How do you risk-rank suppliers?

Most life sciences manufacturers work with hundreds of suppliers, from active ingredient manufacturers to packaging printers and calibration contractors. Treating them all the same is impossible. Auditing them all is unaffordable. Risk-ranking lets you spend your oversight effort where it protects product and patients most.

Step 1: Assess criticality

Start with what the supplier provides. Ask how directly the material or service affects product quality or patient safety. Active ingredients, primary packaging and contract manufacturing usually sit at the top. Office supplies sit at the bottom. Score criticality on a simple scale, such as one to five.

Step 2: Assess supplier risk

Next, look at the supplier itself. Consider:

• Quality history: non-conformances, complaints and rejected deliveries.
• Regulatory status: certifications, inspection history and any warning letters.
• Location and access: how easy the supplier is to audit and communicate with.
• Complexity: how complex or variable the material or process is.
• Dependency: whether you rely on a single source.

Step 3: Combine and rank

Combine criticality and supplier risk into an overall rating. A simple matrix works well: high criticality and high supplier risk means high overall risk. Then group suppliers into high, medium and low.

“Oversight should follow risk. Spend your audit days where a failure would hurt most.”

Craig Jacobs, Founder and Chief Momentum Officer, Affirm8

Step 4: Match oversight to risk

• High risk: on-site or remote audits on a regular cycle, a detailed quality agreement, performance reviews and clear change notification requirements.
• Medium risk: questionnaires, periodic remote or desktop assessments and performance monitoring.
• Low risk: approval based on certification and incoming checks, with review if problems arise.

EU GMP Chapters 5 and 7 and ISO 9001 clause 8.4 all expect supplier control to be proportionate to risk. A documented ranking also makes it easy to explain your choices to an auditor or inspector.

Step 5: Keep it current

Review ratings at least annually and whenever something changes: a quality issue, a change of site, an acquisition or a new product. Feed supplier performance data back into the ranking so it reflects reality rather than the day it was written.

When suppliers won't be audited

Large suppliers sometimes refuse audits or limit data sharing. Options include shared audit consortia, third-party audit reports, desktop assessments, increased incoming testing and strong quality agreements. Document your rationale so the decision stands up to scrutiny.

Where to start this week

1. Export your approved supplier list and add a column for criticality and one for supplier risk.
2. Score your top fifty suppliers by spend or material importance first, rather than trying to cover the whole list at once.
3. Compare the high-risk group against your current audit schedule and quality agreements, and note the gaps.

That gap list becomes your supplier oversight plan for the year. It also often shows that effort is being spent auditing low-risk suppliers while critical ones go unreviewed, which is exactly what risk-ranking is designed to fix.

The bottom line

Risk-ranking turns an impossible task into a manageable one. Instead of trying to watch every supplier equally, you focus your time, budget and audit days on the handful that could genuinely affect your product and your patients. That is better quality, and better value, at the same time.

Frequently asked questions

How often should critical suppliers be audited?

Many companies audit high-risk suppliers every one to three years, with more frequent reviews if performance drops. The right frequency depends on your risk assessment.

What should a supplier quality agreement include?

Responsibilities for quality activities, specifications, change notification, deviation and complaint handling, audit rights, and record retention, in line with the requirements of your sector.

How Affirm8 can help

Affirm8 helps quality and procurement teams across pharmaceuticals, supplements, medical devices and cosmetics risk-rank their supplier base, design supplier audit programmes and turn suppliers into respected partners. Start with the free Always Audit-Ready Diagnostic at affirm8.co.uk.

Related reading

• How do you build a risk-based internal audit programme?
• How do you get beyond “human error” in root cause analysis?