GAMP 5 - Good Automated Manufacturing Practice M2: Appendix M2 Supplier Assessment

Regulated companies formally assess every supplier of computerized systems and services used in GxP regulated work, including cloud service providers, external service providers and internal functions, with the approach based on critical thinking about what is at risk for patients, product quality and the integrity of data, and a documented justification for any supplier not assessed. Three options exist: a basic assessment on public information, market reputation, prior experience and discussions with other companies, with a documented decision not to assess commodities; a postal or email audit by questionnaire covering the organization, QMS, products and services, development life cycle, support, service delivery, training, infrastructure, security and subcontractors, with supporting evidence requested and a short report agreed with the supplier; and an on-site or virtual online audit, planned with a defined scope, a qualified lead auditor and a team that understands the technology, notified in writing including third-party auditors, run as opening meeting, evidence-based review and inspection, and closing meeting, and reported in a confidential quality record retained with the system documentation. The process is completed before the contract is finalized, findings lead to corrective actions evidenced by documents rather than a letter of confirmation, the supplier is accepted unconditionally, for certain products or versions, subject to corrective actions, with additional supervision or testing, under a contractual QMS, or prohibited, and accepted suppliers are periodically re-evaluated at a frequency set in procedure with triggers such as criticality, ownership or management change, QMS change and change of licence or delivery model. Joint audits and shared audit reports are permitted with documented scope validity, auditor qualifications, process acceptance and all-party agreement; a centralized audit repository avoids duplicate audits; suppliers prepare by making people and evidence available; and certifications such as ISO 9001, ISO 27001, ISO 27017, ISO/IEC 20000-1 and SOC 2 reports are considered with their scope and applicability understood, with ISO 19011 as the audit method reference.