Vendor Qualification Under Canada GMP: What Health Canada Inspectors Expect From Your Supplier Program

The fastest way to draw a critical observation during a Health Canada GMP inspection isn’t a missing batch record or a late deviation report. It’s a supplier qualification file that amounts to a folder of certificates of analysis and a signed questionnaire from four years ago. Inspectors have reviewed hundreds of these files, and they recognize the pattern immediately — a program that exists on paper but hasn’t been maintained as a living quality system.

Vendor qualification is one of those areas where Canada GMP requirements are genuinely clear on paper but surprisingly tricky in practice. Most manufacturers understand they need a program. Fewer understand what a program that actually survives scrutiny looks like, and fewer still have done the internal gap assessment to know where theirs falls short.

What Canada GMP Actually Requires — and Where the Guidance Lives

The regulatory basis for supplier qualification under Health Canada’s framework sits primarily in Part C, Division 2 of the Food and Drug Regulations. Section C.02.006 requires that raw materials be tested before use — but that testing obligation alone doesn’t exhaust the requirement. GUI-0002, Health Canada’s Good Manufacturing Practices Guidelines for licensed dealers, expects manufacturers to understand and verify their suppliers’ quality systems, not simply receive and test incoming material.

For natural health product manufacturers, the parallel requirements appear in Part 3 of the Natural Health Products Regulations (SOR/2003-196), in the provisions governing raw material sourcing, identity verification, and testing. The regulatory language differs from the drug GMP framework, but the practical expectation converges: you need documented evidence that your supplier can consistently produce material meeting your specifications, and that evidence needs to be current.

What both frameworks share is a risk-based logic. A supplier of printed folding cartons doesn’t carry the same quality risk as a supplier of an active pharmaceutical ingredient or a concentrated botanical extract. Health Canada GMP guidelines expect your program to reflect that hierarchy explicitly — not just in how much paperwork you generate, but in how often you revisit each supplier’s status and what triggers a re-qualification.

The Three Gaps That Reliably Trigger Inspection Findings

After working through supplier qualification remediations with a range of Canadian manufacturers, three gaps come up with enough consistency that they deserve specific attention.

Gap 1: The questionnaire-only approach. Sending a supplier questionnaire, receiving it back completed, and treating that as qualification is a documentation exercise, not a quality system. There’s nothing inherently wrong with questionnaires — they’re a legitimate and efficient tool for lower-risk, non-critical materials. But for critical suppliers, a questionnaire is a starting point, not a conclusion. The question an inspector will ask is: when did you last verify that the supplier’s answers are accurate? If the honest answer is “when we sent the questionnaire in 2022,” that’s a finding.

Gap 2: Qualification without re-qualification. A supplier qualification file frozen at the time of initial approval is a liability that compounds over time. Suppliers relocate manufacturing operations, outsource production to subcontractors, get acquired by new parent companies, or change their own upstream sourcing — any of which can meaningfully affect the quality of what you receive. None of these changes will appear in your documentation unless you have a structured re-qualification schedule. A defensible program establishes explicit re-qualification intervals: typically 12 to 24 months for critical API and active ingredient suppliers, and 24 to 36 months for lower-risk materials. Those intervals should be documented, and the completed reviews should generate records.

Gap 3: No connection between incoming failures and supplier status. If a supplier has generated 3 out-of-specification incoming test results in the past 18 months and they’re still listed as “qualified” in your approved supplier list with no formal review, no corrective action, and no documented rationale, you have an internal consistency problem that’s visible to any inspector who cross-references your incoming testing logs against your supplier files. This happens more often than it should, and it’s the kind of discrepancy that turns a routine observation into a lengthier conversation about the integrity of your quality system.

What a Defensible Supplier Qualification File Actually Contains

For a critical material supplier — an API source, a botanical extract manufacturer, or a contract analytical laboratory whose test results you’ll rely on in regulatory submissions — a qualification file should contain at minimum 8 core document categories:

1. Supplier qualification questionnaire (completed, dated, version-controlled, with the supplier’s signature)
2. Supplier audit report or a documented, risk-justified rationale for waiving the on-site audit
3. Current GMP certificate issued by a recognized regulatory authority, where applicable
4. Approved material specifications and acceptance criteria, signed off by quality
5. Representative COA history — at minimum 3 consecutive lot COAs reviewed for consistency against your specifications
6. Risk assessment formally classifying the supplier as critical, major, or minor, with documented rationale
7. Qualification approval signed by your Qualified Person or designated quality authority
8. Re-qualification schedule and records of completed re-qualification reviews

For contract analytical laboratories, there’s an additional expectation worth noting explicitly: evidence that the laboratory holds ISO/IEC 17025 accreditation for the specific methods being performed, or a documented and quality-approved rationale for accepting results from a non-accredited source. Health Canada reviewers scrutinize this, particularly when those results are submitted as part of a product licence or drug submission.

On-Site Audits: When You Actually Need One

This is where manufacturers tend to err in both directions — either auditing every supplier on the same annual schedule regardless of risk, or avoiding on-site audits entirely and hoping questionnaires suffice. Neither approach is defensible under Health Canada’s GMP guidelines.

A risk-based model means on-site audits for suppliers where a quality failure would directly affect patient safety or product efficacy, or where the process is complex enough that a questionnaire can’t adequately characterize what’s happening at the facility. That generally includes API manufacturers (ICH Q7 expects API purchasers to maintain an active audit program, with frequency calibrated to the supplier’s risk profile and inspection history), novel botanical extract suppliers where identity and potency verification is technically demanding, and contract manufacturers handling critical production steps.

For a qualified API supplier with a strong track record and no recent quality events, an audit every 2 to 3 years is generally considered defensible under both ICH Q10 and Health Canada’s inspection expectations. For a supplier that has generated quality issues, changed its manufacturing site, or that your team has never physically visited, a shorter interval — or an immediate audit — is warranted.

One practical point that often gets overlooked: if your supplier holds a current GMP certificate from a regulatory authority that Health Canada has a Mutual Recognition Agreement or Collaborative Arrangement with — the EMA, the TGA in Australia, and several others — you can often leverage that inspection record to reduce your own audit burden without compromising the integrity of your qualification. The critical step is documenting that decision explicitly in your risk assessment, not simply assuming it applies.

Building an Approved Supplier List That Actually Functions as a Control

Your approved supplier list (ASL) is the administrative backbone of your vendor qualification program — but only if it’s maintained as a controlled quality document rather than a static spreadsheet in a procurement folder.

A functional ASL should capture, at minimum: supplier name and site address, materials approved for supply from that site, risk tier, qualification approval date, re-qualification due date, and current status (approved, conditional, suspended, or disqualified). It should be version-controlled, reviewed at defined intervals by quality, and connected to your change control process.

That last point matters. When a supplier notifies you of a manufacturing site change, a process change, or a change in their own upstream sourcing, that notification should trigger a formal change control review — not a note in an email thread. Health Canada GMP guidelines expect that changes with potential quality impact are evaluated and approved before you continue receiving and using material from that supplier as though nothing has changed. Inspectors ask specifically whether supplier change notifications are being routed through your quality system, and the answer “we handle those through procurement” is not the answer they’re looking for.

What Inspectors Actually Ask During a Supplier Controls Review

During a Health Canada GMP inspection, the section on supplier controls typically runs through a combination of document review and targeted follow-up questions. The questions are designed to distinguish between a program that’s operational and one that’s been documented for show.

Common lines of inquiry include: “Walk me through how you qualified this API supplier” — inspectors want to hear a coherent process, not a description of where the folder lives. “When was this supplier last re-qualified, and what prompted the review?” “You had 2 OOS results from this excipient supplier in the past year — what happened to their qualification status?” “Who approves additions and removals from your approved supplier list, and what’s the process?”

The pattern behind these questions is consistent: inspectors are trying to determine whether your supplier qualification program is a living part of your quality system or a collection of documents assembled at the time of initial qualification and not touched since. The distinction is obvious in practice, and it shows up in inspection outcomes.

A Practical Starting Point for Smaller Canadian Manufacturers

If you’re running a 15- to 20-person NHP or pharmaceutical manufacturing operation in Canada with a lean quality team, the expectation isn’t that you maintain a 60-page qualification dossier for every purchased material. The expectation is that your program is proportionate to your actual risk exposure, consistently applied across your supply chain, and documented with enough specificity that an inspector can follow your logic without needing you in the room.

For most smaller operations, the most impactful first step is a straightforward material risk-tiering exercise: list every material you purchase, assign each a risk tier based on its function and quality criticality, then compare your current documentation level against what each tier genuinely requires. In almost every case, you’ll find critical-tier materials sitting with minor-tier documentation. Those gaps are exactly what inspectors identify — and they’re addressable before an inspection, not after.

Our team works regularly with Canadian manufacturers across the spectrum, from early-stage NHP licence applicants to established DEL holders preparing for scheduled inspections, to build and remediate supplier qualification programs that hold up under Health Canada GMP scrutiny. The time and cost of getting this right in advance is a fraction of the effort required to respond to a critical GMP observation with a mandated corrective action plan and a re-inspection timeline.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance. Contact us

Related from our network

• ISO 17025 Accredited Analytical Testing for Canadian Supplier Qualification — When your supplier qualification program requires third-party analytical data, Qalitex Laboratories provides ISO 17025-accredited testing to support Health Canada submissions and incoming material release.
• EU Supplier Qualification and REACH Compliance for Imported Ingredients — If your supply chain includes European-sourced ingredients or excipients, Care Europe covers the EU regulatory dimension of supplier qualification, including REACH compliance and EU GMP expectations.