A vendor qualification process is the set of checks a lab or research institution runs on a supplier before that supplier is allowed to bid on or fulfill a purchase order — verifying its quality system, regulatory standing, and capacity to reliably meet requirements. This is a distinct step from vendor selection, which is the downstream decision of choosing among vendors that have already cleared qualification. A lab that skips qualification and jumps straight to comparing quotes is choosing among unvetted bidders, not qualified ones — the two processes solve different problems and belong in different places in a procurement workflow.
This guide covers the qualification process itself: what it verifies, how to tier vendors by risk, what documentation to collect, how to structure an audit or assessment, and how often to requalify. It’s written for lab managers, research administrators, and quality/procurement staff responsible for building or running an approved-vendor program in a research, clinical, or medical-lab setting.
Vendor qualification vs. vendor selection vs. vendor management
These three terms get used interchangeably in casual conversation but describe sequential, distinct activities:
- Vendor qualification — a one-time (then periodically repeated) gate that determines whether a vendor is even eligible to be considered: does it hold the right certifications, can it demonstrate a functioning quality system, is it financially stable enough to be a dependable supply source. A vendor either passes qualification and enters the approved-vendor pool, or it doesn’t.
- Vendor selection — choosing among already-qualified vendors for a specific purchase, based on price, lead time, service level, or other competitive factors. Selection happens after qualification, among a pool that’s already cleared the gate.
- Vendor management — the ongoing relationship once a vendor is engaged: performance monitoring, issue escalation, contract renewal, and (in regulated environments) periodic requalification. See CASRAI’s clinical trial vendor management guide for how this plays out specifically for CROs, CTMS, and eClinical vendors in trial settings — a related but separate discipline from general lab supply-chain qualification.
The distinction matters most in regulated environments, where a purchasing decision that skips formal qualification — even if the vendor turns out to be reliable — is itself a documented quality-system gap, independent of whether anything actually went wrong with the product or service purchased.
Why vendor qualification is a regulatory requirement, not just good practice
For labs operating under a formal quality management system, vendor qualification isn’t optional best practice — it’s a named clause in the standard or regulation the lab is already required to follow:
- ISO 9001:2015, Clause 8.4 (Control of externally provided processes, products and services) requires the organization to determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers, based on their ability to supply processes, products, or services in accordance with requirements.
- ISO 13485:2016, Clause 7.4 (Purchasing) — the medical-device quality standard now incorporated by reference into FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, replacing most of the legacy 21 CFR Part 820 purchasing-controls language — requires documented purchasing processes, defined purchasing information, and verification that purchased product meets specified requirements, with the rigor scaled to the effect of the purchased product on the final device or downstream result. See CASRAI’s ISO 13485 guide for how this standard’s structure differs from ISO 9001.
- ISO/IEC 17025:2017, Clause 6 (Resource requirements) requires accredited testing and calibration laboratories to control externally provided products and services — reagents, consumables, calibration services, and subcontracted testing — because they can affect the validity of reported results. See CASRAI’s ISO/IEC 17025 guide.
- GxP frameworks (GMP, GLP, GCP) generally require an approved-supplier or approved-vendor list as part of the underlying quality system, with qualification evidence retained as part of the audit trail. See CASRAI’s GxP compliance guide for how GLP/GCP/GMP differ in scope.
- CLIA-certified labs are expected to control the reagents, calibrators, and materials that affect test performance as part of the lab’s quality system, even though CLIA (42 CFR Part 493) doesn’t prescribe a specific vendor-qualification procedure the way a device or pharma regulation does. See CASRAI’s CLIA certification guide for what CLIA’s quality-system expectations do and don’t cover.
Labs purchasing on federal awards have a separate, overlapping obligation: 2 CFR 200’s procurement standards (§§200.317–200.327) govern how the purchase itself must be competed and documented, which is a distinct question from whether the vendor was quality-qualified. See CASRAI’s 2 CFR 200 procurement standards guide if the purchase is federally funded — and CASRAI’s subrecipient vs. contractor vs. vendor comparison if it’s unclear which category a given relationship actually falls into, since the answer changes which rules apply.
The vendor qualification process: six steps
1. Define qualification criteria and risk tier
Before contacting any vendor, decide what “qualified” means for the category of purchase — and how much scrutiny it warrants. A vendor supplying a critical reagent that goes directly into a reportable result needs deeper qualification than one supplying general lab consumables. Write the criteria down before evaluating anyone against them; retrofitting criteria to justify a vendor you’ve already started using is a common audit finding.
2. Request and collect qualification documentation
Typical documentation requested at this stage: a copy of the vendor’s quality certification (ISO 9001, ISO 13485, ISO/IEC 17025 accreditation scope, or GMP certificate, as applicable), relevant regulatory registrations (e.g., FDA establishment registration, CLIA certificate for a reference lab), proof of insurance, financial-stability evidence for high-spend or sole-source relationships, and references from comparable customers.
3. Review the documentation (desktop assessment)
A quality or procurement reviewer checks the submitted documentation against the criteria from step 1: certificates current and in scope, registrations active, no unresolved regulatory actions (e.g., an FDA warning letter or import alert against the vendor). This step alone is sufficient qualification for low-risk, non-critical vendors.
4. Assess higher-risk vendors directly
For vendors supplying critical materials, custom services, or anything feeding directly into a regulated or reportable result, a desktop review usually isn’t enough. This step can mean a questionnaire-based self-assessment, a virtual audit, an on-site audit, or evaluation of a pilot/sample lot before committing to a full order — the method should be proportionate to the risk tier assigned in step 1, not applied uniformly to every vendor regardless of criticality.
5. Approve and add to the qualified/approved vendor list
A vendor that clears qualification is added to the lab’s Approved Vendor List (AVL) or Qualified Supplier List, with the qualification file (documentation collected, assessment results, approval signature, and date) retained as the audit record. This list — not an ad hoc purchasing decision — is what selection (choosing among vendors for a specific order) should draw from going forward.
6. Monitor and requalify on a defined schedule
Qualification isn’t permanent. Ongoing monitoring (receiving inspection results, complaint trends, certificate expiration tracking) feeds into a periodic requalification cycle — commonly annual for critical vendors, longer for low-risk ones — and any material change (a vendor losing its accreditation, changing manufacturing site, or acquiring a subcontractor) should trigger an off-cycle review rather than waiting for the next scheduled date.
Risk-based tiering: not every vendor needs the same scrutiny
Applying full audit-level qualification to every vendor — down to the office-supplies account — is the most common reason vendor qualification programs collapse under their own weight and stop getting followed. A workable program tiers vendors, typically along lines like:
- Critical — supplies reagents, materials, calibration, or contracted testing that directly affects a reportable result, patient safety, or product quality. Full documentation review plus a direct assessment (audit, questionnaire, or sample-lot evaluation), annual requalification.
- Moderate — supplies equipment, service contracts, or materials with an indirect but real quality impact. Documentation review, requalification on a longer cycle (e.g., every two to three years).
- Low/non-critical — general consumables, office supplies, non-technical services with no plausible link to result quality or safety. Basic documentation check at onboarding, no formal requalification cycle required.
What to include in a vendor qualification file
A complete qualification file — the record an auditor would ask to see — typically contains:
- Vendor name, address, and scope of products/services covered by the qualification
- Risk tier assigned and the rationale for that tier
- Current quality certification(s) or accreditation scope (ISO 9001, ISO 13485, ISO/IEC 17025, GMP certificate) with expiration dates
- Applicable regulatory registrations (FDA establishment registration, CLIA certificate, state licensure, as relevant)
- Insurance certificate(s)
- Assessment method used (desktop review, questionnaire, audit, sample-lot evaluation) and the outcome
- Approval signature and date
- Requalification schedule and next-due date
- Record of any subsequent complaints, nonconformances, or corrective actions tied to that vendor — see CASRAI’s CAPA (Corrective and Preventive Action) definition for how these should be tracked and closed
Vendor qualification checklist
The items below are commonly built into a spreadsheet or fillable PDF for a qualification program — use this list as the content to populate whichever format your institution standardizes on, adjusted to your own risk-tier definitions:
- Vendor legal name, address, and primary contact confirmed
- Products/services in scope of this qualification clearly defined
- Risk tier assigned (critical / moderate / low) with rationale documented
- Current quality certificate or accreditation scope obtained and verified as active
- Applicable regulatory registration(s) confirmed active, no unresolved regulatory actions
- Insurance certificate on file and current
- Financial-stability check completed (for high-spend or sole-source vendors)
- References checked (for new or high-risk vendors)
- Sample/pilot lot evaluated, if applicable to the product category
- Assessment method selected and completed (desktop review vs. audit vs. questionnaire)
- Qualification approved, signed, and dated by the responsible role
- Vendor added to the approved/qualified vendor list
- Requalification date set and tracked
- Subcontractor/sub-tier supplier disclosure obtained, if the vendor uses one
Common pitfalls
- Treating qualification as a one-time event. A vendor qualified three years ago with an expired certificate is not a qualified vendor — it’s a documentation gap waiting to be found in an audit.
- No documented risk tiering. Auditors specifically look for evidence that the depth of qualification was a deliberate decision, not applied uniformly (or arbitrarily) across every vendor.
- Confusing vendor qualification with the purchase-competition requirements under 2 CFR 200 for federally funded purchases. These are separate obligations that both need to be satisfied — qualifying a vendor doesn’t exempt a federally funded purchase from competitive-bidding requirements, and competing a purchase doesn’t substitute for quality qualification.
- Letting selection happen before qualification. If a vendor is already being used before its qualification file is complete, the qualification becomes retroactive paperwork rather than a real gate — and reads that way to an auditor.
Frequently asked questions
What’s the difference between vendor qualification and vendor selection?
Qualification determines whether a vendor is eligible to be considered at all — verifying its quality system, certifications, and regulatory standing. Selection is the subsequent decision of which already-qualified vendor to use for a specific purchase, typically based on price, lead time, or service factors.
Is vendor qualification required by ISO 9001?
Yes. ISO 9001:2015 Clause 8.4 requires organizations to define and apply criteria for evaluating, selecting, monitoring, and re-evaluating external providers whose processes, products, or services affect conformity of the organization’s own output.
How often should vendors be requalified?
There’s no single fixed interval mandated across standards — the schedule should be risk-based. Critical vendors (those supplying materials or services that directly affect a reportable result or product quality) are commonly requalified annually; lower-risk vendors on a longer cycle. Any material change at the vendor (lost accreditation, changed manufacturing site, ownership change) should trigger an off-cycle requalification regardless of schedule.
What documents does a lab need to qualify a vendor?
At minimum: current quality certification or accreditation scope, applicable regulatory registrations, proof of insurance, and (for critical or high-spend vendors) financial-stability evidence and references. See the qualification-file checklist above for the full list an auditor would expect to see.
Does CLIA require a formal vendor qualification procedure?
CLIA (42 CFR Part 493) doesn’t prescribe a specific vendor-qualification procedure the way a device or pharmaceutical GMP regulation does, but its quality-system expectations require CLIA-certified labs to control reagents, calibrators, and materials that affect test performance — which in practice means labs need some documented basis for trusting their suppliers, even without a named “vendor qualification” clause. See CASRAI’s CLIA certification guide for the full scope of what CLIA does and doesn’t specify.
