This is a ready-to-use risk assessment for assigning a supplier’s qualification tier on a documented, repeatable basis instead of a judgment call made in a meeting. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice.
Document control header
| Field | Entry |
|---|---|
| Document title | Supplier Risk Tier Classification |
| Document number | <<FILL: e.g. RA-QA-041>> |
| Version | <<FILL: e.g. 1.0>> |
| Supplier name and site | <<FILL: supplier, site address>> |
| Material or service assessed | <<FILL: material or service, grade>> |
| Assessed by | <<FILL: name, role>> |
| Assessment date | <<FILL: date>> |
| Next scheduled reassessment | <<FILL: date>> |
1. Purpose
This assessment assigns a risk-based qualification tier to a supplier of GxP materials, components, or services, so the depth of qualification, the audit type, and the monitoring intensity applied are proportionate to the actual risk the supplier represents, and so the tiering decision is defensible against later challenge, whether from an internal reviewer or an inspector.
2. Scope
This assessment applies to a single supplier and a single scope of supply (a named material at a named site, or a named service). A supplier providing more than one material or service, or supplying from more than one site, is assessed separately for each scope, because risk does not transfer automatically from one scope to another at the same organization.
3. Methodology
Score four factors on a 1 to 3 scale, low to high. Sum the four scores for a total between 4 and 12. Map the total to a tier using the band table below, unless the assessor documents a deviation with rationale in section 6.
3.1 Scoring scale
| Factor | Score 1 (low) | Score 2 (medium) | Score 3 (high) |
|---|---|---|---|
| Product and patient impact | Indirect, no patient contact | Affects intermediate quality, not the final dosage form directly | Direct on dosage form, sterile product, cell or gene therapy, or implant |
| Detectability of a defect | Reliably caught by routine incoming testing | Caught by in-process or finished-product testing, not incoming testing alone | Not reliably detectable until use, or requires testing not routinely performed |
| Data integrity impact | No GxP data generated by this supplier | Generates data that supports a quality record | Generates data used directly in batch release or a regulatory submission |
| Supply continuity | Multiple qualified alternative suppliers exist | Few alternatives, moderate requalification lead time | Sole source, or a long requalification lead time with no interim alternative |
3.2 Tier bands
| Total score | Tier | Qualification depth |
|---|---|---|
| 10 to 12 | 1, Critical | Full questionnaire, documentation review, on-site or justified remote audit before approval, quality agreement, active ongoing monitoring |
| 7 to 9 | 2, Major | Questionnaire, documentation review, desk audit or scheduled on-site audit, quality agreement |
| 4 to 6 | 3, General | Basic questionnaire, certificate of compliance or conformance review, periodic performance review |
<<FILL: adjust band boundaries here if your program uses a different scale, and record the rationale>>
4. Assessment
| Factor | Score (1 to 3) | Rationale |
|---|---|---|
| Product and patient impact | <<FILL>> | <<FILL: why this score, tie to the material's role in the process or product>> |
| Detectability of a defect | <<FILL>> | <<FILL>> |
| Data integrity impact | <<FILL>> | <<FILL>> |
| Supply continuity | <<FILL>> | <<FILL>> |
| Total | <<FILL: sum>> | |
| Resulting tier (from band table) | <<FILL: Tier 1, 2, or 3>> |
5. Mitigations for elevated-risk factors
Where a factor scores high and cannot be reduced (for example, a sole-source supplier for a critical material), record the mitigation that compensates for the residual exposure rather than leaving the risk unaddressed.
| Elevated factor | Mitigation | Owner | Target date |
|---|---|---|---|
<<FILL: e.g. supply continuity, sole source>> | <<FILL: e.g. qualify a second source in parallel; hold a defined safety stock; require earlier change notification>> | <<FILL: role>> | <<FILL: date>> |
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
6. Tier override, if applied
Use this section only when the assigned tier deviates from the band table result, for example managing a Tier 2 supplier with a poor performance history as if it were Tier 1.
| Field | Entry |
|---|---|
| Band table result | <<FILL>> |
| Applied tier | <<FILL>> |
| Rationale for override | <<FILL>> |
| Approved by | <<FILL: name, role, date>> |
7. Residual risk and conclusion
After the mitigations in section 5, state the residual risk in plain terms and whether it is acceptable at the assigned tier, or whether it requires an additional control before the supplier can be approved or continue supplying.
<<FILL: residual risk statement and conclusion>>
8. References
ICH Q9, Quality Risk Management. ICH Q10, Pharmaceutical Quality System, management of outsourced activities and purchased materials. 21 CFR 211.84 (components, containers, closures) and 21 CFR 211.68 (automatic, mechanical, and electronic equipment) as applicable to the scope assessed. EudraLex Volume 4, Chapter 5 (evaluation and approval of suppliers).
Confirm the current version and clause numbers of each reference before issue.
9. Approval
| Role | Name | Signature | Date |
|---|---|---|---|
| Assessor | <<FILL>> | ||
| QA reviewer | <<FILL>> | ||
| QA approver | <<FILL>> |
Filled specimen
A worked assessment for a sterile fill-finish contract manufacturer.
| Field | Entry |
|---|---|
| Supplier name and site | Meridian Sterile Manufacturing, Site 2 (illustrative name) |
| Material or service assessed | Aseptic fill-finish, single-use vial presentation |
| Assessed by | J. Okafor, Supplier Quality Lead |
| Assessment date | 2026-08-14 |
| Factor | Score | Rationale |
|---|---|---|
| Product and patient impact | 3 | Direct sterile dosage form, patient-administered |
| Detectability of a defect | 3 | A sterility or contamination defect is not reliably detectable until use |
| Data integrity impact | 3 | Generates the environmental monitoring and batch release data supporting disposition |
| Supply continuity | 2 | One alternate qualified site exists but at 40 percent higher unit cost and a 9-month requalification lead time |
| Total | 11 | |
| Resulting tier | Tier 1, Critical |
Mitigation recorded for supply continuity: the alternate site remains on the AVL in conditional status with a standing agreement to accept limited volume on short notice, reviewed annually so it stays usable rather than qualified in name only.
Residual risk conclusion: at Tier 1 with full qualification depth, active environmental and CoA trend monitoring, and a viable (if costlier) alternate site, residual risk is judged acceptable for continued supply. Reassess at the next scheduled interval or sooner if any event-based trigger fires.
Common inspection findings this assessment prevents
- A supplier’s tier assignment exists nowhere in writing, or reads as an opinion with no scoring behind it.
- Two assessors score the same type of supplier differently with no rubric to reconcile the difference.
- A high-risk factor (sole source, direct patient contact) is known informally but never drives an actual mitigation.
- A tier override is applied without a documented rationale or an approval record.
How to adapt this assessment
- Set your document number, scope, and dates in the header.
- If your program already has a quality risk management scoring convention, align the 1 to 3 scale and band boundaries to it rather than running two parallel systems.
- Link this assessment’s conclusion to the AVL entry and to the qualification level table in your supplier qualification SOP so the tier drives an actual, defined set of activities.
- Re-run this assessment, not just a performance review, whenever a major change in scope, site, or risk profile occurs.