The short answer
Score each supplier on what they supply and how well they perform, then focus your oversight where the score is highest. A simple high, medium and low ranking is enough for most sites, with audits and quality agreements matched to each level.
Most life sciences manufacturers work with hundreds of suppliers, from active ingredient manufacturers to packaging printers and calibration contractors. Treating them all the same is impossible. Auditing them all is unaffordable. Risk-ranking lets you spend your oversight effort where it protects product and patients most.
Start with what the supplier provides. Ask how directly the material or service affects product quality or patient safety. Active ingredients, primary packaging and contract manufacturing usually sit at the top. Office supplies sit at the bottom. Score criticality on a simple scale, such as one to five.
Next, look at the supplier itself. Consider:
Combine criticality and supplier risk into an overall rating. A simple matrix works well: high criticality and high supplier risk means high overall risk. Then group suppliers into high, medium and low.
“Oversight should follow risk. Spend your audit days where a failure would hurt most.”
Craig Jacobs, Founder and Chief Momentum Officer, Affirm8
EU GMP Chapters 5 and 7 and ISO 9001 clause 8.4 all expect supplier control to be proportionate to risk. A documented ranking also makes it easy to explain your choices to an auditor or inspector.
Review ratings at least annually and whenever something changes: a quality issue, a change of site, an acquisition or a new product. Feed supplier performance data back into the ranking so it reflects reality rather than the day it was written.
Large suppliers sometimes refuse audits or limit data sharing. Options include shared audit consortia, third-party audit reports, desktop assessments, increased incoming testing and strong quality agreements. Document your rationale so the decision stands up to scrutiny.
That gap list becomes your supplier oversight plan for the year. It also often shows that effort is being spent auditing low-risk suppliers while critical ones go unreviewed, which is exactly what risk-ranking is designed to fix.
Risk-ranking turns an impossible task into a manageable one. Instead of trying to watch every supplier equally, you focus your time, budget and audit days on the handful that could genuinely affect your product and your patients. That is better quality, and better value, at the same time.
Many companies audit high-risk suppliers every one to three years, with more frequent reviews if performance drops. The right frequency depends on your risk assessment.
Responsibilities for quality activities, specifications, change notification, deviation and complaint handling, audit rights, and record retention, in line with the requirements of your sector.
Affirm8 helps quality and procurement teams across pharmaceuticals, supplements, medical devices and cosmetics risk-rank their supplier base, design supplier audit programmes and turn suppliers into respected partners. Start with the free Always Audit-Ready Diagnostic at affirm8.co.uk.