How I Vet a Pharma Supplier in 20 Minutes (Even When the Clock Is Running)

In March 2024, I nearly signed a purchase order for a 'rush delivery' of a critical reagent based on a well-designed website and a friendly sales rep. The price was good (maybe too good), the promised lead time fit perfectly into my client's schedule, and I was 36 hours away from a deadline. What stopped me was a 20-minute checklist that I've now run on every emergency order since. It's not complicated, but it's concrete—and it has saved me from at least two disasters that would have cost far more than the order itself.

Most of what I do as an emergency procurement coordinator is triage. Someone's upstream supplier fell through, a batch got rejected in quality control, or the original vendor simply ghosted them. When the clock is ticking, the temptation is to move fast and verify later. That instinct is exactly backwards.

The 7-Step Checklist I Use for Emergency Supplier Verification

Step 1: Find the legal entity behind the product. The website says one thing, but the legal entity is what you're actually doing business with. For example, if you're buying Lonza RPMI formulation media, you should be able to identify the specific Lonza entity that manufactures it. Look up the company registration number, the registered address, and the actual manufacturing site. If the address is a residential home or a virtual office, stop.

Step 2: Verify the GMP certificate covers the site you're buying from. 'GMP-compliant' is a phrase that gets thrown around a lot. You need to see the certificate, and it needs to cover the specific site where the product is made. For pharmaceutical supply chains, a certificate from a recognized authority—like an FDA inspection report or an EU GMP certificate—is the minimum. Don't accept a supplier's claim that they're 'working on it.' You're not in the business of accepting promises; you're in the business of preventing failures.

Step 3: Ask for a documented product trail. Any established supplier can provide you with a Certificate of Analysis (COA), batch records, and safety data sheets. Most have a customer portal where this documentation is readily available. For example, the Lonza login portal gives you access to batch-specific documentation for the products you purchase. If a supplier says 'we'll send it after you order,' that's not a supplier—it's a risk.

Step 4: Pull the data into your own systems. This is one of those steps that sounds techy but saves the most time in a rush. When I set up supplier monitoring for our procurement team, I used the Pigment GraphQL API Python SDK to pull inventory levels and lead-time data directly from supplier APIs into our planning dashboard. Instead of emailing each supplier for updates, I had a live view of what was available where. When a supplier's API says 'out of stock' but their sales rep says 'we can make it,' trust the API.

Step 5: Understand where the money is coming from. If you are supplying pharmaceutical or biotech companies, there is a good chance the end client is using some form of grant funding. I've seen pharma grants that explicitly require purchases from GMP-certified suppliers, or that impose specific documentation requirements. Ignoring those terms can jeopardize the entire project. Before you place the order, ask your client if there are funding-linked procurement rules. That conversation can save you from a compliance nightmare.

Step 6: Do a 'legit check' search before you commit. Type the supplier's name into a search engine along with words like 'legit,' 'scam,' or 'complaint.' This is how you find the gray-market players. For example, people often ask 'is Dragon Pharma legit?'—and the answer is no. Dragon Pharma is a brand associated with black-market anabolic steroids, not a licensed pharmaceutical manufacturer. The point is not to single out one name; it's to make the same inquiry for every potential supplier. Forum threads, consumer complaints, and regulatory warnings can tell you more than a marketing website ever will.

Step 7: Compare the product formulation to the official source. This matters most for critical inputs like cell culture media. If you need the Lonza RPMI formulation, you can find the official formulation documentation on Lonza's website or through their technical support. A legitimate supplier should be able to match that formulation exactly, including buffer components and concentrations. If their product sheet looks different from the reference, or if they won't share the full composition, that is a hard stop.

Where the Checklist Usually Falls Apart

I'll be honest: I didn't always run this checklist. When I first started in this role, I assumed that a higher price meant a more legitimate supplier. I thought that a company charging premium rates would have their compliance in order. Three near-misses later, I learned that cost and legitimacy are independent variables. You can find expensive scammers and cheap manufacturers with excellent GMP compliance. Price is not a signal of quality.

The most frustrating part is that the suppliers who cause the biggest problems are often the ones with the most polished sales teams. They answer emails quickly, they say all the right things, and they promise delivery times that your reliable suppliers can't match. But when you ask for the GMP certificate or a specific batch record, the conversation suddenly slows down.

Another common failure point: doing the checklist verbally and not documenting it. I know, documentation feels like a waste of time when you're in a rush. But an audit trail is your protection. Screenshot the registration, save the certificate, keep the emails. If anything goes wrong, you'll need that evidence to prove you did your due diligence. And if you're using an automated tool like that Pigment API connection, keep the logs. (Thankfully, most API systems will automatically timestamp the data pulls.)

There's something satisfying about seeing a rush order land completely intact—the right product, the right paperwork, the right time. It doesn't happen by accident. It happens because someone spent twenty minutes checking the things that don't show up on a sales brochure.

5 minutes of verification beats 5 days of correction.

I've become more convinced of that every time we have to triage an emergency order. The clients who bring you a 48-hour deadline because of a supply chain failure are usually the ones who skipped verification earlier. That's not a judgment; it's a pattern. The good news is, the checklist works for them too. It just takes one disciplined pass to avoid repeating the same error.

One more suggestion: build verification into your standard workflow, not just emergency orders. (I should add that this is more of a strategic fix than a tactical one.) When the rush is over, sit down with your team and ask: 'What would have happened if we hadn't checked?' That question has pushed us to automate more of the verification process, so the emergency steps become routine.

At the end of the day, rushing is not the opposite of caution. You can move fast and still be careful. The secret is having a short, repeatable checklist that you trust—and running it every single time, no matter how loud the clock is ticking.