Subcontractor Management
on Validated
Pharma Projects

Why Subcontractor Management Is Different in Pharma

In standard automation projects, a subcontractor is a commercial arrangement. You hire a panel builder, they build the panel to specification, you inspect it, you accept it or reject it. The liability sits with them until acceptance. In a GMP context, that model breaks down. The liability for the quality of every component in the validated system stays with the lead SI — or more precisely, with the regulated party — regardless of who physically built it.

GAMP 5 and EU GMP Annex 11 are explicit that the regulated user must ensure their suppliers operate adequate quality management systems. This requirement flows down through the supply chain. If you are the lead SI and you subcontract panel building, you are responsible for ensuring the panel builder's work meets GMP standards. If an auditor later finds that the wiring test records do not exist because the panel builder did not keep them, that is a finding against your validation package — not against the panel builder directly.

The Qualification Requirement

Subcontractors performing GMP scope must be qualified before work begins. Qualification means demonstrating — in writing — that they have the capability and quality management system to produce work that meets GMP standards. The mechanism is the same as the supplier assessment process applied to the overall project: a questionnaire, a review of the responses, and a documented qualification decision.

The depth of qualification required scales with the risk of the subcontracted scope. A specialist calibration laboratory needs a thorough assessment including review of their ISO/IEC 17025 accreditation, scope of accreditation, and certificate format. A panel builder contributing to a GMP system needs their document control procedures, wiring test methodology, and component traceability practices reviewed. A specialist software subcontractor developing SCADA scripts needs their version control practices, code review procedures, and GMP training records assessed.

Not every subcontractor needs a formal multi-hour assessment. The proportionality principle applies — the depth of assessment should match the GMP criticality of the work being subcontracted. But every subcontractor on GMP scope should be documented somewhere, and there should be a record of why they were considered acceptable for GMP work.

Flowing Down GMP Requirements to Subcontractors

Qualifying a subcontractor establishes that they are capable of GMP work. Flowing down requirements tells them specifically what GMP work means for your project. Both are necessary. A qualified subcontractor who is never told which document numbers, naming conventions, and evidence requirements apply to your project will produce work that is competent but not directly usable in your validation package.

A GMP requirements flowdown document — sometimes called a project quality brief or subcontractor technical requirements — should cover at minimum: the document numbering system and naming conventions used on this project; the GMP-controlled document format requirements (including approval signatures, revision history, and document control fields); the wiring test records or other evidence required from the subcontractor before their work can be incorporated into the validation package; the change control requirement (no changes to GMP scope after the agreed baseline without a change control request); and the key personnel clause (the same engineer who was assessed during qualification must remain on the project, or a replacement must be reviewed and accepted).

This flowdown should be part of the subcontract, not a separate informal briefing. A subcontractor who has signed off on GMP requirements in their contract cannot later claim they did not know documentation was required.

What to Require From Panel Builders

Panel builders are one of the most common subcontractors on pharma automation projects and one of the most common sources of IQ documentation gaps. A panel that is built correctly but not documented correctly fails the IQ. The specific requirements that should be flowed down to a panel builder on a GMP project are:

• CE marking and panel builder's Declaration of Conformity — required as an IQ document verification item
• Component certificates for all major components: PLC, I/O modules, HMI hardware, power supplies, safety relays — manufacturer's conformity declarations or technical data sheets
• Wiring test records — a completed wiring continuity and insulation test record for every cable, signed by the test technician, with pass/fail result per conductor. This is what the IQ uses to verify correct installation
• As-built markings on drawings — every change from issued-for-construction to actual installation must be marked on the drawings before they leave the panel builder's facility
• Component labelling standards — every terminal block, cable, DIN rail component, and indicator must be labelled per the project labelling standard, consistent with the HDS

What to Require From Calibration Subcontractors

Calibration is the most regulated subcontracted activity on a pharma project. The requirements are well-defined by ISO/IEC 17025 and the GMP expectations flowing from EU GMP Annex 11 and FDA 21 CFR Part 211.68. What an SI needs from a calibration subcontractor is straightforward but must be confirmed before the first instrument is calibrated:

• ISO/IEC 17025 accreditation — the specific calibration activity must be within the laboratory's accredited scope. An accredited laboratory performing calibration outside their scope produces a non-accredited certificate that does not satisfy GMP.
• Certificate format — the certificate must include the calibration date (not the issue date), the reference standard used with its traceability chain, the measurement results at each calibration point, the instrument serial number, and the technician's identification. Review a sample certificate before commissioning the calibration work.
• Instrument-specific calibration procedure — particularly for complex instruments like conductivity sensors and TOC analysers, confirm that the calibration laboratory has the capability to calibrate the specific instrument type, not just the signal type.
• Turnaround time — calibration certificates must be available before IQ begins. Confirm certificate turnaround time in the subcontract and build the IQ start date around it, not around an optimistic assumption.

Managing Subcontractor Documentation in the Validation Package

Subcontractor-produced documents that form part of the validation evidence — panel builder wiring test records, calibration certificates, CE declarations — are referenced in the IQ protocol by their document numbers and filing locations. These documents are not owned by the SI in the sense that the SI wrote them, but the SI is responsible for ensuring they are present, complete, and retrievable when the IQ is executed.

A practical approach is to maintain a subcontractor evidence log — a simple register that tracks, for each subcontracted activity, what evidence is required, what has been received, and where it is filed. This log becomes the checklist during IQ pre-conditions verification: before IQ begins, confirm that all subcontractor evidence required for IQ is on file. The Validation Plan should reference subcontractor evidence requirements explicitly so there is no ambiguity about what must be in place before IQ starts.

Changes made by subcontractors after the validation baseline is established — a last-minute component substitution by the panel builder, a firmware update applied to a calibrated transmitter during installation — require the same change control process as any other post-baseline change. Subcontractors who are not briefed on this requirement will make what they consider routine engineering decisions that are, in a validated context, formal change events requiring documentation and impact assessment.