How do life sciences companies ensure GMP compliance and quality standards in regulated procurement?
We embed regulatory requirements into the procurement processes for pharma, biotech, medtech and IVD: from risk-based supplier selection through quality agreements to auditable tendering and contract management. The most common audit finding does not arise when sourcing a new material, but when switching suppliers without a clean change control path. That is where a cost-driven decision meets a quality agreement that no one updated beforehand.
- Pharma
- Biotech
- MedTech
- IVD
Overview
Which compliance risks arise in regulated procurement?
Procurement made auditable in line with EU GMP Guide Part I Chapters 5 and 7 as well as ISO 13485:2016
Last updated: 2026-06-13
In life sciences, procurement is not a purely operational function but a quality-relevant one. The EU GMP Guide (EudraLex Volume 4) requires that starting materials be sourced only from qualified suppliers and that outsourced activities be governed by contract. Four points at which procurement processes most frequently come up in audits:
- Supplier switch without a complete change control process. When a qualified supplier is replaced without the change running through change management, this results in a GMP finding under Part I, Chapter 5 of the EU GMP Guide.
- Missing or outdated quality agreement with critical suppliers. The EU GMP Guide, Part I, Chapter 7 requires a written contract for outsourced activities that clearly defines the GMP responsibilities of the contract giver and the contract acceptor.
- Purely cost-driven procurement decisions without a risk assessment of supply compliance, even though ICH Q10 expects risk-based supplier management as part of the pharmaceutical quality system.
- Gaps in the supplier audit program: critical suppliers are not audited at all or too rarely. For medical devices and IVD, ISO 13485:2016 requires documented criteria for the selection, evaluation and monitoring of suppliers based on risk.
Services
How we support you
Procurement process design & SOP development
Design of auditable procurement processes from requirement definition through tendering and supplier selection to change control when switching suppliers. Deliverable: an SOP set that evidences every process step in line with EU GMP Guide Part I, Chapters 5 and 7, including the link to supplier qualification.
Quality agreements & contract management
Drafting and review of quality agreements with critical suppliers: GMP responsibilities, change notification, audit rights, complaint and deviation management. Deliverable: a signature-ready quality agreement that covers the requirements for outsourced activities under Chapter 7.
Learn more →Supplier risk assessment & categorization
Risk-based categorization of the supplier portfolio into critical, important and standard suppliers following the approach of ICH Q10. Deliverable: a supplier matrix that justifies audit frequency and monitoring depth per category and derives the audit plan.
Procurement KPI system & process metrics
Building a procurement performance system with on-time delivery, quality metrics, supplier ratings and compliance status. Deliverable: a metric set as the basis for data-driven procurement decisions and the periodic supplier evaluation.
Supplier audit program
Building a documented, risk-based audit program including audit plan, checklists and follow-up of findings. Deliverable: a program that meets the selection and monitoring requirements of ISO 13485:2016 as well as the regulators' GMP expectation of a risk-based supplier audit.
Learn more →How we work together
What it comes down to
In regulated procurement, sequence is the real lever. A procurement decision is often made on price, yet it only becomes GMP-relevant through the supplier and the outsourced activity behind it. The clean path runs exactly the opposite way to standard purchasing: first the risk categorization of the supplier, which under ICH Q10 determines audit frequency and monitoring depth. Then the quality agreement per EU GMP Guide (EudraLex Volume 4), Part I, Chapter 7, which clearly assigns the GMP responsibilities. And only then the commercial contract. Reverse this sequence and you are negotiating terms before it is even established which quality obligations the supplier can actually bear.
The most expensive bottleneck arises when switching suppliers. A qualified supplier is replaced, but change management per Part I, Chapter 5 does not run alongside, and the quality agreement stays at its old version. This is exactly where we come in: we couple the procurement process to change control and to supplier qualification, so that a switch does not surface only in the audit but runs through the documented path. That shifts the effort upstream, where a missing signature or an open item in the audit program can still be corrected cheaply, rather than into the regulatory audit, where the same gap becomes a finding.
Our approach
Our approach
Step
Result
Current-state assessment of procurement processes
Findings list: where the procurement process deviates from EU GMP Guide Part I, Chapters 5 and 7 as well as ISO 13485:2016, and which findings are critical.
Supplier risk categorization
Supplier matrix with critical, important and standard suppliers and the audit frequency and monitoring depth derived from it.
Quality agreements
Signature-ready quality agreements for the critical suppliers with clearly assigned GMP responsibilities under Chapter 7.
Processes & SOPs
Approved SOP set that maps tendering, supplier selection and change control when switching suppliers in an auditable way.
KPI system & audit program
An operating procurement KPI system and a documented, risk-based supplier audit program with an audit plan.
Common pitfalls
Where projects commonly fail
The supplier switch is treated as a pure purchasing decision.
Without a change control process per EU GMP Guide Part I, Chapter 5, the qualification of the new supplier remains open and the quality agreement outdated, a standard finding in the GMP audit.
The quality agreement remains a template without concrete assignment.
Chapter 7 of the EU GMP Guide requires that the GMP responsibilities of the contract giver and contract acceptor be clearly defined; blanket clauses without clear responsibility lead to objections and accountability gaps in the event of a complaint.
Procurement decisions are made on price alone.
If the risk assessment of supply compliance is missing, critical materials end up with suppliers that lack sufficient GMP maturity. The bottleneck only becomes apparent when a batch has to be held.
The audit program is not risk-based.
If all suppliers are assessed at the same frequency or by questionnaire only, this contradicts the expectation of the FDA and EMA of a documented, risk-based program; critical suppliers such as API manufacturers and CDMOs are then audited on site too rarely.
The quality agreement and the supply contract contradict each other.
When the commercial framework agreement and the quality agreement are maintained separately, conflicts arise over change notification and audit rights. In the audit, what the quality agreement governs counts, not the purchasing terms.
FAQ
Frequently asked questions
Sources
- EU GMP Guide (EudraLex Volume 4), Part I, Chapter 5 (Production) and Chapter 7 (Outsourced Activities)
- ICH Q10: Pharmaceutical Quality System
- ISO 13485:2016: Quality management systems for medical devices (purchasing)
- Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), QM system requirements
- 21 CFR Part 211 and 21 CFR Part 820: US cGMP and Purchasing Controls
- https://theentourage.de/expertise/compliant-procurement-excellence/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- EU GMP Guide (EudraLex Volume 4), Part I, Chapter 5 (Production / Procurement of Starting Materials)
- EU GMP Guide (EudraLex Volume 4), Part I, Chapter 7 (Outsourced Activities)
- Directive (EU) 2017/1572 (GMP principles for medicinal products for human use)
- ICH Q10 (Pharmaceutical Quality System)
- ISO 13485:2016 (QM system for medical devices, purchasing)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- 21 CFR Part 211 (cGMP for Finished Pharmaceuticals)
- 21 CFR Part 820 (Quality Management System Regulation, Purchasing Controls per § 820.50)
Related topics
Supplier Development & Qualification →
Initial qualification and ongoing development of the suppliers that compliant procurement presupposes
Supply Chain Governance →
Overarching steering of the supply chain in which the operational procurement process is embedded
GxP Audit Consulting →
Supplier audits as part of the risk-based audit program
Change Management Compliance →
Change control when switching suppliers per EU GMP Guide Part I, Chapter 5
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences