Choosing a pharmaceutical manufacturer is not a purchasing decision. It is a regulatory decision that follows your product for its whole commercial life.
If the site you buy from has a compliance problem, that problem becomes yours. Your import permit, your dossier, and your market authorisation all rest on the site being what the paperwork says it is.
Most of the verification work can be done from your desk, using public databases anyone can search. The rest needs documents, direct questions, and eventually a visit.
This guide sets out what to check, where to check it, and what each check proves.
Quick answer: Verifying a pharmaceutical manufacturer means confirming its legal identity and manufacturing licence, checking its GMP standing in independent public regulatory databases rather than supplied PDFs, confirming the certificate scope covers your exact site and dosage form, and then auditing the site before supply begins.
Table of Contents
- Why Verifying Your Pharmaceutical Manufacturer Matters
- Step One: Establish Corporate Identity
- Step Two: Verify Regulatory Standing in Public Databases
- Does the Certificate Match What You Are Buying?
- Registered Is Not the Same as Inspected
- The Quality Document Pack
- The Supplier Questionnaire
- Auditing the Pharmaceutical Manufacturer
- References, Export History and Commercial Checks
- Quality Agreement and Supply Agreement
- Comparison of Verification Methods
- How to Verify a Pharmaceutical Manufacturer: Step by Step
- Red Flags You Should Never Ignore
- Ongoing Monitoring After Qualification
- Expert Tips
- Common Mistakes
- Frequently Asked Questions
- Final Thoughts
Why Verifying Your Pharmaceutical Manufacturer Matters
When you register a product abroad, the authority does not evaluate your trading company. It evaluates the manufacturing site named in the dossier.
You inherit that site’s record. A warning letter, an import alert, or a GMP non-compliance report can stall your registration or pull your product from the market.
Recalls work the same way. If a batch fails, the investigation goes back to the site, and your name is on the import licence.
Price gaps between suppliers are usually small. The cost of choosing a site that cannot pass an inspection is the whole project.
Match the effort to the risk
A sterile injectable for a regulated market deserves far more scrutiny than a bulk excipient. Set your depth of checking by dosage form, route of administration, and destination market.
Step One: Establish Corporate Identity
Confirm that the company legally exists, and that the entity you are contracting with is the entity that manufactures.
Ask for the company registration number and check it in the national corporate register. Most countries publish a searchable one.
Then ask for the manufacturing licence number and the issuing authority. A licence is granted to a specific site for specific product categories. Record the number and the validity dates.
Trading office address versus site address
Many pharmaceutical companies have a head office in one city and a factory somewhere else entirely. Every regulatory document refers to the site address, not the office.
Ask directly for the plot number, industrial area, and district of the manufacturing block that will make your product. A genuine manufacturer answers without hesitation.
Confirm too whether the company owns the site or subcontracts. A trading house is a valid partner, but you must verify the factory behind it.
Step Two: Verify Regulatory Standing in Public Databases
This is the most valuable part of verification, and it costs nothing. Regulators publish their own records — use those instead of the PDFs your supplier emails.
A certificate is a claim. A database entry held by the issuing authority is evidence. When they disagree, the database wins.
FDA establishment registration
Sites making drugs for the US market must register with the FDA and list their products. Search by firm name and by address, and confirm the registered address matches the site your supplier named.
FDA inspection classifications and warning letters
The FDA publishes inspection classification data showing whether a site’s last inspection was classified as acceptable or as requiring action. It also publishes warning letters and import alerts.
Search all three. A site on an import alert for your product category is out for the US market until the alert is resolved. Try the parent name, the site name, and partial address strings before deciding a site is absent.
EudraGMDP for EU GMP certificates
EudraGMDP holds European manufacturing authorisations, GMP certificates, and non-compliance reports. If a supplier claims EU GMP status, the certificate should be findable there.
Open the record and check the site address, certificate number, date of last inspection, and the annexed scope. Then check the statements of non-compliance section, not just the certificate section.
WHO prequalification lists
WHO publishes lists of prequalified products and the manufacturing sites tied to them. Prequalification is product-specific and site-specific — it does not extend across a company’s whole catalogue.
EDQM and CEP holders
For APIs used in Europe, EDQM issues Certificates of Suitability to the European Pharmacopoeia monograph and publishes CEP status. Check the CEP is current rather than suspended or withdrawn, and that the holder name matches your supplier exactly.
National authority licence registers
Most drug regulators publish licence registers or approval lists. India’s CDSCO and the state FDA registers are common examples. The importing country’s authority is worth searching too.
If a database exists and your supplier is not in it, resolve that before proceeding. Our guide to global regulatory authorities explains which agency publishes what.
Does the Certificate Match What You Are Buying?
Verification usually fails not because a certificate is fake, but because it does not cover the thing being sold.
Site. A group with four factories may hold a certificate for one. Compare the address on the certificate, character by character, with the block making your batches.
Scope. GMP certificates list the operations covered — sterile manufacture, non-sterile manufacture, primary packaging, secondary packaging, QC testing, batch release. A certificate for secondary packaging does not cover manufacturing.
Dosage form. Scope is broken down by category: tablets, capsules, oral liquids, creams, injectables. Buying an ointment from a site certified only for solid orals is a dead end.
Dates. Look at the inspection date behind the certificate, not just the issue date. A certificate resting on an old inspection carries less weight.
Registered Is Not the Same as Inspected
This is the most common misunderstanding in supplier verification, and some suppliers encourage it.
Registration means the site filed its details with an authority. In many systems it is self-declared and involves no visit.
Inspection means inspectors came to the premises and formed a conclusion, producing a certificate, a classification, or a non-compliance report.
So “FDA registered” is a statement about paperwork. “Inspected with an acceptable classification” is a statement about quality. Ask plainly which one applies.
The Quality Document Pack
Once regulatory standing checks out, request the documents. What you ask for depends on whether you are buying an API or a finished dosage form.
For an API supplier: Site Master File or site overview; specification and COAs for recent commercial batches; method of analysis and validation summary; DMF or CEP reference and status; stability data summary supporting the retest period; residual solvent, elemental impurity and nitrosamine risk statements; and a manufacturing flow chart showing key starting material sources.
For a finished dosage form supplier: product specification and finished product COA; the batch manufacturing record structure; packaging specification and shelf life data; a Free Sale Certificate or CPP if your market needs one; and the list of markets where the product is already registered.
Read each COA against the specification rather than filing it. Ask for two COAs from different batches — identical values to the same decimal place deserve a question.
The Supplier Questionnaire
A questionnaire creates a written record of what the supplier claims, which you can test later during an audit. Fifteen good questions answered fully beat a hundred-item form returned with one-word replies.
Cover the quality system and who the quality head reports to, deviation and CAPA handling, change control and customer notification, raw material supplier qualification, and the last three regulatory inspections with dates, agencies and outcomes.
Ask specifically about data integrity: are laboratory systems on audit trails, who holds administrator rights, and how are electronic records backed up and reviewed?
Vague answers to specific questions are themselves a finding.
Auditing the Pharmaceutical Manufacturer
No database or document replaces seeing the site. An audit is where claims meet practice.
Remote versus on-site
A remote audit — document review plus a live video walk-through — works for a first pass, for low-risk products, or when travel is impractical.
What it cannot do is let you open a random cupboard or follow an operator who was not scheduled to be on camera. For high-risk products, an on-site audit stays necessary.
What a proper audit agenda covers
- Quality management system — organisation chart, quality manual, SOP control, training records, self-inspection
- Premises walk-through — layout, material and personnel flow, cross-contamination controls, HVAC and pressure differentials
- Water system — generation, storage, loop design, sanitisation, and twelve months of monitoring data
- Warehouse — receipt, sampling, quarantine and release status control, temperature mapping, rejected goods segregation
- Production — line clearance, in-process controls, equipment qualification, cleaning validation
- QC laboratory — calibration, reference standards, stability chambers, out-of-specification investigations
- Documentation review — one completed batch record traced end to end against the master formula
- Data integrity — audit trail review on a chromatography system, user access levels, control of deleted or reprocessed data
Trace one product backwards through the whole chain: finished stock to packaging to production to raw material receipt. Systems that look tidy in a presentation often break down under a single traced batch.
Third-party audit reports and their limits
Buying an existing third-party report saves time and money, and is reasonable for lower-risk supply.
The limits are real. The report reflects one date, was scoped for someone else’s product, and may not have covered the line you will use. Check the scope and date before relying on it, and treat unresolved observations as open items.
References, Export History and Commercial Checks
Ask for references from buyers in markets with comparable regulatory demands. A reference from a light-touch market says little about performance in a strict one.
Request export history — which countries, which products, how long — then test it for consistency. A site claiming years of EU supply should appear in EU-facing databases.
A manufacturer that cannot fund raw materials cannot supply reliably. Review audited financials, or at minimum confirm the company is not in insolvency proceedings.
Capacity matters equally. Ask about batch sizes, number of lines, current utilisation, and lead time for your volumes. A site running near capacity will deprioritise your small order.
Quality Agreement and Supply Agreement
Verification ends in writing, in two documents that do different jobs.
The quality agreement allocates GMP responsibilities: specifications, testing, batch release, deviation notification, change control, complaints, recall cooperation, retention samples, and audit rights.
The supply agreement covers commercial terms: volumes, pricing, lead times, Incoterms, payment, liability, exclusivity.
Put audit rights and change notification in the quality agreement explicitly. A general right to inspect is far weaker than a defined obligation to tell you before any change to process, site, or key material source.
Comparison of Verification Methods
| Method | What it proves | Effort | Main limitation |
|---|---|---|---|
| Corporate register check | The legal entity exists and who controls it | Low | Says nothing about manufacturing capability |
| Public regulatory database search | Independent confirmation of licence, GMP or inspection status | Low | Coverage varies by country; naming inconsistencies |
| Supplied certificate review | What the supplier claims, and the scope claimed | Low | Documents can be edited; must be cross-checked |
| Supplier questionnaire | Written record of stated systems and practices | Low to medium | Self-reported; untested until audited |
| Document pack review | Whether specifications, COAs and stability data are coherent | Medium | Shows the batches the supplier chooses to send |
| Third-party audit report | An independent view of the site on one date | Medium | Scoped for another buyer; may exclude your line |
| Remote audit | Documentation systems and general site condition | Medium | Cannot see unscripted areas or what is off camera |
| On-site audit | Actual practice, data integrity and traceability | High | Costly, and reflects that date only |
| Reference and export history checks | Real-world performance with comparable buyers | Medium | References are chosen by the supplier |
| Trial order with independent testing | Whether delivered material meets specification | Medium to high | One batch does not prove consistency |
How to Verify a Pharmaceutical Manufacturer: Step by Step
- Define what you are buying. Product, dosage form, strength, pack, volume, destination market. Everything is checked against this line.
- Collect identity data. Legal name, registration number, manufacturing licence number, full site address.
- Verify the entity in the corporate register and the licence in the issuing authority’s register.
- Search every relevant public database — FDA registration, inspection classifications, warning letters, import alerts, EudraGMDP certificates and non-compliance statements, WHO prequalification, EDQM CEP status, national registers.
- Match scope to purchase. Confirm the certificate covers this site, this operation, this dosage form.
- Request the document pack and read it against your own specification.
- Issue the questionnaire and review the answers for specificity.
- Decide the audit level by risk: third-party report, remote audit, or on-site audit.
- Conduct the audit to a written agenda, and issue observations with response deadlines.
- Check references and export history in markets comparable to yours.
- Run financial and capacity checks before committing volume.
- Place a qualification batch and test it at an independent laboratory against your specification.
- Sign the quality agreement and supply agreement before commercial supply starts.
- Approve the supplier formally in writing, with the approved scope stated and a re-audit date set.
Red Flags You Should Never Ignore
Certificates absent from any public database. If a GMP certificate cannot be found in the issuing authority’s register, treat it as unverified however convincing it looks.
Scope mismatches waved away. A supplier who says the dosage form difference “is not a problem” does not respect the certificate they hold.
Refusal to name the manufacturing site. Genuine manufacturers state the address freely — it is on every regulatory filing they make. Refusal usually means they are reselling.
Reluctance to permit an audit. Delays, conditions, permanent scheduling problems, or an offer to send a video instead. Qualified sites are audited routinely and treat it as normal.
Pressure to skip qualification for a discount. Pricing that expires before your checks can finish is a sales tactic, not a supply relationship.
Mismatched document details. Different addresses on the licence and the COA, letterheads that vary, or certificate numbers that do not follow the authority’s format.
No named quality contact. If every question routes through sales and you never reach the quality head, you cannot verify the quality system.
Ongoing Monitoring After Qualification
Approval is a snapshot. Sites change owners, lose key staff, move lines, and fail inspections.
Set a re-audit interval by risk — commonly two to three years for standard products, sooner for sterile products or after a significant event.
Require change notification in the quality agreement: process changes, site or line transfers, raw material supplier changes, specification changes, equipment changes.
Run a periodic performance review covering batch rejections, out-of-specification results, complaints, on-time delivery, and documentation errors. Trends appear here long before failures do.
Re-run the public database checks yearly. New warning letters and non-compliance statements appear continuously, and nobody will tell you when your supplier shows up in one.
Expert Tips
- Search databases by address, not just by company name. Group companies rename themselves and trade under several brands. The site address is the constant that ties records together.
- Ask for the certificate number before the certificate. Then look it up yourself. The pause before an answer is informative.
- Request the last inspection outcome in writing — agency, date, and number of observations, not just the certificate.
- Trace a single batch backwards during any audit. One complete traceback reveals more than a day of walking clean corridors.
- Test the qualification batch at an independent laboratory. The supplier’s COA is their result; an independent result is yours.
- Write the audit report within a week. Detail fades fast, and vague observations are easy to close without changing anything.
- Keep a dated verification file per supplier. When your own authority asks how you qualified the site, that file is the answer.
Common Mistakes
- Accepting emailed PDFs as verification. A document you cannot trace to an issuing authority proves nothing, and your regulator will say so.
- Confusing registration with inspection. You present a site with no inspection history as compliant, and the dossier stalls.
- Verifying the trading company instead of the factory. Your registration names a site nobody actually checked.
- Ignoring certificate scope. The certificate is genuine but does not cover your dosage form, and it surfaces during market authorisation review.
- Skipping the non-compliance sections of databases. You see the certificate and miss the statement filed against the same site.
- Signing a supply agreement with no quality agreement. When a deviation happens, nobody is obliged to tell you.
- Treating qualification as permanent. A site that passed three years ago may have changed hands, and you learn it during a recall.
Frequently Asked Questions
How do I check if a pharmaceutical manufacturer is FDA approved?
The FDA approves products and inspects sites rather than approving manufacturers in general. Search the FDA establishment registration and drug listing data to confirm the site is registered, then check the inspection classification database to see whether it was inspected and how the result was classified. Search the warning letter database and import alert lists using both company name and site address. A site appearing only in registration data has told the FDA it exists, which is not the same as passing an inspection.
What is the difference between a GMP certificate and a manufacturing licence?
A manufacturing licence is issued by the national authority and gives the site legal permission to make specified categories of medicine. A GMP certificate confirms that an inspection found the site compliant with Good Manufacturing Practice for a defined scope of operations and dosage forms. A site can hold a licence without holding a current GMP certificate that your destination market recognises. Check both documents, and confirm the certificate scope covers the exact product type you intend to buy.
Can I verify a GMP certificate online?
Often, yes. EU GMP certificates appear in EudraGMDP, where you can search by company or country and view the scope, inspection date, and any statement of non-compliance. EDQM publishes the status of Certificates of Suitability, and WHO publishes its prequalification lists. Many national authorities maintain searchable licence registers. If a certificate cannot be located in the issuing authority’s own database, ask the supplier to explain the gap and treat the document as unverified until they do.
What documents should I request from a pharmaceutical manufacturer?
Ask for the manufacturing licence, the applicable GMP certificate, a Site Master File, the product specification, Certificates of Analysis for recent commercial batches, stability data, and the DMF or CEP reference where relevant. For finished dosage forms, add packaging specifications, shelf life data, and a Certificate of Pharmaceutical Product if your market requires one. Request the list of markets where the product is already registered, and read every document against your own specification.
Is a remote audit enough to qualify a supplier?
It depends on risk. For a low-risk product from a site with a strong, verifiable inspection record, a remote audit combined with database checks and a document review can be sufficient. For sterile products, complex dosage forms, or a supplier with no independent inspection history, an on-site audit is hard to justify skipping. A remote audit cannot show you unscheduled areas, cannot follow material flow physically, and depends entirely on where the camera points.
How often should I re-audit a pharmaceutical manufacturer?
A common interval is every two to three years for standard products, shortened for higher-risk manufacturing such as sterile injectables. Re-audit outside that cycle after specific triggers: a change of ownership, a site or line transfer, a regulatory non-compliance finding, a serious deviation, or a pattern of complaints. Between audits, run an annual public database re-check and a periodic performance review covering rejections, out-of-specification results, complaints, and delivery reliability.
What is a quality agreement and do I really need one?
A quality agreement is a written document allocating GMP responsibilities between you and the manufacturer. It defines specifications, testing responsibilities, batch release, deviation and change notification, complaint handling, recall cooperation, retention samples, and audit rights. Regulated markets generally expect one between an importer and its manufacturing site. Without it you have no defined right to be told about a process change, and no agreed process when a batch fails. A supply agreement covers commercial terms and does not replace it.
How can I tell if a supplier is a trader rather than a manufacturer?
Ask for the manufacturing site address, the manufacturing licence number, and permission to audit the site. A manufacturer answers all three directly. Traders typically give a commercial office address, avoid naming the factory, and route audit requests through conditions and delays. Cross-check the company name in the issuing authority’s licence register. Working with a trader is not automatically wrong, but you must still verify and audit the actual manufacturing site behind them.
What should I do if a supplier refuses an audit?
Treat it as a serious finding, not an inconvenience. Ask for the reason in writing. Legitimate constraints exist, such as shutdown periods or an ongoing regulatory inspection, and those come with a proposed alternative date. If the refusal is open-ended, or audit rights are resisted in the quality agreement, the risk rarely justifies the price advantage. At minimum, do not proceed without a recent, in-scope third-party audit report and strong independent database evidence.
Does a WHO-GMP certificate mean a site can supply any market?
No. WHO-GMP indicates compliance with WHO GMP guidance as assessed by the issuing national authority, and it is widely accepted across many emerging markets. It does not substitute for an EU GMP certificate, an FDA inspection outcome, or approval by any specific importing regulator. Each destination market decides which certifications it recognises. Confirm what your importing authority requires before assuming a certificate is enough, and check that the scope covers your dosage form.
Final Thoughts
Verifying a pharmaceutical manufacturer is a process, not a document check. Confirm identity, verify through independent public sources, match scope to what you are buying, audit the site, and keep watching afterwards.
Every step skipped becomes a question someone else asks you later — an importing authority, a customer, or an inspector. Answering those before the first shipment is far cheaper than answering them after.
Work With a Supplier That Welcomes Verification
AksharAvira Pharma supports buyers through the full qualification process: site details, document packs, questionnaire responses, and audit access.
If you are evaluating suppliers for a specific product and market, discuss your sourcing requirements with our team and we will walk you through the documentation you need.