Why keep a file
Two conditions in section 503A turn on the supplier. A bulk drug substance has to be "manufactured by an establishment that is registered under section 360 of this title" and "accompanied by valid certificates of analysis for each bulk drug substance" (21 U.S.C. 353a(b)(1)(A)(ii) and (iii)).
The FDA's page for compounders on bulk and excipient suppliers says: "The agency urges compounders to know your bulk drug substance, or API, and excipient suppliers and know if the supplier is testing the component to ensure it is of appropriate quality to use in drugs."
USP <797> puts components under written procedures. As Washington's 2026 worksheet restates section 9.3, the pharmacy's SOPs address the "selection, receipt, evaluation, handling, storage, and documentation" of every component of a sterile preparation.
Current good manufacturing practice requirements apply to outsourcing facilities and not to compounding under section 503A. The FDA says: "Drugs compounded in outsourcing facilities are subject to current good manufacturing practice (CGMP) requirements. By contrast, drugs compounded by a licensed pharmacist in a state-licensed pharmacy or federal facility, or by a physician, in accordance with the conditions of section 503A of the FD&C Act, are not."
We did not find a list of what a supplier qualification file holds in any of these sources. The list below is what we keep, with the source each item rests on.
What the file holds
| Item | Where it comes from | What it rests on |
|---|---|---|
| The manufacturer's registration and FEI | A dated capture from the FDA's registration site. See the FEI lookup guide. | 21 U.S.C. 353a(b)(1)(A)(ii) |
| The repackager's or relabeler's registration | A second capture, labeled by role. See the repackaged API guide. | 21 CFR 207.21(a) |
| State licenses, where they apply | Ask the supplier which licenses it holds, and confirm each with the state that issued it. Wholesale drug distributors and third-party logistics providers also report licensure to the FDA each year, and the FDA publishes a searchable database. | Our practice. The FDA's registration site page describes the yearly reporting. |
| The supplier's quality documents and accreditations | The supplier | Our practice. ICH Q7 7.11 is background. |
| Inspection history | The FDA Data Dashboard, searched by firm name or FEI number | Our practice. The FDA's caution on reading inspection dates is in the FEI lookup guide. |
| The identity of the original manufacturer of each API | The COA and the supplier's written answer | ICH Q7 7.13 and 17.61 |
| A COA for every lot | It arrives with the lot | 21 U.S.C. 353a(b)(1)(A)(iii). USP <795> 6.2.1 and <797> 9.3.1, as Washington restates them. |
| Receipt records for each lot | Your own receiving log | USP <795> 6.2.2, as Washington restates it |
Most of the file is about the supplier and its establishments. The COA and the receipt record are per lot. That split is why we keep one file per supplier and one record per lot inside it.
The COA for each lot
The file is where the pharmacy evaluates every COA, verifies supplier and manufacturer information, and identifies discrepancies before a lot is used.
Washington's worksheets restate what the COA for an API includes under USP <795> 6.2.1 and <797> 9.3.1: specifications and test results for the component. The guide to COA requirements by source quotes each source in full.
What we check on each COA is our practice:
- The manufacturer's name and address on the COA match the registration capture in the file.
- The lot number on the COA matches the lot number on the container label.
- Each test carries a specification and a result.
- The certificate is dated and signed.
- For a repackaged lot, the original manufacturer is named and the original batch certificate is attached.
The last check gives the lot its traceability back to the establishment that made it. Our reading of each field is published as the valid certificate standard.
Requalification on a schedule
We did not find a requalification interval in the sources read for this page. Your SOP sets it.
Some dates set themselves. This is how we schedule the file:
- Registration. It is reviewed and updated every year "during the period beginning on October 1 and ending December 31 of each calendar year" (21 CFR 207.29(b)(1)). We take a fresh capture after the window closes.
- Licenses. Each one carries its own expiration date. We record the date and look again when it passes.
- A change of manufacturer or site. We treat it as a new qualification and start with a new registration capture.
ICH Q7 addresses a change of source for API manufacturers. Paragraph 7.14: "Changing the source of supply of critical raw materials should be treated according to Section 13, Change Control." It is background for a pharmacy and not a rule for one.
What to do with a discrepancy
For the physical lot, USP <795> 6.2.2 and <797> 9.3.2 have an answer. As Washington restates them, a component found to be of unacceptable quality is rejected promptly, labeled as rejected and kept apart from stock in use.
For a document that does not match, we found no procedure in the sources. This is ours.
- Hold the lot
Keep it out of use until a pharmacist decides.
- Record the mismatch
Write down the field, what the document says and what the record says.
- Ask for the document
Request the corrected or missing document from the supplier, in writing.
- Decide and sign
A pharmacist reads the answer, decides on the lot and signs the decision.
- Keep the exchange
File the request, the reply and the decision with the lot.
In our vocabulary each item in the file is Verified, Not verified or Decision owed. A mismatch stays Decision owed until a pharmacist closes it.
ICH Q7 section 7, as background
ICH Q7 is addressed to manufacturers of APIs and intermediates. A 503A pharmacy is not one. We use its section 7 as a reference point for what evaluating a supplier means.
7.11. "Manufacturers of intermediates and/or APIs should have a system for evaluating the suppliers of critical materials."
7.13. "If the supplier of a critical material is not the manufacturer of that material, the name and address of that manufacturer should be known by the intermediate and/or API manufacturer."
Veritura is the quality operations platform for compounding. Our supplier qualification page shows the dated file for each supplier and the decision a person signs.
Sources
Every source below was opened and read for this page. Last reviewed: November 11, 2026.
- 21 U.S.C. 353a. Section 503A of the Federal Food, Drug, and Cosmetic Act. Read at Cornell Law School's LII.
- 21 CFR 207.21. When an establishment registers. Read at Cornell Law School's LII.
- 21 CFR 207.29. The yearly review and update. Read at Cornell Law School's LII.
- FDA to Compounders: Know Your Bulks and Excipients Suppliers. The FDA. Content current as of February 4, 2026.
- Compounding and the FDA: Questions and Answers. The FDA. Content current as of September 16, 2025.
- Drug Establishments Current Registration Site (DECRS). The FDA's page about the site. Content current as of February 5, 2026.
- Wholesale Distributor and Third-Party Logistics Providers Reporting. The FDA's public database of reported licenses.
- FDA Data Dashboard. The FDA's public inspection and enforcement data.
- Pharmacy Self-Inspection Worksheet, 2026 USP 795 Nonsterile Compounding Addendum. Washington State Pharmacy Quality Assurance Commission, DOH 690-326, January 2026. PDF. Restates USP <795> and does not replace it.
- Pharmacy Self-Inspection Worksheet, 2026 USP 797 Sterile Compounding Addendum. Washington State Pharmacy Quality Assurance Commission, DOH 690-296, January 2026. PDF. Restates USP <797> and does not replace it.
- ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients. ICH Harmonised Tripartite Guideline, Step 4 version dated 10 November 2000. PDF.
ICH holds the copyright in ICH Q7 and its Questions and Answers. The passages on this page are quoted with that copyright acknowledged.
We read documents. We do not test material.