ICH Q9 in Supplier Qualification: Risk Decides Depth

Supplier qualification suffers from a simple failure: every supplier gets the same questionnaire, the same sample request and the same audit form, regardless of what the material does or where it sits in the process. ICH Q9 exists precisely to argue against that habit. Quality risk management says the effort should scale with the risk, and supplier selection is one of the highest-leverage places to apply it.

The idea sounds abstract until it is put as one question: if this supplier fails, what does the failure cost, and how early would we see it? The answer to that question, written down before any document is requested, is the whole methodology.

The two questions that size the effort

Severity. What happens downstream if the material is wrong? A substance entering a registered formulation carries regulatory consequences; an intermediate consumed early in a synthesis with verified clearance carries process consequences; a reagent bought on certificate of analysis alone carries mostly cost consequences. Same questionnaire, very different stakes.

Detectability. How early would a problem surface? Material with a pharmacopoeial monograph and a capable incoming lab surfaces at release. A custom intermediate with no monograph and no independent method may not surface until a downstream batch fails, months later. The harder the detection, the deeper the upstream qualification must go.

Severity and detectability together rank suppliers into tiers, and the tiers decide the work: a document pack, a sample evaluation, a remote audit, an on-site audit, or a multi-stage programme. The tier logic pairs naturally with the eight-dimension supplier scorecard, which measures performance after qualification; Q9 decides how much qualification each tier earns in the first place.

What risk does not excuse

A lower tier is not a free pass. Three elements stay in place regardless of tier, because they are what make the risk model honest.

Document integrity. Whatever pack you request, its internal consistency matters more than its thickness. A two-page pack that cross-checks is worth more than a dossier that does not, which is the premise of the first-order document pack.

Data credibility. Every tier relies on the supplier's own numbers eventually, so the credibility of those numbers is a qualification criterion, not a nice-to-have. The signals are practical: whether raw data can be shown, whether methods are identified, whether results are suspiciously round. The framework is set out in data integrity and what a COA can honestly claim.

Re-qualification triggers. Risk assessment is not a one-time gate. A change in route, site or specification reopens the file at a depth set by the same severity-and-detectability question, which is why change communication obligations belong in the agreement from the start.

Building the scale in one afternoon

The exercise needs no software. List the materials you buy, score severity and detectability on a simple scale, sort, and draw the tier lines. Then write down, per tier, what qualification consists of: which documents, what testing, whether anyone travels. Most organisations discover their effort is inverted: deep paperwork on monographed commodities and a short form on the custom intermediate where a failure is invisible until it is expensive.

That inversion is the diagnosis Q9 would make. The fix is not more investigation everywhere; it is the right investigation where detectability is lowest and severity highest, and a lighter, honest baseline everywhere else. Thirty structured questions per supplier, of the kind gathered in the due diligence question set, cover the baseline; the tier decides who also gets an audit day.

Risk-based qualification, in the end, is a budgeting statement: we will find problems where finding them is possible, and we will design upstream so that the problems we cannot find are unlikely to exist.

A worked example makes the scale concrete. Take three materials a bile-acid buyer might source in the same quarter.

A monographed pharmacopoeial substance for formulation use: severity is high, but detectability is also high, because a monograph, a reference standard and a capable incoming laboratory catch problems at release. The tier work is a solid document pack, an incoming method, and supplier performance tracking.

A custom intermediate with no monograph, consumed early in a synthesis whose downstream steps the buyer controls: severity may be moderate, but detectability is poor, because the intermediate's own impurities are not what fails; the downstream batch fails months later. This is the tier that earns an audit day, a method transfer or verification, and a specification negotiated line by line, because nothing external will catch a problem for you.

A reagent bought on certificate against a simple grade: severity low, detectability immediate at use. The tier work is a consistent document pack and nothing more, and pretending otherwise just burns audit days on commodities.

Writing the tier logic down also changes conversations with suppliers. A supplier who understands that depth of investigation follows the material's risk profile reads your questionnaire as engineering rather than bureaucracy, and answers it better. The formal texts behind the method are the ICH quality guidelines, with Q9 among them; the European implementations live on EMA, and inspection-side expectations are visible through PIC/S publications.

The review cycle is the last piece. Tiers decay as products and processes change: a reagent that becomes a registered raw material changes tier, a supplier that changes route reopens the file, and a material that starts failing incoming testing silently migrates upward in detectability-adjusted risk. Re-scoring annually, or on trigger, keeps the model honest. The methodology asks for exactly that: risk management as a living process, not a laminated chart.

Frequently asked questions

What does ICH Q9 add to supplier qualification?

It supplies the logic for effort allocation: severity of a failure times how early it would be detected decides how deep qualification goes. This replaces the habit of sending every supplier the same questionnaire regardless of material criticality.

How do I tier my suppliers?

Score each material on severity of downstream harm and detectability of a problem, sort, and draw tier lines. High severity with late detection earns audits and deep documentation; low severity with easy detection earns a consistent document pack and incoming testing.

Does a lower-risk tier mean skipping qualification steps?

No. Document consistency, data credibility and re-qualification triggers stay in every tier. The tier changes the depth of investigation, not the honesty of the baseline.

When should a supplier be re-qualified?

On any notified change to route, site or specification, and at defined periodic intervals. The depth of re-qualification follows the same severity and detectability logic as the original qualification.

How does risk-based qualification relate to supplier scorecards?

They are complementary. The risk tier decides how much qualification a supplier must earn before onboarding; the scorecard measures ongoing performance after onboarding. Using one without the other leaves either the entry or the maintenance unmanaged.

What is the commonest mistake the Q9 lens reveals?

Inverted effort: heavy paperwork on monographed commodities where incoming testing detects problems quickly, and thin screening on custom intermediates where failures surface only months later in a downstream batch.