Supplier Qualification: Scope, Evidence and Approval

Supplier qualification is the documented process of evaluating, approving and periodically reassessing a supplier for a defined item or service, source site and intended use. This is an operational definition used across pharmaceutical, supplement, food, device and chemical manufacturing, not a shared legal requirement. It connects evidence about supply capability with a decision about acceptable use, then keeps that decision under review.

Qualification is therefore the broader lifecycle; approval is a scoped decision within it. A supplier audit or supplement supplier CoA verification programme supplies evidence for particular questions, rather than replacing the lifecycle.

These distinctions help readers interpret supplier status: a purchasing account, completed audit or accepted lot answers a narrower question than whether the defined supply scope remains qualified.

A practical approval unit is a defined supplier–item–site–use combination, not the vendor account alone. Start with a proposed scope record linking the commercial supplier, original manufacturer, manufacturing site, item specification and revision, activity supplied, intended use and destination market. This boundary also supports dual-source qualification: an alternative source receives its own assessment rather than inheriting the incumbent’s approval.

Identify a distributor separately from the manufacturer and the locations where processing occurs. Record manufacture, testing, repacking and storage as separate covered activities, naming the responsible entity and site for each. Link evidence to the activity it addresses; evidence about storage does not establish suitability for repacking.

Use a scope matrix to make decisions visible. The following are proposed organisational status labels, not regulatory terminology; each row represents a fully specified combination.

Assign a scope owner to maintain the record, technical reviewers to assess suitability, and an approval authority to decide acceptance and limitations. Keep payment details, tax records and other commercial onboarding information separate from the technical evidence supporting suitability. Record who owns unresolved scope questions before a decision is made.

Capture jurisdiction and product classification as inputs to the regulatory mapping below. Assess applicable duties against those inputs and the supplied activity, rather than assigning identical duties to every vendor serving a regulated manufacturer.

Map the decision before selecting its evidence: accepting analytical results, confirming ingredient identity and verifying hazard control are different questions. The following US regulatory mapping is product-specific; the implementation practices at the end are not additional legal requirements.

Binding regulation: US finished human-drug components

For US finished human-drug components, 21 CFR 211.84(d)(2) permits acceptance of a supplier’s report of analysis instead of the manufacturer testing addressed by that paragraph, provided the manufacturer conducts at least one specific identity test and establishes the reliability of the supplier’s analyses through appropriate validation of test results at appropriate intervals.

In implementation, record analytical reliance as a defined decision: identify the component, the results being relied upon and the supporting validation. Avoid using a general supplier approval status as a substitute for that decision.

Binding regulation: US dietary-supplement decisions

• For US dietary-supplement component CoA reliance, 111.75(a)(2)(ii)(A) requires initial supplier qualification by confirming supplier test or examination results to establish CoA reliability.
• For US dietary-supplement component CoA reliance, 111.75(a)(2)(ii)(B) requires the certificate to include methods, limits and actual results.
• For US dietary-supplement component CoA reliance, 111.75(a)(2)(ii)(C) requires documentation of how the supplier was qualified.
• For US dietary-supplement component CoA reliance, 111.75(a)(2)(ii)(D) requires periodic reconfirmation of the supplier’s CoA.
• For US dietary-supplement component CoA reliance, 111.75(a)(2)(ii)(E) requires quality control personnel to review and approve the documentation supporting supplier qualification and requalification.

Use the separate references on component identity confirmation and the ingredient identity and supplier CoA guide when defining these decisions operationally.

Binding regulation: US human food and medical devices

For US human-food receiving facilities operating an applicable supply-chain program, 21 CFR 117.410(c) requires assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented. Check the current section for scope rather than treating every food vendor as an identical verification case. The 21 CFR 117 reference provides the neighboring framework.

For US medical devices, check the current text of 21 CFR 820.10 for QMSR scope. Use that current framework as the starting point, rather than assigning supplier duties from legacy purchasing-control provisions.

Official guidance and implementation practice

Keep official guidance separately labelled in the approval rationale: distinguish recommendations from binding provisions and from the organisation’s own procedures.

The remaining lifecycle model, chemical-manufacturing examples and non-US applications are implementation practice, not additional jurisdiction-specific legal mappings. Treat a chosen audit, quality agreement or reassessment interval as an organisational control unless an applicable legal basis is identified. Record why that control fits the supplier, item, site and intended use; do not relabel the chosen procedure as a statutory requirement.

The following lifecycle is an implementation pattern, not a universal regulatory sequence. It turns a sourcing request into a documented decision, with responsibility assigned at each stage.

1. Request a defined scope. Identify the supplier, manufacturing or service site, material or service, specification and intended use. Name the requesting function and the decision needed; avoid starting with a request to approve the supplier generally.
2. Assess consequences of failure. Apply supplier risk management to the actual material or service: product quality or safety impact, detectability at receipt, processing complexity, source transparency, intended use and available performance history. Explain which uncertainties matter rather than relying solely on an aggregate score.
3. Specify the evidence plan. Translate each material uncertainty into a question to resolve, suitable evidence, acceptance criteria and a responsible reviewer. For example, uncertainty about source transparency calls for evidence connecting the offered material to its manufacturing site. Track unresolved issues explicitly.
4. Evaluate evidence and gaps. Reviewers document whether each acceptance criterion is met, identify contradictions and explain the significance of missing information. Distinguish gaps that prevent a decision from those that can be managed through defined restrictions.
5. Make an authorised decision. Separate technical evidence review from final approval authority. Example states are pending, approved, restricted and suspended. Record the decision maker, rationale and applicable scope; retain rejected and deferred decisions rather than recording successful approvals alone.
6. Define restrictions precisely. For example, restrict a packaging supplier to the named site and secondary-carton specification, excluding product-contact packaging. Conditions could include enhanced incoming inspection; assign the supplier-quality lead as owner and review the restriction when agreed corrective-action evidence is accepted.
7. Control use and reassess. Maintain the decision against its approved scope and route performance concerns or controlled changes into reassessment. The recovery section addresses reassessment triggers.

Finish with a handoff to purchasing and receiving: communicate the current scope, status, conditions and responsible contact. Transaction mechanics belong in the integration section.

A useful qualification file connects evidence to a defined approval scope rather than accumulating documents. The following is a suggested information model, not a mandated database schema.

• Supplier identity: legal entity, trading names and relationship to the original manufacturer.
• Manufacturing site: identifiable location and the operations performed there.
• Item specification: item identifier, grade and applicable specification revision.
• Qualification scope: linked supplier, site, item, intended use and boundaries of the assessment.
• Evidence: identifiable records linked to the scope and questions they support.
• Approval decision: authorised conclusion linked to its scope and supporting evidence.

For each evidence record, capture the scope supported, document identity and revision, issuing organisation, review date, reviewer, conclusion, limitations and unresolved actions. Possession of a certificate or audit report is not an assessment: record why its coverage is relevant to the actual site, item and intended use, and where coverage stops.

For supplement documentation conditions, refer back to the regulatory mapping; use the supplier CoA verification programme for the related operational detail.

In the decision record, include approval authority, effective status and date, restrictions, linked evidence, rationale and the event or condition prompting the next review. Identify unresolved actions that limit approval rather than leaving their effect implicit.

Preserve superseded decisions and their evidence relationships. Retain the versions used in each assessment so a reviewer can reconstruct the approval basis applicable when a purchase or receipt occurred. An audit trail complements that history; it does not replace the assessment rationale.

As risk-based implementation practice, select assessment methods by the question, process risk and information access—not by assuming every supplier needs an audit. An audit plan should identify what each activity can establish and what remains unresolved.

For US human-food supply-chain programs, 21 CFR 117.410(b)(1)-(3) lists onsite audits, sampling and testing, and review of relevant food-safety records as appropriate verification activities for raw materials and other ingredients.

For components used in US finished human drugs, 21 CFR 211.84(b) requires representative samples of each shipment of each lot for testing or examination.

In assessment practice, check record authenticity, source traceability and revision control. Follow a reported result back to the relevant material, lot, method and underlying record; investigate unexplained inconsistencies rather than averaging them away. Keep evidence of manufacturing controls distinct from evidence about the tested sample.

Document the initial sampling rationale against material variability, the decision being supported and applicable sector rules, rather than adopting a fixed sample count. For each assessment limitation, record the unresolved question, its effect on the proposed approval, the follow-up evidence needed, an owner and a closure criterion. Audit completion alone is not an unconditional pass.

These illustrative decision exercises describe proposed manufacturing practice, not customer results or universal legal outcomes. Each separates the existing approval from the evidence needed for the next decision.

Case A: approval does not travel with a company name

Assume a chemical supplier is approved for citric acid manufactured at its North site for food blending. One request proposes South-site material for food blending; a separate request proposes North-site material for drug formulation. The decision unit is supplier–site–item–intended use. North/citric acid/food blending remains approved; South/citric acid/food blending and North/citric acid/drug formulation remain pending their own scope assessments.

Existing corporate identity and contact records remain relevant if unchanged. The existing specification can serve as a comparison baseline, while North-site performance remains evidence about North. The South-site gap concerns its manufacturing process, contamination controls, traceability and testing capability. The drug-use gap concerns suitability of specifications, impurity controls, analytical evidence and handling for the proposed formulation. Review these questions through change control before extending scope; the food-use assessment does not establish drug suitability.

Case B: the CoA result field is blank

Assume a US dietary-supplement manufacturer is reviewing a non-dietary component through the supplier CoA route, with the other qualification conditions already addressed. The received report identifies a method and limit but leaves the actual result blank. The decision unit is the report supporting that received component lot. For US dietary-supplement components under this route, 21 CFR 111.75(a)(2)(ii)(B) requires the certificate to include actual results, alongside method descriptions and limits. The blank field leaves that condition unmet.

Proposed response: retain the material’s unresolved disposition. Request a corrected report traceable to the received lot and underlying analysis, or arrange an appropriate alternative assessment before deciding disposition. Do not substitute the acceptance limit for the missing result. Supplier status is a separate decision: route recurring report defects through deviation review for supplier reassessment rather than treating correction of this report as closure of a recurring problem.

Case C: the manufacturer has changed

Assume an approved distributor offers the same item designation from a different original manufacturer. The decision unit is distributor–original manufacturer–site–item–use. The changed source relationship, not the unchanged catalogue designation, creates the evidence gap. Keep the proposed source pending; retain the existing combination’s approval. Before adding the source, establish the manufacturer and manufacturing site, review specification equivalence, process and impurity differences, analytical evidence, and traceability through the distributor. Record the exact approved combination only after that review supports the intended use.

A proposed integration pattern is for purchasing, receiving and quality review to use the same supplier–item–manufacturing-site–intended-use identifiers and current qualification decision status. At transaction level, retain the commercial supplier identifier separately from the original manufacturer and manufacturing-site identifiers; a distributor account does not identify the production source.

• Supplier master data connects the commercial account to approved scope records; purchasing carries the selected scope into the order.
• Material master data links the ordered item to its applicable specification revision. Receiving inspection compares the delivered source, lot and documents with that order and scope.
• Laboratory review returns results against the applicable specification to the authorised material-disposition reviewer, preserving the receipt and lot references.
• Deviations connect receipt or testing failures to supplier review and corrective action. Change control routes proposed source, site or specification changes for scope assessment before affected transactions proceed.

Responsibility matrices and, where appropriate, quality agreements can allocate change notification, investigation support and record access. Use them to identify accountable parties and escalation contacts, rather than prescribing an agreement for every supplier.

For missing identifiers, conflicting status records or failed status synchronisation, pause the transaction, apply a receiving quality hold where relevant, and route it to a named quality reviewer. Do not default uncertainty to approval. These proposed system checks support authorised people; they do not make quality-approval or material-disposition decisions.

As implementation practice, combine scheduled review with event-triggered reassessment. Set the review basis according to risk, evidence maturity and observed performance rather than a universal calendar interval. Keep the sector-specific reconfirmation provisions covered above separate from this general oversight schedule.

Typical triggers include a manufacturing-site or process change identified through change control, recurring report discrepancies, an adverse testing trend assessed through out-of-trend handling, or an unresolved investigation. Assess whether the concern affects the approved supplier, item, site or intended use—not merely whether a document needs updating.

For US human-food receiving facilities, when the owner, operator or agent in charge determines that a supplier is not controlling hazards identified by the receiving facility as requiring a supply-chain-applied control, 21 CFR 117.410(e) requires the receiving facility to take and document prompt action.

1. Identify the affected approval scope, receipts and material already used.
2. Restrict further receipt or use where appropriate to the concern.
3. Assign an investigation owner and define the evidence needed for reassessment.
4. Assess corrective evidence against the original concern, using a CAPA effectiveness check where appropriate.
5. Record the authorised outcome: restore approval, retain restrictions, narrow scope or withdraw approval, with reasons and follow-up responsibilities.

This recovery sequence is implementation practice. The supplier's corrective-action submission is an input; the receiving organisation separately assesses whether the relevant concern has been resolved before recording its approval decision.

Use the earlier scope, evidence and recovery sections as the basis for these practical checks. Look for mismatches at operational handoffs, not merely empty fields in the qualification file.

Use exception-based review to prioritize mismatches; record who resolves each discrepancy and who accepts the correction.

Use this checklist as an implementation aid within your quality system, not a certification test or a substitute for applicable product-specific requirements. Review the actual file and its operational handoffs.

• Identify the supplier relationship, actual source and manufacturing site, item, intended use and approval boundary.
• Confirm that the applicable specification revision is unambiguous.
• Check that evidence supports the particular decision, rather than merely documenting supplier activity.
• Make limitations, unresolved actions and their disposition visible.
• Trace the authorised decision to its reviewer, date, rationale and supporting records.
• Confirm that purchasing and receiving can apply the approved scope and restrictions.
• Assign an owner to each restriction; link tracked risks to the quality risk register.
• Record reassessment triggers and their route into change control.

Can another authorised reviewer reconstruct why this supplier was accepted for this particular source, item and use?