Services / Vendor qualification

Vendor qualification

Vendor qualification and oversight

Vendor qualification is a file you can hand an inspector: questionnaire, quality agreement, audit or desktop review, CAPAs, certificates, and the last periodic review. CliniGene uses AI to inventory what arrived, map answers to your SOP and Part 11/Annex 11 expectations, and flag contradictions. The qualification decision is always a person.

Contact us about this Email hello@clini-gene.com

The problem this process is built for

Qualification often dies in email. A questionnaire is sent, a PDF comes back, someone files it, and two years later an inspector asks how you know the vendor’s Part 11 controls still match what you accepted. The file has a certificate that expired and a quality agreement that never named audit rights.

High-impact vendors (CRO conducting the trial, lab producing primary endpoints, cloud hosting eTMF) need a different depth than a low-impact translation shop. Without tiers, everything is either a 200-question burden or a rubber stamp.

AI is good at reading long questionnaires, SOC 2 / ISO packs, and last year’s audit report at the same time. It is not allowed to “approve” a vendor.

What this has to survive

An inspector picks a CRO or a cloud eTMF and asks for the qualification decision, the agreement (audit rights, data return), and the last periodic review. That should be one folder, not an email search.

Standards we score against

  • Your vendor qualification / supplier SOP and quality-agreement template
  • ICH-GCP sponsor duties for vendors and subcontractors
  • 21 CFR Part 11 / Annex 11 when the vendor holds GxP electronic records
  • Data-processing and privacy terms you require
  • ISO 9001 / 27001 / SOC 2 as supporting evidence, not a substitute for GxP

Where teams get stuck

  • One questionnaire for every vendor regardless of GxP impact
  • Quality agreement unsigned or silent on CAPA, audit, and data return
  • Desktop review that restates the vendor brochure
  • No periodic review; certificates lapse unnoticed
  • Subcontractors of the CRO never appear in your file

Who it is for

Vendor management, QA, procurement, and clinical operations overseeing CROs, central labs, IRT, EDC, eTMF, safety, and SaaS GxP suppliers.

What AI does — and does not do

On vendor work, AI inventories the pack, maps answers to your SOP and Part 11/Annex 11, and lists contradictions. Your QA procedure names who may approve, condition, or reject. AI drafts maps, flags, first-pass language, and punch lists. A named specialist accepts, edits, or dismisses every official finding. AI does not sign a quality record, approve a vendor, freeze Vault, or speak in an inspection.

Questions on fit? hello@clini-gene.com or the contact form.

When to start this process

Start when a sponsor QA audit will sample vendor files, when a new CRO or eTMF SaaS is being selected, or when certificates and quality agreements have drifted for two years.

A portfolio cleanup should be phased by inspection date and GxP impact — not one 200-question blast to every translator and every CRO.

What this is not

  • Approving a vendor in your QMS
  • Ghost-writing the vendor’s questionnaire answers
  • Treating ISO/SOC 2 as a substitute for GxP intended use
  • Legal advice on the quality agreement (we redline GxP clauses; counsel still reads it)
AI in this process

How the model is used, layer by layer

Each layer has a human gate. AI does not write the official quality record.

Tiering draft

From the service description, AI suggests a GxP impact tier (trial conduct, GxP data processor, GxP computer system, facilities, low impact) and the matching pack: questionnaire depth, audit vs. desktop, review cycle.

Pack inventory

What arrived vs. what the SOP requires for that tier. Missing DPA, missing validation summary, missing org chart for the quality unit — listed before anyone writes a report.

Control mapping

Each questionnaire answer and certificate claim is mapped to your SOP and to Part 11/Annex 11 / data-integrity expectations. Vague answers (“we are secure”) are quoted so QA can send a precise follow-up.

Contradiction check

SOC 2 says one hosting region; the questionnaire says another. Last audit CAPA still open; the new questionnaire says no open CAPAs. AI lists the pair; the reviewer asks.

Audit agenda or desktop-report draft

High-tier: agenda built from the gaps. Desktop: report body drafted. Findings and classification are written by the auditor / QA.

Oversight plan

KPIs, review cadence, and what triggers for-cause review. Periodic review re-reads new certs and tickets against last year’s file.

Want this process walked on your trial or system?

Send the study, Vault, vendor, or inspection window. We will say what we need and what a first pass looks like.

hello@clini-gene.com

Contact form Email the team
End-to-end process

Step-by-step: from intake to re-check

  1. 1

    List vendors and services

    What they do on this trial or in this QMS, including known subcontractors.

  2. 2

    Assign a tier

    Workshop using your SOP. AI may suggest; you lock the tier so the rest of the file is consistent.

  3. 3

    Request the pack

    Questionnaire, QA draft, DPA, validation/assurance summary, certs, org/quality contacts.

  4. 4

    Inventory and map

    AI gap list + control map. QA sends one consolidated query list, not a week of scattered emails.

  5. 5

    Review or audit

    Desktop or on-site/remote audit. We prepare; your qualified auditor (or ours if engaged as such) issues findings.

  6. 6

    Quality agreement

    Redline roles, deviations, CAPA, audit rights, data return, subcontracting notice. Legal and QA both see it.

  7. 7

    Qualification decision

    Approve, conditional (with dated conditions), or reject. Conditions become tracked CAPAs in your system.

  8. 8

    Oversight and periodic review

    KPI pack and a calendar. On review, AI diffs new evidence; you decide whether the tier or approval still holds.

What a typical engagement looks like

Setting. Typical: 15–40 GxP vendors on a late-phase program, mix of CRO, lab, IRT, eTMF SaaS; files incomplete before a sponsor QA audit.

What we do. Tier the list, rebuild packs, AI-map questionnaires, issue query lists, draft two desktop reports and one audit agenda, redline three quality agreements, set a 12-month review clock.

What you can show. An inspector can pick a vendor and see tier, decision, agreement, last review, and open conditions — in one folder.

Time

A focused high-tier vendor (new CRO or eTMF) is often 3–8 weeks including queries. A portfolio cleanup is phased by inspection date and risk.

How a typical calendar runs

  1. Week 0. Vendor list, services, known subcontractors, your qualification SOP, who may approve.
  2. Week 1. Tiering workshop. Pack request list per tier.
  3. Week 2–3. Inventory vs. SOP. Control map. One consolidated query list.
  4. Week 3–6. Desktop reports and/or audit agenda. Quality-agreement redline. Conditions become dated CAPAs.
  5. Week 6+. Qualification file index. Oversight KPIs. Periodic-review clock. Re-diff on the next certs.

What we need from you

  • Vendor list with services and known subcontractors
  • Vendor qualification SOP and QA template
  • Existing questionnaires, certs, and old audit reports
  • Who may approve a vendor in your QMS

You receive

  • Tiered vendor inventory and pack gap list
  • Control map and consolidated query list
  • Desktop-review or audit-report draft
  • Quality-agreement redline and oversight KPI plan
  • Qualification file index ready for inspection

Questions we hear first

Do you approve vendors for us?
No. We prepare the file and the recommendation. Your QA procedure names the approver.
ISO certificate — is that enough?
It is supporting evidence. GxP intended use, Part 11, and your SOP still have to be answered.
Can AI fill the questionnaire for the vendor?
We do not ghost-write a vendor’s answers. We critique what they sent.
How do you treat CRO subcontractors?
They belong on the list. If your SOP says the CRO qualifies them, we still want evidence of that qualification in your file — and a notice clause in the quality agreement.
Desktop review or on-site audit?
Tier plus your SOP. High GxP impact (trial conduct, primary endpoint lab, GxP records host) usually needs more than a brochure restatement. We will recommend, not decide.
What is a conditional approval?
Approve with dated conditions (missing DPA, open vendor CAPA, unsigned agreement). Conditions are tracked. Expired conditions are a finding.

Start with Vendor qualification and oversight

Email hello@clini-gene.com or use the form. Mention Vendor qualification and oversight so we route it correctly.

hello@clini-gene.com

Contact form Email the team

Talk with us about Vendor qualification and oversight

Email hello@clini-gene.com or send this form. The process is already selected.

Tell us the trial, Vault, vendor, or inspection date and what “done” looks like.

Send a message

Email hello@clini-gene.com if you prefer not to use the form.

See Privacy. We reply with how we can help and what we need next.

Other services

Veeva managed services

Run Vault after go-live: administration, releases, change control, and delta validation — with AI watching drift and tickets, and your system owner still approving production changes.

Learn more →

CSV and CSA

Apply GAMP 5 and FDA computer software assurance so testing follows patient-safety and data-integrity risk — not a copy-paste IQ/OQ/PQ for every screen.

Learn more →

eTMF quality review

Reconcile the electronic TMF to the TMF plan and milestones — completeness, QC, and inspectability — with AI pre-checks and TMF specialists issuing the official metric.

Learn more →