Pharma Vendor Selection: Evaluation Criteria and Decision Framework for October 2026

Use this framework to select regulatory software: authoring, document review, submission publishing, or regulatory information management. Identify the actual scope before comparing products. An authoring assistant, a publisher, and a RIM platform cannot earn equivalent “functionality” points for different deliverables.

The resource is provided directly below as editable text and tables. Copy them into your evaluation document or spreadsheet. No download, account, or vendor contact is required. This is Assyro's editorial template, revised September 14, 2026, rather than an agency qualification form.

Copy the evaluation record before reviewing proposals

Create one record per exact product and edition. Bracketed fields are deliberate blank-template placeholders; complete required fields before deciding eligibility.

Evaluation ID and revision: [required]
Decision owner and review date: [required]
Vendor / product / edition / available release: [required]
Purchased workflow and excluded activities: [required]
Authority / application / format, where relevant: [required or justified N/A]
Users, external organizations, volume and target date: [required]
Systems retained and interfaces required: [required]
Required records, retention and export destinations: [required]
Applicability assessment approved by: [required]
Evidence register location: [required]
Mandatory gates: [all pass / pending / failed]
Weighted score: [calculate only after all applicable gates pass]
Decision / conditions / owners / due dates: [required]
Optional reference-call notes: [optional; absence earns no points]

For each requirement, use the following row format. Split a row if its conditions could receive different results.

An evidence link should open the relevant record, not just the vendor's homepage. Keep vendor assertions, observed exercises, supplied documentation, and unresolved questions distinguishable. A screenshot may demonstrate one screen; it does not demonstrate a complete export or the scope of a support agreement.

Decide which requirements are mandatory

Write these conditions before demonstrations. They should represent your intended use, not a universal checklist imposed on every pharmaceutical system.

• Required output: Specify what the purchased edition must produce. For publishing, name the agency, application context, eCTD version, and required lifecycle behavior. For authoring, name the document, source inputs, review process, and usable output.
• Record preservation: State which approved versions, history, metadata, signatures where applicable, and linked records must remain retrievable. Define the export the next responsible party must receive.
• Access boundary: Specify sponsor, CRO, contractor, and administrator permissions. Include a negative condition, such as a CRO reviewer being unable to open another organization's restricted document.
• Applicable controls: Have Quality determine the record and signature requirements, validation approach, and evidence needed for the intended use. Replace “Part 11 compliant” with specific conditions and assigned responsibilities.
• Operational feasibility: Name the required implementation date, migration acceptance, recovery needs, support coverage, and contractual terms. A non-negotiable filing dependency belongs here rather than in a low-weight convenience category.

Record unknown when evidence is absent or insufficient. Record fail when evidence shows the condition is not met. Neither result becomes “3 out of 5” to keep the comparison moving. Not applicable requires a documented reason accepted by the relevant owner; it is not a way to bypass an inconvenient requirement.

If a genuine requirement changes, revise the scope and reassess every candidate. A commercial sponsor cannot turn a mandatory failure into a pass simply by accepting a cheaper price.

For an Assyro-specific commercial comparison, review current Assyro pricing and confirm the included scope in the proposal used for your evaluation.

Apply regulatory sources to the actual use

Part 11's scope concerns specified electronic records and signatures, not every purchase made by a pharma company. FDA's guidance also explains its approach to scope and enforcement discretion while retaining the underlying record requirements. Use the current Part 11 text and FDA's Scope and Application guidance to support an applicability assessment.

Where relevant, section 11.10 provides concrete control topics such as record copies, retrieval, access, audit trails, and authority checks. A vendor's control matrix is supporting evidence; your configured workflow, procedures, and retained records still need assessment.

EU Annex 11 applies to computerised systems used in GMP-regulated activities. Its supplier section addresses formal agreements, responsibilities, supplier competence, and risk-based assessment. The European Commission's current index lists the January 2011 revision. Do not automatically apply it to every regulatory-software purchase or substitute a consultation draft for the operative text. EU Annex 11, principle and section 3.

Completed example: eligibility comes before the score

Everything in this example—candidates, evidence identifiers, observations, dates, costs, and scores—is fictional. It illustrates how to complete the resource, not how real vendors performed.

Evaluation VS-01, revision 1: A biotech sponsor needs a review-and-publishing workflow for an existing FDA eCTD v3.2.2 application. Scope is 20 users, two external CRO organizations, and deployment within ten weeks. The existing document repository remains the source system; broader RIM replacement is excluded. The sponsor requires historical records and transferable submission packages. Regulatory Operations owns the decision; Quality and IT approve their respective gates.

A–D identify four fictional products, each assessed in its Standard edition, release 1.0. The workload is 50 documents per month with 12 historical sequences to import. Evidence sits in evaluation folder VS-01. An additional EMA-output criterion is recorded as not applicable, approved by Regulatory Operations because this purchase is FDA-only. Optional reference-call notes are absent and earn no points.

The mandatory register covers current format/output support, complete history/export, organization permissions, applicable record controls, and delivery feasibility. Assume all gates pass unless a specific exception is shown below.

For C, “exports current files” is not proof that history is absent. The required result is simply unverified. For D, the evidence establishes a known incompatibility. A roadmap commitment cannot satisfy this purchase's present requirement.

An individual completed row for C would read: EXP-01; mandatory; preserve and export the required history; evidence C-03 dated September 14; unknown; owner Regulatory Operations; vendor demonstration due September 18; close only after the buyer reconciles the exported versions and relationships.

Score only the eligible candidates

Use a 1–5 preference scale: 1 offers little benefit beyond the mandatory minimum; 3 meets the agreed operational target; 5 meets a defined stretch target with evidence. Scores 2 and 4 are intermediate. Set the anchors before seeing results and retain the reason for each score. Missing preference evidence also stays unknown; complete it before reporting a final total.

For VS-01, the fictional evidence supports these anchors and results:

• Workflow, A3/B5: The target permits four manual handoffs in the representative workflow; the stretch target is none. A-01 records four, B-01 none.
• Implementation, A4/B3: Both meet the ten-week gate. The accepted plans A-02/B-02 show seven and nine weeks respectively; nine weeks is the target, five the stretch target, and seven the intermediate anchor.
• Support, A4/B4: Both contracts include the desired named escalation owner and a pre-filing rehearsal. Neither includes the additional dedicated coverage needed for 5.
• Cost, A5/B3: The three-year model below produces $265,000 and $325,000. Pre-agreed bands are 5 at or below $275,000; 4 through $300,000; 3 through $325,000; 2 through $350,000; 1 above that.
• Expansion, A4/B5: Both cover planned user growth. A's proposal requires a documented configuration project for the next CRO; B's exercised configuration meets the stretch target of adding that organization without a separate project.

The formula is weighted points = weight × score ÷ 5. For A, the total is 30×3/5 + 25×4/5 + 15×4/5 + 20×5/5 + 10×4/5 = 78. B totals 30 + 15 + 12 + 12 + 10 = 79.

B leads by one point under these preferences. That narrow lead is not proof of superior quality. If the committee moves five weight points from workflow to cost, A becomes 80 and B 77. Document that sensitivity rather than adjusting the weights after seeing which candidate wins.

Include the customer's work in total cost

License price is only part of the cost. Retain implementation, migration, validation or qualification work, training, administration, change assessment, and exit costs in the model. Separate vendor fees from buyer labor so included services are not counted twice.

This is VS-01's completed illustrative three-year USD model. It assumes flat annual subscription prices, a $100 loaded hourly labor rate, and no taxes, discounting, inflation, or contingency. These are model inputs, not vendor quotations.

The $60,000 premium for B buys the modeled workflow and expansion advantages. It does not prove they are worth that amount. To offset $60,000 through labor capacity alone at $100/hour over three years, B would need to save 200 additional hours annually. That benefit has not been demonstrated by counting manual handoffs, and available capacity is not cash savings unless spending actually falls.

Vary the labor rate as well. At $150/hour, A totals $317,500 and B $362,500; B's premium falls to $45,000 because its assumed initial buyer effort is lower. Under the unchanged cost bands, A's cost score becomes 3 and B's becomes 1. Their overall scores become 70 and 71, respectively. A lower initial subscription price does not tell you which system costs less to operate under every workload.

Assess supplier evidence without rewarding paperwork volume

Ask each finalist: What work will our team perform, what evidence do you supply, and what remains unverified? A large generic validation package may be less useful than a smaller set of relevant requirements, test records, configuration details, and known limitations.

Quality should identify which supplied evidence can support the intended use, which configuration and interface work needs buyer assessment, and who reviews release changes. Do not assume a vendor's testing removes all customer responsibilities, or that every deployment needs an identical IQ/OQ/PQ package.

IT should review actual hosting and security scope: data flows, subprocessors, account boundaries, recovery evidence, and incident responsibilities. When using a SOC report, examine its period, covered system, exceptions, and customer responsibilities. Neither a logo nor cloud hosting establishes suitability; on-premises deployment is not automatically a negative score.

Regulatory Operations should verify the difficult handoffs: an external reviewer loses access, a document changes after review, imported history has a missing dependency, or the relationship ends. Record the expected result before the exercise and retain the actual output afterward. Detailed publishing-history work belongs in the eCTD lifecycle guide, rather than being reduced to a generic “export supported” answer.

References can clarify implementation effort and escalation behavior, but a favorable inspection anecdote cannot validate your deployment. Ask what scope and version the reference used, what work their own team performed, and which limitations remain.

Adapt the purchase without weakening its gates

A small biotech can give greater preference weight to internal workload and deployment effort. A CRO may treat separation between client organizations and end-of-contract handback as mandatory. An enterprise may require particular interfaces and change-control arrangements before scoring scalability. Make those changes in the requirement record first; company size alone does not determine regulatory applicability.

The same standard applies to this publisher. Assyro publishes this framework. As of September 14, 2026, Assyro does not support eCTD v3.2.2, so it cannot satisfy VS-01's mandatory publishing requirement. A different authoring or review purchase needs its own scoped evaluation; editorial preference cannot establish that its requirements pass.

Finish with a decision record: selected candidate, approved scope, gate evidence, score and sensitivity, agreed budget, unresolved non-gating conditions, owners, and signoffs. In VS-01, the defensible outcome is to carry A and B into final commercial review, resolve whether B's workflow advantage justifies its premium, keep C pending, and exclude D. The one-point score difference does not settle the investment decision.

Put negotiated obligations into the contract and implementation acceptance plan: deliverables, evidence access, support coverage, change notification, migration reconciliation, and usable export on exit. Vendor selection authorizes a purchase decision; it does not by itself authorize production use. Copy the records above, replace the fictional inputs with your own evidence, and close every applicable mandatory gate before approving the selection.