E-Procurement for the Pharmaceutical Industry: ISO 27001 and Audit Requirements

In regulated industries, the selection of a procurement platform rarely comes down to the range of features, but rather to supplier approval. IT security requires certifications, while quality assurance demands traceability—and the two mean different things. This article distinguishes between these two requirements and provides you with a checklist to reliably evaluate any provider.

For the pharmaceutical, chemical, and medical technology industries, e-procurement systems that provide two types of evidence separately are suitable: information security on the provider’s end—i.e., ISO 27001 or equivalent plus a data processing agreement—and auditability within the system—i.e., a complete audit trail, role-based access rights, and SSO. If either is missing, approval fails.

The most important points at a glance:

• The provider’s certification and the system’s auditability are two separate assessments with two different parties responsible.
• An ISO 27001 certificate means little unless you have read its scope.
• For indirect needs, the key requirement is usually not GxP compliance, but rather access control and traceability.
• The key factor is whether audit trails are retained even when a user leaves the company.
• Request proof in the form of documentation, not just a statement made during a sales pitch.

Anyone looking to implement a procurement platform in a pharmaceutical or medical technology company knows the process: Purchasing is convinced, then comes supplier qualification, and suddenly an 80-item questionnaire is on the table. We regularly monitor these evaluations and consistently see the same mistake—on both sides. Below, we’ll show you which requirements are truly essential, which ones you can do without, and what you should request in writing from a provider.

Two types of documentation that are constantly confused in requests for proposals

The most common cause of failed approvals is a confusion: the vendor’s security level is equated with the system’s auditability. Both must be met, but they are different assessments.

Definition: An Information Security Management System (ISMS) in accordance with ISO/IEC 27001 is a documented process through which an organization systematically manages risks to the confidentiality, integrity, and availability of information. The current version is ISO/IEC 27001:2022.

A provider may operate an excellent ISMS and still deliver a system whose logging is insufficient for your internal audit. Conversely, even the best audit trail is of no use if the GDPR-compliant data processing agreement is missing. Review both aspects separately and with separate points of contact.

What an ISO 27001 certificate actually indicates—and what it does not

The certificate alone is not the answer. What matters is the scope specified in the certificate.

A company may be certified to ISO 27001 for data center operations, but not for software development. Or for its Munich location, but not for the service provider handling support. Therefore, when requesting the certificate, always ask for the full scope—not just confirmation that one exists.

Tip: Request the ISO 27001 certificate—including its scope and date of issuance—from every e-procurement provider. A certificate whose scope does not cover the platform in use has no value for your supplier approval process.

Also pay attention to the wording. “Certified to ISO 27001” means that an accredited body has conducted an audit. “Aligned with ISO 27001” or “operated according to ISO 27001 principles” means that the company applies the requirements without seeking certification. This may be sufficient for your review—but you must be aware of it and be able to justify it internally.

The absence of certification is not an automatic disqualification. Many companies demonstrate their security level through their corporate structure, technical evidence, and a completed security questionnaire. What matters is that the information is reliable and in writing.

The system requirements that are actually assessed in every audit

When an auditor examines indirect procurement, they do not check the software itself, but rather the traceability. Five questions practically always come up.

This last point is often underestimated. Many systems delete a user’s history along with their account—and this is precisely where audits fail, because orders from the previous year can no longer be traced back to a specific person.

Does GxP even apply to indirect needs?

In most cases, no—and you should clarify this question early on, as it determines the scope of the project.

Computer-based systems that process GxP-relevant data are subject to validation requirements, such as those outlined in EU GMP Annex 11. A system for office supplies, occupational safety, MRO needs, and C-parts generally does not affect product quality and therefore does not fall within this scope. The situation is different as soon as you procure primary packaging materials, cleanroom consumables, or quality-relevant test equipment via the same platform.

Tip: Specify in writing in the requirements specification which product groups are to be procured via the e-procurement system and which are expressly excluded. This distinction determines whether computer system validation is required—and thus accounts for a significant portion of the project budget.

This classification does not replace an assessment by your quality assurance department. However, it helps you initiate a discussion with QA before the project is launched, rather than after.

How Simple System Meets These Requirements

Here, we describe what can be verified—and where you should ask for clarification.

Regarding the vendor: simple system is part of Hoffmann SE and is therefore integrated into the compliance structures of an international corporation, including a Code of Conduct, Supplier Code, and an anonymous whistleblower system. You can find details on these specific regulations on our corporate compliance page. For the current status of information security certification, please request the latest information directly—we’ll provide it along with its scope.

At the system level: Authentication is handled via Single Sign-On via SAML 2.0. simple system does not store passwords for SSO users; multi-factor authentication is centrally managed through your identity provider, and the integration works with Azure AD, Okta, Google Workspace, Ping Identity, and Keycloak. If a user is deactivated in the directory service, access is immediately blocked—while that user’s order data and audit trail files are retained. This is precisely the combination that auditors request.

All login attempts—both successful and failed—are logged, including the user, timestamp, and identity provider details. The logs can be exported to your SIEM.

Regarding rules and approvals: Budget limits, approval hierarchies, and supplier- and product-group-specific ordering rights are defined as system rules. Any purchase order that violates these rules is blocked—regardless of who initiates it. We’ll cover how to implement approval workflows in procurement without slowing down the process in a separate section.

The use case on audit security during contract award: A health tech company had to demonstrate to an auditor who had accessed which data and when, and whether the account of a former employee had in fact been immediately locked.

Questionnaire for Vendor Evaluation

These nine questions cover both levels of review. Request written answers before entering into detailed negotiations.

1. Certification: Does the provider hold an ISO 27001 certificate, and what is its scope?
2. Data Processing: Is there a data processing agreement in accordance with the GDPR, and which subcontractors are listed?
3. Server Location: Where is the data stored and processed?
4. Audit Trail: Are orders, changes, and approvals logged individually with user and timestamps?
5. Retention: Are logs and order data retained after a user is deactivated, and for how long?
6. Authentication: Is SSO supported via SAML 2.0, and can multi-factor authentication be enforced?
7. Offboarding: Does deactivation in the directory service immediately block access?
8. Export: Can logs be transferred to a SIEM or log management system?
9. Scope: Which product categories are processed through the system, and is validation required?

If a provider answers more than two of these questions only verbally, the result is not usable for your approval.

Conclusion: Evaluate two levels, not just a certificate

In the pharmaceutical, chemical, and medical technology industries, it is not the scope of functionality that determines implementation, but rather approval. Those who separate vendor verification from system verification from the outset and ensure both levels are documented in writing can shorten the process from months to weeks.

→ 15-minute appointment: Compare requirements against your compliance guidelines
You describe your evaluation criteria, and we’ll tell you openly which ones we meet and which ones we don’t.

FAQ – Frequently Asked Questions About E-Procurement in Regulated Industries