Templates8 min readUpdated May 2026

Pharmaceutical Vendor Audit SOP: GMP & Compliance Guide

Having a well-structured vendor audit checklist for pharmaceutical industry is the single most important step you can take to ensure consistency, reduce errors, and save countless hours of repeated effort. Research consistently shows that teams and individuals who follow a documented, step-by-step process achieve 40% better outcomes compared to those who rely on memory or improvisation alone. Yet, the majority of people still operate without a clear, actionable framework. This comprehensive Pharmaceutical Vendor Audit SOP: GMP & Compliance Guide template bridges that gap — giving you a battle-tested, ready-to-use guide that covers every critical step from start to finish, so nothing falls through the cracks.

Complete SOP & Checklist

Template Registry

Standard Operating Procedure

Registry ID: TR-VENDOR-A

Standard Operating Procedure: Pharmaceutical Vendor Audit Process

This Standard Operating Procedure (SOP) defines the systematic approach for evaluating, selecting, and maintaining the oversight of third-party vendors within the pharmaceutical supply chain. Given the regulatory requirements of Good Manufacturing Practices (GMP), Good Distribution Practices (GDP), and Good Pharmacovigilance Practices (GPvP), this audit process ensures that all partners maintain the quality standards necessary to protect patient safety, ensure data integrity, and guarantee product efficacy.

Phase 1: Pre-Audit Preparation

Define Scope: Determine if the audit is for a new vendor (initial qualification) or an existing vendor (re-qualification).
Documentation Review: Collect the vendor’s current Quality Manual, organizational chart, site master file, and relevant certifications (ISO, FDA/EMA inspection history).
Risk Assessment: Categorize the vendor based on criticality (e.g., API supplier vs. janitorial services) to determine the audit depth required.
Audit Agenda: Distribute the agenda to the vendor at least 14 days prior to the onsite visit, outlining required personnel and document access.

Phase 2: Quality Management Systems (QMS)

Governance: Confirm that a robust QMS is in place, with documented policies for Management Review.
Document Control: Verify procedures for the creation, approval, distribution, and archival of SOPs.
Change Control: Ensure the vendor has a formal system for managing changes to materials, processes, or facilities that may impact product quality.
CAPA System: Evaluate the effectiveness of Corrective and Preventive Action processes, including root cause analysis (RCA) techniques.

Phase 3: Facility and Operational Controls

Personnel Training: Review training records for all operators handling critical processes; ensure periodic refresher training is documented.
Calibration & Maintenance: Verify that all instruments affecting product quality are on a valid calibration schedule with traceable standards.
Environmental Monitoring: Inspect logs for controlled environments (cleanrooms, cold storage) to ensure compliance with temperature and humidity specifications.
Sanitation: Review pest control programs and cleaning validation protocols to prevent cross-contamination.

Phase 4: Production and Data Integrity

Material Traceability: Conduct a "traceability challenge" by selecting a finished product and tracing it back to the raw material receipt.
Data Integrity (ALCOA+): Ensure all electronic and paper-based data is Attributable, Legible, Contemporaneous, Original, and Accurate.
Stability Testing: Verify that stability samples are held under appropriate conditions and tested per established protocols.
Complaint/Recall Management: Review the vendor’s mock recall procedure and evidence of recent effectiveness testing.

Phase 5: Post-Audit Follow-Up

Audit Report: Compile a formal report documenting observations, categorizing findings (Critical, Major, Minor).
CAPA Plan: Require the vendor to submit a detailed CAPA plan with firm completion dates for all non-conformances.
Classification: Issue an Approved, Conditionally Approved, or Disqualified status based on the audit outcome.

Pro Tips & Pitfalls

Pro Tip: Always interview the front-line operators, not just the Quality Manager. Operators often reveal more about the culture of compliance than management.
Pro Tip: Perform a "Data Integrity Walkthrough." Ask to see the raw data for a specific test result, not just the summarized report.
Pitfall: Focusing solely on physical facilities. In modern pharma, the "invisible" risks—software validation, cybersecurity, and data management—are where most audit failures occur.
Pitfall: Accepting vague CAPAs. If a vendor says they will "retrain staff," require evidence of how the training material was revised to address the specific root cause.

Frequently Asked Questions (FAQ)

1. How often should a critical pharmaceutical vendor be audited? Critical vendors (e.g., API manufacturers) typically require a formal onsite audit at least every 2 to 3 years, supplemented by annual remote performance reviews (Quality Agreements and QBRs).

2. What is the difference between a 'Major' and 'Critical' finding? A 'Critical' finding indicates a direct risk to patient safety or product efficacy (e.g., falsified data). A 'Major' finding is a breakdown in the QMS that does not immediately impact product quality but presents a significant risk of doing so if left unaddressed.

3. What should I do if a vendor refuses to provide requested documentation? Refusal to provide documentation is a major red flag regarding transparency. It should be documented as an observation, and the vendor’s qualification status should be downgraded or suspended until the information is provided and verified.

Page 1 of 1

View all