendering, supplier selection and change control when switching suppliers in an auditable way.
05
KPI system & audit program
An operating procurement KPI system and a documented, risk-based supplier audit program with an audit plan.
Common pitfalls
Where projects commonly fail
The supplier switch is treated as a pure purchasing decision.
Without a change control process per EU GMP Guide Part I, Chapter 5, the qualification of the new supplier remains open and the quality agreement outdated, a standard finding in the GMP audit.
The quality agreement remains a template without concrete assignment.
Chapter 7 of the EU GMP Guide requires that the GMP responsibilities of the contract giver and contract acceptor be clearly defined; blanket clauses without clear responsibility lead to objections and accountability gaps in the event of a complaint.
Procurement decisions are made on price alone.
If the risk assessment of supply compliance is missing, critical materials end up with suppliers that lack sufficient GMP maturity. The bottleneck only becomes apparent when a batch has to be held.
The audit program is not risk-based.
If all suppliers are assessed at the same frequency or by questionnaire only, this contradicts the expectation of the FDA and EMA of a documented, risk-based program; critical suppliers such as API manufacturers and CDMOs are then audited on site too rarely.
The quality agreement and the supply contract contradict each other.
When the commercial framework agreement and the quality agreement are maintained separately, conflicts arise over change notification and audit rights. In the audit, what the quality agreement governs counts, not the purchasing terms.
Supply Chain & Technical Operations
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
A quality agreement is a document agreed in writing between the contract giver and the supplier that defines the respective quality and GMP responsibilities: GMP standards, change notification, audit rights, complaint and deviation management, and traceability. For outsourced activities, the EU GMP Guide (EudraLex Volume 4), Part I, Chapter 7 requires such a contract that clearly assigns responsibilities.
All suppliers that provide GMP-relevant materials or services: active pharmaceutical ingredients (API), excipients, primary packaging, sterilization service providers, CDMOs, testing laboratories and critical component suppliers. IT service providers for GMP-relevant systems may also require a quality agreement. The decisive factor is the quality relevance of the outsourced activity per Chapter 7 of the EU GMP Guide.
No fixed frequency is prescribed by regulation; what is required is a risk-based approach. ICH Q10 and the EU GMP Guide expect a documented audit program that derives frequency and depth from the supplier category. In practice, critical suppliers such as API manufacturers and CDMOs are audited considerably more often and preferably on site than standard suppliers, some of which are covered by questionnaire.
Supplier qualification is the initial assessment and approval of a new supplier for GMP-compliant use. Supplier development is the ongoing support of the supplier to improve its performance and compliance capability. Compliant procurement connects both with the procurement process: tendering, contract and change control.
Yes. For medical devices and in vitro diagnostics, ISO 13485:2016 requires documented criteria for the selection, evaluation and monitoring of suppliers based on risk; the requirements are anchored in the QM systems under the MDR (EU 2017/745) and the IVDR (EU 2017/746). In the US, the same has applied since 2 February 2026 through 21 CFR Part 820 (QMSR), which incorporates ISO 13485:2016 by reference; the governing requirement for purchasing there is Clause 7.4 of the standard. Procurement control and supplier monitoring are therefore also subject to audit outside the pure GMP environment.
Sources
- EU GMP Guide (EudraLex Volume 4), Part I, Chapter 5 (Production) and Chapter 7 (Outsourced Activities)
- ICH Q10: Pharmaceutical Quality System
- ISO 13485:2016: Quality management systems for medical devices (purchasing)
- Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), QM system requirements
- 21 CFR Part 211 (US cGMP) and 21 CFR Part 820 (QMSR, effective since 2 February 2026, with ISO 13485:2016 Clause 7.4 for purchasing)
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Latest insights
All insights →Regulations & standards considered
- EU GMP Guide (EudraLex Volume 4), Part I, Chapter 5 (Production / Procurement of Starting Materials)
- EU GMP Guide (EudraLex Volume 4), Part I, Chapter 7 (Outsourced Activities)
- Directive (EU) 2017/1572 (GMP principles for medicinal products for human use)
- ICH Q10 (Pharmaceutical Quality System)
- ISO 13485:2016 (QM system for medical devices, purchasing)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- 21 CFR Part 211 (cGMP for Finished Pharmaceuticals)
- 21 CFR Part 820 (Quality Management System Regulation, QMSR, incorporating ISO 13485:2016 Clause 7.4 for purchasing; formerly Section 820.50 Purchasing Controls)
Related topics
Supplier Development & Qualification →
Initial qualification and ongoing development of the suppliers that compliant procurement presupposes
Supply Chain Governance →
Overarching steering of the supply chain in which the operational procurement process is embedded
GxP Audits (GMP, GLP, GCP) →
Supplier audits as part of the risk-based audit program
Change Management →
Change control when switching suppliers per EU GMP Guide Part I, Chapter 5
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences