This is a ready-to-use approved supplier list (ASL) for GxP software suppliers, the single reference procurement and project teams check before purchase or go-live to confirm a supplier and the specific product version are actually qualified. It is the operational record that section 6 of the supplier assessment SOP requires be kept current. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows. This is general guidance to adapt to your own supplier assessment program and verify, not legal or regulatory advice.
Instructions
Add or update a row on completion of every supplier assessment report. A supplier and product combination is not “approved” for use until it appears here with a current status. Review the list at each internal audit cycle to confirm no entry has passed its re-assessment date without action.
Field table
| Field | Format | Required | Completed by | When |
|---|---|---|---|---|
| Supplier name | Free text | Yes | Validation / CSV lead | On first assessment |
| Product name | Free text | Yes | Validation / CSV lead | On first assessment |
| Version(s) assessed | Version string(s) | Yes | Validation / CSV lead | On each assessment |
| GAMP category | 1 / 3 / 4 / 5 | Yes | Validation / CSV lead | On first assessment |
| GxP / data-integrity impact tier | Low / Medium / High | Yes | Validation / CSV lead | On each assessment |
| Assessment method used | Questionnaire / documentation review / postal / remote / on-site | Yes | Validation / CSV lead | On each assessment |
| Assessment report reference | <<FILL: report number>> | Yes | Validation / CSV lead | On each assessment |
| CSA reliance level | Full reliance on delivered functions / partial, configured functions re-tested / minimal, high re-test burden | Yes | Validation / CSV lead | On each assessment |
| Status | Approved / Approved with conditions / Not approved / Suspended | Yes | QA | On each assessment |
| Conditions, if any | Free text | Yes if conditional | QA | On each assessment |
| Date approved | Date | Yes | QA | On approval |
| Re-assessment due date | Date, set by risk tier | Yes | QA | On approval |
| Off-cycle trigger events since last assessment | Free text (e.g. major release, security incident, ownership change) | Yes, updated as they occur | Validation / CSV lead | Ongoing |
| Current systems using this supplier/product | List of system names/IDs | Yes | System owners | Ongoing |
Retention
Retain as a living controlled record; superseded versions retained per the records retention schedule for not less than <<FILL: retention period>>.
Filled specimen
The following shows three illustrative rows. Values are illustrative.
| Supplier | Product | Version(s) assessed | GAMP category | Impact tier | Method | Report ref | CSA reliance | Status | Re-assessment due |
|---|---|---|---|---|---|---|---|---|---|
<<FILL: Vendor Alfa>> | LIMS | 8.4.2 | 4 | High | Remote audit | SA-2026-0031 | Partial, configured result calculations re-tested | Approved | 2027-09-01 (1-year, high tier) |
<<FILL: Vendor Bravo>> | Document management (unconfigured, used as delivered) | 12.1 | 3 | Medium | Documentation review + questionnaire | SA-2026-0045 | Full reliance on delivered functions | Approved | 2029-06-15 (3-year, medium tier) |
<<FILL: Vendor Charlie>> | Custom MES integration | 2.0 (bespoke) | 5 | High | On-site audit | SA-2026-0052 | Minimal; supplier tested only generic framework, all site-specific logic re-tested by us | Approved with conditions | 2027-03-10; condition: supplier to provide unit-test evidence for the site-specific module by 2026-12-31 |
Off-cycle trigger log extract for Vendor Alfa: “2026-11-02: vendor announced a major platform release (v9.0) with changes to the result-calculation engine; off-cycle delta assessment scheduled ahead of the standard 2027-09-01 date.”
Common inspection findings this log prevents
- A system in live GxP use whose supplier was never formally added to the approved list.
- An approval that expired years ago with no re-assessment performed and no flag raised.
- A newer software version in production than the version actually assessed, with no record connecting the two.
- No visibility into which live systems depend on a given supplier, so a supplier-level finding cannot be traced to its operational impact.
How to adapt this log
- Populate the initial list from every current supplier assessment report on file; do not start it empty when suppliers are already in use.
- Set re-assessment intervals by risk tier per your supplier assessment SOP, and track them here so a due date is never missed silently.
- Update the off-cycle trigger field whenever a major release, security incident, ownership change, or quality event affects a listed supplier, even between formal re-assessments.
- Require procurement and project teams to check this list, not their own memory or a sales relationship, before committing to a new use of a supplier’s product.