How a System Integrator
Qualifies Themselves
to Work on Pharma Projects

Why Pharma Clients Qualify Their Suppliers

The logic behind supplier qualification is straightforward: a pharmaceutical manufacturer cannot fully validate a system delivered by a supplier whose own development processes are uncontrolled. If the supplier writes PLC code without version control, produces documentation without review, and has no formal change management process, the pharma client has no foundation for trusting the delivered system — regardless of how well the IQ and OQ execute on-site.

EU GMP Annex 11 §3 states explicitly that computerised systems should be validated and that suppliers should be assessed. GAMP 5 goes further, describing a risk-based approach to supplier assessment where the depth of assessment is proportional to the GMP criticality of the supplied system. A supplier delivering a Category 5 custom PLC application for a sterile filling line will be assessed far more rigorously than a supplier providing a standard commercial software product.

For an SI new to pharma, this assessment is not a formality to be managed. It is a commercial gate. A client whose QA team cannot approve your company as a qualified supplier cannot award you the contract — regardless of your technical capability or price competitiveness. Understanding what the assessment covers, and building the evidence to pass it, is as important as your engineering credentials.

Area 1 — Your Quality Management System

The first thing a pharma client's QA team wants to see is evidence that your company operates a documented Quality Management System. This does not necessarily mean ISO 9001 certification, although that is the clearest evidence of a structured QMS. What it means in practice is: do you have documented procedures for how you manage projects? How you control document revisions? How you train staff? How you handle non-conformances and corrective actions?

An SI that operates on experience and informal practice — no written procedures, no version-controlled documents, no training records — cannot satisfy this requirement with a conversation. The QA team needs documented evidence. If you do not have it, the assessment will flag a High gap, and the qualification outcome will be conditional on you producing it before contract award.

Area 2 — Technical Capability and Platform Experience

The technical assessment covers whether your team can actually deliver a GMP-compliant automation system on the platforms the client uses. This is not just about naming platforms — it is about demonstrating GMP-specific experience on those platforms. Telling a QA team "we have Siemens TIA Portal experience" is different from saying "we have delivered three Category 5 validated PLC applications on TIA Portal V17 for EU GMP-regulated manufacturing sites in the past three years, with full FAT and IQ/OQ execution."

The assessment will also probe your software development practices. Do you use version control for PLC and SCADA programmes? Do you have a peer review process for code before FAT? Do you have a coding standard? On a validated system, a PLC programme that has not been peer-reviewed against a coding standard is a risk — and QA knows it.

Area 3 — Validation Methodology

This is the area where most non-pharma SIs struggle. The client's QA team wants to know that your company understands the GAMP 5 validation lifecycle — not just conceptually, but operationally. Can you produce a Validation Plan? Do you understand the V-model and what design documents feed which test protocols? Do you know the difference between IQ, OQ, and PQ, and what each one verifies?

They will also ask how you handle data integrity requirements. Do your SCADA designs address audit trail completeness? Do your PLC applications support electronic records that meet 21 CFR Part 11 or EU GMP Annex 11? Do you understand what GAMP 5 risk assessment means in practice, and how it affects your test scope?

If your company has not delivered a validated pharma project before, the honest answer to most of these questions is "not yet." That is not necessarily disqualifying — it depends on the client's risk tolerance and the criticality of the system. But it means you need to compensate with other evidence: a clear plan for how validation activities will be managed on this project, named resources with the relevant experience, and ideally a document framework that demonstrates you understand what the outputs need to look like.

Area 4 — Pharmaceutical Industry Experience

Prior pharma project experience is assessed separately from technical capability because it speaks to organisational familiarity with GMP culture, not just engineering competence. A team that has never worked in a GMP environment will underestimate the documentation overhead, the approval cycle times, the role of QA, and the consequences of informal practices. Clients know this — and they weight prior pharma experience heavily in their assessment scoring.

Specific questions include: how many GMP automation projects has your company completed in the last three years? Have any of your delivered systems been subject to a regulatory inspection finding related to data integrity or validation? Can you provide three project references who can confirm GMP delivery capability?

If your reference count is low, be honest about it and compensate with detail on what you did deliver. A single well-described pharma project reference — naming the system type, the regulatory market, the validation activities performed, and a contact who will answer the phone — is worth more than a vague list of project names. Clients will follow up on references. Make sure the contacts know they may be called and are prepared to speak to your GMP performance specifically.

Area 5 — Proposed Project Team Qualifications

The final area assessed is the specific people who will work on the project — not the company's best-case capability roster, but the named individuals proposed for this contract. QA teams have learned from experience that a supplier's general capability often does not reflect who actually turns up on-site. The assessment specifically requests CVs for the project manager, validation specialist, and lead engineer, and scrutinises their individual GMP experience.

If your proposed project team includes someone with direct pharma validation experience — even a single person with three or four validated projects behind them — that individual's CV can anchor the entire team assessment. Their presence signals to QA that GMP practices will be applied, even if the rest of the team is new to pharma. If no one on your proposed team has pharma experience, this is a gap that will be flagged in the SAR and will likely result in a conditional qualification requiring you to either add an experienced resource or accept additional client oversight during execution.

Building Your Evidence Package Before the First Assessment

The most effective approach to supplier qualification is to build your evidence package before the first pharma client asks for it — not in response to their SAQ with a two-week deadline. This means treating your qualification readiness as a business development activity, not an administrative one.

The minimum viable evidence package for a first pharma qualification covers five things: a written quality policy and document control procedure; a coding standard for PLC and SCADA development; CVs of your proposed project team with pharma experience highlighted; a reference list of any relevant projects with contactable references; and at minimum a sample Validation Plan or equivalent document demonstrating awareness of GMP validation structure.

• Written quality policy and document control procedure
• PLC/SCADA coding standards document (even a simple one-page standard signals awareness)
• Version control practice description — tool used, how programmes are tagged and archived
• CVs for proposed project team with GMP project experience highlighted
• Three contactable project references — pharma or adjacent regulated industry preferred
• Sample validation document demonstrating understanding of GAMP 5 structure
• Training records for any GMP-specific training team members have completed

None of this requires a large investment. A one-page quality policy and a two-page document control procedure can be written in a day. A coding standard based on IEC 61131-3 principles can be produced in a few hours. The point is not to have an elaborate QMS — it is to demonstrate that your company has thought about quality systematically enough to write it down.

Maintaining Qualification Status Across Projects

Supplier qualification is not a one-time event. Many pharma clients conduct periodic re-assessments of their qualified supplier list — typically annually or when a supplier proposes a new project team. A qualification approved two years ago on the basis of specific named personnel does not automatically extend to a new team. If your team composition changes significantly between projects, expect a re-assessment or at minimum an updated CV submission.

The SIs who maintain their approved status most easily are those who treat GMP practices as a permanent operating mode rather than a project-specific overlay. Version control, peer review, training records, deviation logging — these are habits, not procedures you activate when the SAQ arrives. When your everyday practice already reflects GMP standards, re-qualification is a documentation exercise, not a remediation effort.