Qualifying a Canadian Contract Laboratory: What Health Canada GMP Actually Requires

Most GMP deficiencies Health Canada cites during inspections don’t come from production floors. They come from paper — or the absence of it. One of the most consistently flagged gaps is inadequate supplier qualification, specifically for the contract laboratories that generate your testing data. When an inspector asks to see your lab qualification file and you hand over a printed COA and a marketing brochure, the conversation doesn’t go well.

Qualifying a contract laboratory isn’t bureaucratic box-checking. Under Division 2 of Part C of the Food and Drug Regulations (C.02.012), manufacturers are responsible for ensuring that their materials — and the test data supporting product release — come from qualified, Canada GMP-compliant sources. For natural health product manufacturers, Schedule 2 of the Natural Health Products Regulations (NHPR) imposes parallel obligations. The accountability runs through your quality system whether the pipettes are in your building or someone else’s.

The good news: building a solid lab qualification program is entirely achievable, and it doesn’t require reinventing anything. Here’s how we approach it with clients who are either setting up their supplier qualification framework for the first time or shoring up gaps ahead of a Health Canada inspection.

Step 1: Define the Scope of Qualification Before You Start

Not every contract lab you interact with requires the same depth of qualification. The risk-based approach Health Canada endorses under its GMP Guidelines (GUI-0001) means your qualification effort should scale with what the lab is actually doing for you.

High-rigor scenarios that demand full qualification include release testing of finished drug products or NHPs, potency or identity testing for APIs, sterility or endotoxin testing for sterile products, and any testing result used to make a product disposition decision.

Lower-rigor scenarios — still requiring documentation, but not a full audit package — include environmental monitoring support, method development work that won’t be used for release, and reference standard confirmation.

Practically, we recommend categorizing contract labs as Tier 1 (release-critical) or Tier 2 (non-release) and building qualification templates accordingly. This prevents over-engineering for every supplier while keeping the high-stakes relationships properly documented. A lot of organizations we work with have never explicitly drawn this line — which means they’re either over-qualifying minor vendors or, more dangerously, under-qualifying critical ones.

Step 2: Request and Review the Right Documentation

This is where most qualification programs fall short — not in intention, but in specificity. Teams know they should “review credentials,” but the scope of that review is often too thin.

For a Tier 1 contract lab under Canada GMP, you should be collecting and reviewing:

Accreditation certificate. An ISO/IEC 17025:2017 accreditation certificate from the Standards Council of Canada (SCC) or a recognized ILAC member body. Pay close attention to the scope — the lab’s accreditation may not cover the specific method you need. A lab accredited for cannabis potency testing isn’t automatically qualified for pharmaceutical dissolution testing under USP <711>.

Drug Establishment Licence (DEL). If the lab is performing release testing on drug products for the Canadian market, they should hold a DEL from Health Canada with an “analytical testing” activity listed. Some labs operate under a client’s GMP umbrella, but this arrangement requires additional documentation to justify and is less common than most people assume.

SOPs and method validation or verification reports. Request the SOPs governing sample handling, chain of custody, and the specific compendial or validated methods they’ll use for your products. Compendial methods (USP, Ph.Eur., BP) don’t require full in-house validation, but the lab should demonstrate method suitability under their specific conditions via a verification study. Ask for those verification data.

OOS event summary. Ask for a summary of out-of-specification events from the past 12 months — not individual results, but aggregate counts and confirmation that a formal investigation procedure exists. A lab that has never had an OOS event is statistically suspicious. A lab that can’t tell you how many they’ve had is a red flag.

Training records format. You don’t need individual employee files, but confirm the lab has a documented training program and that analysts are formally qualified on the methods they’ll run for you.

Expect this documentation package to take 2–4 weeks to gather from a reasonably organized lab. If it takes significantly longer, that tells you something about their QMS.

Step 3: Conduct a Supplier Questionnaire or On-Site Audit

For Tier 1 labs, a questionnaire alone is rarely sufficient — especially if they’re performing release testing or sterility work. Health Canada inspectors reviewing your supplier qualification files will ask whether you have direct, documented knowledge of the lab’s quality system, not just their certificates.

A supplier questionnaire covers the fundamentals in writing: equipment calibration and maintenance programs, reference standard management, data integrity controls, and handling of client confidentiality. This is a reasonable starting point for remote qualification or for Tier 2 relationships.

An on-site audit — or a virtual audit with live screen-sharing access to their LIMS — gives you direct observation. A 4–6 hour audit should cover:

• Physical layout and sample segregation (cross-contamination risk between client samples)
• LIMS data trail — can raw data be modified without a documented, timestamped audit trail?
• Reference standard log — are they tracking expiry dates, source certificates, and lot numbers?
• Column log for HPLC/UPLC systems — are columns tracked for use, condition, and re-qualification triggers?
• Analyst interviews at the bench level — does the person who will actually run your samples understand the method?

One thing we see consistently: labs that look excellent on paper can have surprisingly weak data integrity practices at the bench level. The LIMS audit trail is particularly revealing. If you can’t get a clear answer on how raw data modifications are logged, that’s a Canada GMP data integrity problem — regardless of what the ISO 17025 certificate says.

Step 4: Run a Comparative Study Where Feasible

Before transferring routine testing to a new contract lab, running a parallel or split-sample study gives you empirical qualification data rather than just a paper file.

Send 3–5 samples of a reference material or well-characterized product, run the analysis at both your internal lab (or your current qualified lab) and the candidate lab under identical conditions, then compare results. Acceptance criteria should be defined in advance — typically within 2–3× the method’s established %RSD. If the candidate lab’s results diverge beyond your predefined acceptance limit, that’s a qualification failure requiring investigation before you proceed.

For organizations without an internal lab, a comparative study against certified reference materials (CRMs) achieves a similar purpose. This step may feel optional when timelines are tight, but for sterile or complex-matrix products it’s exactly the kind of proactive quality evidence that Health Canada inspectors look for when they’re deciding how closely to examine your supplier qualification program.

Step 5: Execute and Archive a Formal Quality Agreement

A quality agreement — sometimes called a technical agreement — is not optional under Canada GMP. GUI-0001 Section 5.5 explicitly addresses the need for written agreements between manufacturers and their contract laboratories, specifying responsibilities for sampling, testing, result reporting, OOS notification, and record retention.

Key clauses that clients consistently neglect:

OOS notification protocol. The lab must notify you immediately when an OOS result is generated — not just report a failure on the final COA. You need time to initiate your own investigation before making any product disposition decision. Build in a 24-hour notification requirement.

Change notification. If the lab changes their validated method, analytical equipment, or the qualified analyst assigned to your account, they must notify you in advance. This prevents the scenario where a result is generated under materially different conditions than what you originally qualified.

Right to audit. Include an explicit provision allowing on-site audits with reasonable notice — typically 30 days. Without this clause, the lab has no contractual obligation to let you through the door.

Record retention. Specify that raw data must be retained for at least the duration of your regulatory obligations — often 5 years post-product expiry for drugs under C.02, or longer if you’re operating in multiple jurisdictions.

Legal review of the quality agreement is worth the investment. Quality agreements can interact with commercial supply contracts in ways that create unintended liability, particularly around indemnification for failed testing.

What Health Canada Inspectors Actually Look For

During a Health Canada GMP inspection, your contract lab qualification documentation typically surfaces in two places: the materials section of your Quality Management System tour, and any product-specific OOS investigation where lab data is central to the inquiry.

Inspectors will typically request your approved supplier list and the evidence basis for each lab’s qualification status, the most recent version of each quality agreement, your audit schedule with evidence that audits were actually conducted, and any OOS results from the contract lab alongside your internal investigation records.

The observation that kills programs isn’t usually the absence of a certificate — it’s the absence of a systematic, documented decision that the lab was qualified. A 15-page audit report from three years ago, with no subsequent re-qualification or surveillance activity, may be less defensible than a simpler annual questionnaire with documented review and sign-off. Currency and consistency matter as much as thoroughness.

Re-qualify your Tier 1 labs every 12–24 months on a defined schedule. If there’s a significant OOS event, a material change notification, or any regulatory action against the lab, trigger an unscheduled review regardless of where you are in the cycle.

---

Building this right takes 6–10 weeks for a Tier 1 lab from first contact to executed quality agreement. That’s not a trivial investment — but it’s substantially less painful than receiving an inspection observation that requires you to retroactively justify every piece of testing data in your quality record.

If you’re building out your Canadian supplier qualification program or preparing for a Health Canada GMP inspection, mapping your contract lab relationships early gives you options. Rushing the process once you’re already in an inspection window rarely ends well.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance. Contact us

Related from our network

• ISO 17025-Accredited Testing for Canadian Drug and NHP Products — Qalitex Laboratories provides accredited analytical testing services for pharmaceutical and natural health product manufacturers requiring GMP-compliant documentation.
• EU GMP Compliance and Supplier Qualification for the European Market — Care Europe supports manufacturers expanding into the EU with regulatory consulting and GMP compliance programs under EU 2001/83/EC and Annex 16.