RegOpsPro™

Supplier, Customer & Broker Qualification Guide™

A practical model for classifying counterparties, verifying authority, assessing integrity and capability, making scoped decisions and maintaining oversight.

Open Qualification WorkspaceView Operating Model™
Authority checksSupply-chain integrityScoped approvalRequalification

What this guide is for

Human-medicines suppliers, customers and brokers, with related outsourced-service interfaces. Apply the authority route relevant to the actual activity and jurisdiction. Register results support human review and do not establish a complete qualification decision.

How to use it

Read the judgement behind each stage, challenge your current arrangements and use the workspace to capture evidence, decisions and owned actions. Transfer approved outputs into your authorised system.

The implementation sequence

Work through the eight stages and revisit earlier decisions when the facts change.

1

Classify the entity and regulated relationship

Classify the party by what it actually does in each transaction: buys, sells, negotiates, stores, transports or receives medicines. One company can perform different roles and require separate assessments.

Draw the contractual chain alongside the physical flow, including sites, intermediaries and delivery addresses. A company registration confirms identity information, not medicines authority.

Put it into practice

  • Record legal and trading names with independent identity evidence.
  • Map commercial and physical relationships.
  • Identify mixed roles and assessment boundaries.
  • Refer brokering activity to the specific registration requirements.
Control point
Which qualification route applies to each activity? A carrier treated as the customer.

Working output: An entity scope record defining the party, activities, interfaces and qualification route.

2

Verify authority and authorised activities

Verify identity, current authority and authorised scope using primary registers and documents. Match entity, premises, activities and product categories, then check restrictions, suspension or revocation where applicable.

Different customer categories have different entitlement bases. A registered pharmacy or other authorised recipient should be assessed under its applicable route; do not insist every legitimate customer holds a WDA(H).

Put it into practice

  • Retain dated official evidence and the search identifiers.
  • Check restrictions and scope separately from name matching.
  • Resolve discrepancies through an independent channel.
  • Record uncertainty as unresolved, not a passed check.
Control point
Confirmed, mismatched or unresolved authority? Relying only on an emailed licence image.

Working output: A dated authority-check record with source, result, reviewer and follow-up.

3

Complete proportionate due diligence

Assess whether the party is legitimate and capable of the proposed activity. Review ownership, contacts, quality capability, supply-chain transparency, relevant adverse intelligence and the reasonableness of commercial terms.

Apply proportionate checks to the role and risk. Licence verification, fraud prevention and operational capability are complementary controls; none substitutes for the others.

Put it into practice

  • Use known independent contact details to verify the relationship.
  • Review available quality and compliance evidence.
  • Investigate implausible offers or unusual ordering patterns.
  • Record gaps and any specialist sanctions or legal assessment required.
Control point
Is further investigation or an audit needed? Pressure to bypass checks for urgent discounted stock.

Working output: A due-diligence file showing checks, findings, gaps and escalation.

4

Determine risk and qualification depth

Use the intended product, role, route and patient consequences to determine qualification depth. Consider uncertainty, complexity, subcontracting, past performance and how readily a failure would be detected.

Risk assessment helps allocate assurance effort. It cannot waive a legal prerequisite or convert missing authority into an acceptable commercial risk.

Put it into practice

  • Define criteria and record the rationale for each material rating.
  • Select audit, technical review and monitoring requirements.
  • Set escalation rules for high-risk or uncertain cases.
  • Review the rating when scope or evidence changes.
Control point
What qualification depth is proportionate? Low score produced by averaging away a serious issue.

Working output: A justified risk tier linked to required controls and monitoring.

5

Record the working approval decision

Consolidate the authority, due diligence, capability and risk conclusions into a decision with a precise scope. Distinguish approved, restricted, deferred and rejected outcomes and identify the accountable approver.

Conditional approval needs clear boundaries. It is unsuitable where a missing legal prerequisite or unacceptable product risk prevents the proposed activity.

Put it into practice

  • Link the decision to dated supporting evidence.
  • State restrictions, expiry or review triggers and owners.
  • Record rejection or deferral reasons.
  • Transfer the approved status into the controlled supplier/customer system.
Control point
Approve within scope, restrict, defer or reject? Open critical audit findings described as minor admin tasks.

Working output: A review-ready recommendation with rationale, conditions, owners and expiry.

6

Control onboarding and agreements

Translate qualification into operational controls: approved master data, purchase and supply restrictions, responsibilities, quality agreements and change communication. Reconcile the contracting entity with the approved party.

For outsourced GDP activities, define access to evidence, subcontracting control, deviations, returns, recalls and escalation. Commercial terms do not remove the need for effective quality oversight.

Put it into practice

  • Check master data against the approval record.
  • Agree responsibilities for the actual service.
  • Train staff on restrictions and change triggers.
  • Sample the first transaction to confirm controls work.
Control point
Is the relationship ready for operational use? An approved name with unrestricted sites in the ERP.

Working output: An onboarding control pack aligned to the approved scope.

7

Monitor continued suitability

Monitor continued entitlement and suitability using authority changes, quality events, performance and credible external intelligence. Establish periodic checks plus immediate triggers for material changes.

Treat automated register matches as evidence to review. An unavailable source, ambiguous match or stale result cannot provide a current clearance.

Put it into practice

  • Assign monitoring ownership and frequency by risk.
  • Investigate adverse signals and changed details.
  • Restrict affected activity while material uncertainty is resolved.
  • Record the response and update operational status.
Control point
Continue monitoring, intensify review or suspend? Expired evidence displayed as current.

Working output: A monitoring record identifying status, deterioration and escalation.

8

Requalify and govern the portfolio

Requalification should reassess actual use, current authority, performance and unresolved risk. Review the portfolio for overdue reviews, concentration risk, restricted entities and recurring issues.

Management oversight should produce decisions on resources, alternatives and controls. A completed review date alone does not demonstrate continuing suitability.

Put it into practice

  • Sample actual transactions against approved scope.
  • Refresh evidence and risk conclusions.
  • Escalate overdue or repeated weaknesses.
  • Verify that completed actions improve subsequent performance.
Control point
Renew, narrow, suspend or end the relationship? Annual review copied forward unchanged.

Working output: A current qualification portfolio with documented renew, restrict, suspend or remove decisions.

Sources and applicability

Human-medicines suppliers, customers and brokers, with related outsourced-service interfaces. Apply the authority route relevant to the actual activity and jurisdiction. Register results support human review and do not establish a complete qualification decision.

Sources checked 21 September 2026. Read historical commentary alongside current official requirements. RegOpsPro scenarios are illustrative working examples. Formal approvals and controlled records remain in your authorised QMS.

View source coverage and knowledge-search scope

Working-workspace boundary. This supports assessment and evidence preparation. Accountable professionals retain decision responsibility; approved records remain in the authorised QMS.

Move from guidance to execution

Open Qualification WorkspaceOpen Qualification Practitioner Practitioner Practitioner Practitioner Practitioner Practitioner Guide™