The Complete Documentation Checklist: What Pharma Companies Require from Chemical Suppliers
- 8 hours ago
- 11 min read
Key Takeaways
Documentation is the primary defense against supply chain contamination: The heparin, melamine, and nitrosamine crises have transformed supplier documentation from administrative burden into patient safety imperative—regulatory agencies now scrutinize raw material controls with unprecedented intensity.
Risk-based classification determines documentation depth: APIs and primary excipients require full qualification packages including on-site audits, DMF/ASMF references, and complete analytical verification; non-GMP process aids may qualify through questionnaire and certificate review alone.
Certificate of Analysis (CoA) integrity is non-negotiable: FDA warning letters increasingly cite over-reliance on supplier CoAs without independent verification; identity testing of every lot is now expected even from qualified suppliers.
Regulatory filings create documentation dependencies: Type II DMFs (US), ASMFs (EU), and CEPs (EDQM) are confidential documents that pharmaceutical companies must reference through Letters of Access—without them, drug applications cannot proceed.
Modern compliance extends beyond traditional quality: REACH, CITES, Nagoya Protocol, nitrosamine risk assessments, elemental impurity data, and GMO declarations are now standard documentation requirements for chemical suppliers to the pharmaceutical industry.
Change control and traceability are continuous obligations: Suppliers must notify pharmaceutical customers of any process, specification, or facility changes before implementation; batch traceability records must be maintained for at least one year after expiry or three years after complete distribution.
Introduction
If you are a chemical supplier seeking to serve the pharmaceutical industry, or a procurement manager evaluating chemical suppliers for drug manufacturing, the documentation requirements are extensive, specific, and non-negotiable. Here is the direct answer: pharmaceutical companies require a structured documentation package that proves your chemical product is manufactured under GMP-equivalent controls, characterized by validated analytical methods, traceable to its source, and free from contaminants that could compromise patient safety.
This is not a matter of checking boxes. Regulatory agencies—FDA, EMA, WHO, and national authorities—hold pharmaceutical manufacturers legally responsible for the quality of every raw material they use. That responsibility flows backward through the supply chain to you, the chemical supplier. The documentation you provide is not merely proof of quality; it is the evidentiary foundation upon which drug approvals, batch releases, and ultimately patient safety depend.
This article maps every document category that pharmaceutical companies require from chemical suppliers, organized by material risk classification, regulatory region, and operational phase—from initial qualification through ongoing supply.
1. Foundational Regulatory Framework: Why Documentation Matters
1.1 The Legal Basis for Supplier Documentation
Pharmaceutical manufacturers take on full legal responsibility for the quality of raw materials used in cGMP processes. This is codified across multiple regulatory frameworks:
EU Directive 2001/83/EC, Article 8: Marketing authorization applications must include written confirmation that the manufacturer has verified API supplier compliance with GMP principles through audits.
EU Directive 2001/83/EC, Article 46: Manufacturing authorization holders must use only active substances manufactured in accordance with GMP and distributed in accordance with GDP; excipients must be "suitable for use in medicinal products by ascertaining what the appropriate GMP is."
EU Directive 2001/83/EC, Article 46b: Active substances may only be imported if manufactured under GMP standards at least equivalent to EU GMP, demonstrated through written confirmation or inclusion on the EU "white list."
FDA Q7A GMP Guidance for APIs: Mandates that materials be purchased against agreed specifications from suppliers approved by the quality unit; complete analyses must be conducted on at least three batches before reducing in-house testing.
ICH Q7: Provides the comprehensive GMP framework for API manufacturing, including documentation, materials management, and laboratory controls that suppliers must demonstrate.
The historical driver for these requirements is patient safety. The accidental use of ethylene glycol instead of propylene glycol resulted in morbidity and mortality. The 2008 heparin contamination crisis—adulterated API sourced from China—killed 81 people in the US alone. These events transformed supplier documentation from good practice into regulatory mandate.
1.2 Risk-Based Material Classification
Documentation requirements scale with material criticality. Pharmaceutical companies classify chemical suppliers into risk tiers:
Risk Level | Material Examples | Documentation Depth |
Critical (High-Risk) | APIs, sterile components, primary packaging, key excipients | Full qualification package: DMF/ASMF/CEP, on-site audit, complete CoA verification, three-batch full testing, quality agreement |
Major (Medium-Risk) | Standard excipients, secondary packaging, analytical services | Document review plus additional controls: questionnaire, GMP certificate, sample testing, periodic audit |
Minor (Low-Risk) | Office supplies, non-GMP utilities, general chemicals | Basic supplier approval: business license, questionnaire, specification confirmation |
2. Core Documentation Required from All Chemical Suppliers
2.1 Certificate of Analysis (CoA)
The CoA is the most frequently requested and scrutinized document. Regulatory expectations are precise:
Mandatory CoA elements:
Material name exactly matching the approved specification (official pharmacopeial name, not trade names)
Clear pharmacopeial reference (USP-NF, Ph. Eur., BP, JP, IP)
Statement of compliance (e.g., "Complies with USP-NF")
Batch number and date of manufacture/release
Complete test results with numerical values (not just "pass/fail")
Acceptance limits for each test
Authorized signature from quality unit personnel
Name, address, and telephone number of original manufacturer
For repackers/reprocessors: their identification plus reference to original manufacturer
Expiry date or retest date
Critical compliance note: The CoA must be issued by the original manufacturer's quality unit. It is unacceptable for brokers or agents to transcribe manufacturer CoA results onto their own letterhead.
FDA warning letter trend: Recent enforcement actions highlight over-reliance on supplier CoAs without independent verification. Even for qualified suppliers, identity testing of every lot is now expected. For high-risk materials such as glycerin and polyethylene glycols (PEGs), verification testing beyond the CoA is explicitly required.
2.2 Certificate of Conformance (CoC) / Certificate of Compliance
While CoA confirms analytical test results, CoC confirms broader compliance:
Manufacturing performed under GMP or GMP-equivalent quality system
Compliance with applicable pharmacopeial monographs
Absence of specific contaminants (e.g., BSE/TSE, melamine, nitrosamines)
Adherence to agreed specifications and quality agreements
Change control notification commitments
2.3 Safety Data Sheet (SDS) / Material Safety Data Sheet (MSDS)
Required under REACH, OSHA Hazard Communication Standard, and global chemical safety regulations:
Chemical identification (CAS number, synonyms)
Hazard classification and pictograms
Composition/information on ingredients
First-aid measures
Firefighting measures
Accidental release measures
Handling and storage conditions
Exposure controls/personal protection
Physical and chemical properties
Stability and reactivity
Toxicological information
Ecological information
Disposal considerations
Transport information
Regulatory information
2.4 Manufacturing License and GMP Certificates
For API suppliers:
Valid manufacturing license from national regulatory authority
Current GMP certificate (FDA establishment registration, EU GMP certificate, PMDA accreditation, NMPA license)
Scope of GMP certification must cover the specific chemical being supplied
Recent regulatory inspection history (no outstanding FDA 483 observations, no warning letters)
For excipient suppliers:
IPEC-PQG GMP Guide compliance documentation
ISO 9001 certification (minimum)
GMP inspection reports by competent authorities, if available
General GMP statements
2.5 Drug Master File (DMF) / Active Substance Master File (ASMF) / Certificate of Suitability (CEP)
These are confidential regulatory filings that pharmaceutical companies must reference in their drug applications:
Table
Document | Region | Purpose | Access Mechanism |
Type II DMF | US (FDA) | API manufacturing process, specifications, impurity profiles, stability | Letter of Access (LoA) from DMF holder |
ASMF | EU (EMA) | API quality data for MA applications | Letter of Access |
CEP/COS | Europe (EDQM) | Certificate proving API suitability for Ph. Eur. monograph | Public certificate; no LoA needed for certificate itself |
MF | Japan (PMDA) | API registration in Japan | Letter of Access |
Verification checklist for pharmaceutical buyers:
DMF/ASMF number and active status
Has the DMF been referenced in an approved ANDA or NDA? (Proves regulatory review)
Date of last amendment (stale files raise questions about process currency)
Any FDA deficiency letters or complete response letters?
Multi-market coverage (DMF + ASMF + CEP indicates serious regulatory commitment)
3. Supplier Qualification Documentation Package
3.1 Supplier Qualification Questionnaire
A standardized questionnaire assessing the supplier's quality management system. Key areas include:
Corporate structure and ownership
Manufacturing site details (size, history, employees, shift operations)
Site activities (blending, packaging, testing, R&D)
Primary applications of products (pharmaceutical, food, cosmetic)
Production of antibiotics, steroids, or hormones (cross-contamination risk)
Organizational chart with quality unit independence
Subcontractor control
Customer audit policy
3.2 Site Quality Overview (SQO)
Based on IPEC-PQG GMP Guide, the SQO communicates:
Section 1: Site Overview
Scope, site name, address, excipients covered
Corporate ownership
General site information, activities, primary applications
Organizational chart with product release responsibility
Subcontractor use and control
Section 2: Compliance Evidence
ISO registration certificates (9001, 14001, 45001)
GMP inspection outcomes by regulatory agencies
General GMP statements
Other certifications (AIB, BRC, FSSC 22000)
Section 3: IPEC-PQG GMP Compliance Details
Quality management system elements
Management responsibility
Resource management
Product realization
Measurement, analysis, and improvement
Section 4: Miscellaneous
Risk management plans (HACCP)
Statistical process control / PAT
Section 5: Revisions
Version control and change history
3.3 Site and Supply Chain Security Overview
Documents the supplier's plans to ensure product protection and supply continuity:
Carrier evaluation and qualification
Tamper-evident packaging and seals
Environmental controls during transport
Distributor and forwarder qualification
Intermediate storage location controls
Repacking/relabeling activities under GDP
FDA BioTerrorism Act registration (if applicable)
C-TPAT or AEO participation
Business continuity plan for disaster/pandemic scenarios
3.4 Financial Stability Documentation
Audited financial statements
Credit references
Insurance certificates
Bankruptcy checks
Rationale: Financially unstable suppliers become your problem when they cannot maintain operations, fulfill orders, or respond to quality issues.
4. Product-Specific Quality and Safety Documentation
4.1 Pharmacopeial Grade Compliance
When a pharmacopeial monograph exists (USP-NF, Ph. Eur., BP, JP, IP):
Official monograph title used as primary material name
Grade and compendial reference clearly stated
Compliance with all monograph tests and limits
Most stringent requirement applied when multiple pharmacopeias apply
For non-pharmacopeial materials:
In-house specification with justification
Clear "Non-pharmacopeial" statement
Quality attributes based on intended use and risk
Traceability and control equivalent to pharmacopeial materials
4.2 Impurity and Contamination Control Documentation
Nitrosamine Risk Assessment (mandatory post-2019):
Formal risk assessment identifying amine/nitrosating agent presence
Analytical results confirming absence or control of nitrosamine impurities
Information on potential nitrosating conditions in synthesis routes
Change control commitments to prevent unannounced process changes
Elemental Impurities (ICH Q3D):
Elemental impurity data for Class 1 (As, Cd, Hg, Pb), Class 2A/2B, and Class 3 metals
Validated analytical methods (ICP-MS)
Declaration of compliance to expected limits or risk-assessment-based justification
Consistency of impurity profiles across batches
Residual Solvents (ICH Q3C):
Disclosure of all solvents used in manufacturing
Testing results against ICH Q3C limits
Risk-based justification for any solvent exceedances
Melamine Control (for high-risk materials):
Supplier declaration confirming absence of melamine
Risk assessment based on material type, origin, and supply chain
Testing where risk is identified (HPLC/LC-MS)
Inclusion in specifications or periodic monitoring
4.3 Biological Safety Documentation
TSE/BSE Status (for animal-derived materials):
Identification of all animal-derived materials
Traceability to species, tissue, and country of origin
Supplier TSE/BSE declarations
Compliance with EMA/410/01 and WHO TSE guidelines
Preference for vegetable or synthetic alternatives documented
Viral Safety (for biologics raw materials):
Raw material risk classification (human, animal, microbial origin)
Viral safety evaluation per ICH Q5A
Viral clearance validation data
Testing or certification for absence of adventitious agents
GMO Status (for biological/plant-derived materials):
Supplier declaration of GMO or non-GMO status
Traceability to source organism and production method
Compliance with EU GMO Regulations (EC 1829/2003, 1830/2003)
4.4 Allergen and Sensitization Declarations
Presence or absence of major allergens (gluten, lactose, soy, nuts, sesame, shellfish, eggs)
Potential for cross-contamination during manufacturing
Measures taken to prevent allergen carryover
INCI naming for cosmetic-pharmaceutical hybrid products
4.5 Sterilization and Processing Statements
Ethylene Oxide (EO/EtO) Statement:
Declaration whether EO is used during sterilization or processing
Validated analytical data confirming residual levels meet pharmacopeial limits
Adherence to ISO 11135 for EO sterilization
Periodic requalification data and change-notification commitments
Titanium Dioxide (TiO₂) Declaration:
Presence or absence of TiO₂
Detailed specifications (particle size distribution, grade, coating status)
Compliance with pharmacopeial monographs
Safety data supporting intended use
5. Environmental, Ethical, and Trade Compliance Documentation
5.1 REACH Compliance (EU)
Substance registration confirmation
Declaration of absence of restricted or banned substances
SVHC (Substances of Very High Concern) declaration if present above 0.1% w/w
SDS meeting REACH requirements
5.2 CITES Compliance
For botanical, animal, marine, or traditional medicine raw materials:
Confirmation that materials do not originate from CITES-listed species
Legally required CITES permits if species is regulated
Traceability of biological sourcing
5.3 Nagoya Protocol Compliance
For genetic or biological resources:
Confirmation of lawful sourcing from country of origin
Prior informed consent (PIC) and mutually agreed terms (MAT) documentation
Benefit-sharing obligations respected
6. Contractual and Ongoing Documentation
6.1 Quality Agreement
A formal contract between pharmaceutical company and supplier defining:
Mode of transport and delivery
Roles and responsibilities
GMP requirements applicable to the material
Technical requirements and specifications
Product and service quality monitoring
Rejection, deviation, and complaint handling
Change control notification procedures
Audit rights and frequency
Regulatory inspection cooperation
6.2 Change Control and Notification Commitments
Suppliers must notify the pharmaceutical customer before implementing any change that could affect:
Manufacturing process or synthesis route
Specifications or test methods
Manufacturing site or facility
Equipment critical to quality
Supplier of critical raw materials
Packaging or labeling
Stability profile
The notification period is typically 6-12 months for critical changes, enabling pharmaceutical companies to assess impact, perform requalification, and update regulatory filings.
6.3 Batch Records and Traceability
For each batch supplied, the following must be maintained and available upon request:
Complete batch manufacturing records
Raw material inputs with batch numbers and quantities
In-process control results
Laboratory control results
Deviation and investigation records
Final release decision by quality unit
Retention periods: At least 1 year after expiry date of the batch, or 3 years after complete distribution for APIs with retest dates.
6.4 Periodic Requalification Documentation
Supplier qualification is not a one-time event. Pharmaceutical companies require:
Requalification at defined intervals (time-based)
Requalification triggered by events (facility relocation, process changes, quality failures)
Requalification triggered by performance degradation (specification failures, repeated deviations)
Updated audit reports
Current GMP certificates
Refreshed CoA trending data
7. Documentation by Material Category
7.1 Active Pharmaceutical Ingredients (APIs)
Document | Purpose | Regulatory Basis |
Type II DMF (US) | Confidential manufacturing data | FDA 21 CFR 314.420 |
ASMF (EU) | API quality data for MA | EMA QWP/185401/2006 |
CEP/COS (EDQM) | Ph. Eur. suitability certificate | EDQM procedure |
GMP Certificate | Proof of GMP compliance | EU Directive 2001/83/EC, Art. 46b |
Written Confirmation | Export to EU from non-EU country | EU Directive 2001/83/EC, Art. 46b |
CoA per batch | Quality verification | ICH Q7, Section 11.4 |
Impurity Profile | Characterization of known/unknown impurities | ICH Q3A/Q3B |
Stability Data | Shelf-life/retest date justification | ICH Q1A |
Process Validation | Consistent manufacturing capability | ICH Q7, Section 12 |
Analytical Method Validation | Reliable testing procedures | ICH Q2(R1) |
7.2 Excipients
Document | Purpose | Regulatory Basis |
IPEC-PQG GMP Compliance | Excipient-specific GMP | IPEC-PQG GMP Guide 2006/2017 |
Excipient Information Package (EIP) | Standardized qualification data | IPEC Europe |
Site Quality Overview | Manufacturing site assessment | IPEC-PQG |
Site and Supply Chain Security Overview | Product protection and continuity | IPEC-PQG |
CoA per batch | Quality verification | IPEC GDP Guide |
Pharmacopeial Compliance | USP-NF, Ph. Eur., JP monograph adherence | USP-NF, Ph. Eur. |
Nitrosamine Risk Assessment | Carcinogenic impurity control | EMA/520845/2020 |
Elemental Impurity Data | ICH Q3D compliance | ICH Q3D |
TSE/BSE Declaration | Prion disease risk mitigation | EMA/410/01 |
7.3 Raw Materials and Intermediates
Document | Purpose | Regulatory Basis |
CoA with full test results | Quality verification | ICH Q7, Section 7.3 |
Manufacturing process description | Process understanding | ICH Q7, Section 6.4 |
Specification sheet | Agreed quality standards | ICH Q7, Section 7.1 |
SDS/MSDS | Safety information | OSHA, REACH |
Supplier audit report | GMP verification | EU GMP Chapter 5, 5.29 |
Three-batch full testing data | ICH Q7, Section 7.3 |
7.4 Packaging Materials
Document | Purpose | Regulatory Basis |
CoC (Certificate of Conformance) | Compliance with specifications | EU GMP Chapter 5, 5.45 |
Extractables/Leachables Data | Safety of patient contact | USP <1661>, <1663>, <1664> |
Biological Safety Data | Cytotoxicity, sensitization, irritation | ISO 10993 |
DMF Type III (US) | Packaging material registration | FDA 21 CFR 314.420 |
CEP (EU) | Ph. Eur. suitability for packaging | EDQM |
8. Frequently Asked Questions
Q: Can a broker or agent provide the CoA instead of the original manufacturer? A: No. It is unacceptable for brokers or agents to transcribe manufacturer CoA results onto their own letterhead. The CoA must originate from the quality unit of the manufacturing site. Brokers must be qualified separately under GDP guidelines.
Q: What if our chemical does not have a pharmacopeial monograph? A: Use an in-house specification, clearly state "Non-pharmacopeial," justify quality attributes based on intended use and risk, and ensure traceability and control equivalent to pharmacopeial materials. The pharmaceutical customer's quality unit must approve the specification.
Q: How often must supplier documentation be updated? A: GMP certificates and regulatory licenses must be current. DMFs/ASMFs should be amended when processes change. CoAs must be issued per batch. Site Quality Overviews should be revised annually or upon significant change. Requalification audits typically occur every 2-3 years for critical suppliers.
Q: Do we need a DMF for excipients? A: Not typically. DMFs are primarily for APIs (Type II) and packaging materials (Type III). Excipients use the IPEC Excipient Information Package (EIP) or CEP if a Ph. Eur. monograph exists. However, some novel excipients may require Type IV DMFs in the US.
Q: What happens if we change our manufacturing process without notifying customers? A: This is a serious GMP violation. Pharmaceutical companies must assess the impact of supplier changes on their drug products and may need to file regulatory variations. Unannounced changes can result in supplier disqualification, batch rejection, and regulatory enforcement against both supplier and pharmaceutical customer.
Q: Are remote audits acceptable instead of on-site audits? A: Yes, particularly post-pandemic. The FDA has increased remote interactive evaluations. However, on-site audits remain the gold standard for critical suppliers. Third-party certifications may be acceptable for initial assessments.
Conclusion
The documentation required by pharmaceutical companies from chemical suppliers is extensive because the stakes are absolute: patient safety. Every document serves a specific function in a risk management system designed to prevent the contamination, adulteration, and misidentification incidents that have killed patients and destroyed companies.
For chemical suppliers, the message is clear: documentation is not a sales inconvenience—it is your license to operate in the pharmaceutical market. Invest in robust quality systems, maintain current regulatory filings, provide transparent CoAs with full numerical data, and establish rigorous change control procedures. The suppliers who treat documentation as a competitive advantage will win the trust of pharmaceutical procurement teams and the regulatory approvals that follow.
For pharmaceutical procurement and quality professionals, the documentation framework outlined here provides a systematic approach to supplier qualification that aligns with FDA, EMA, ICH, and IPEC expectations. Do not accept incomplete packages. Do not rely solely on supplier CoAs. Verify, audit, trend, and requalify—because the most expensive test is the one you didn't perform until a quality issue emerges downstream.
Comments