A supplier ships nonconforming material. Your incoming inspection catches it. You quarantine the lot, issue a deviation, and contact the supplier — but then what? Without a structured Supplier Corrective Action Request (SCAR) process, the same failure often shows up again in three months.

This guide covers how to build and run a SCAR program that meets FDA and ISO 13485 expectations, drives real supplier improvement, and holds up to audit scrutiny.

What is a Supplier Corrective Action Request (SCAR)?

A Supplier Quality Management (SQM) SCAR is a formal written request issued to a supplier when a quality failure — a nonconformance, out-of-spec delivery, process deviation, or audit finding — requires documented investigation and corrective action on the supplier’s side.

Unlike an informal complaint or phone call, a SCAR creates a documented record: the nature of the failure, what the supplier did to investigate it, what root cause they identified, what actions they took, and how they verified the actions were effective. That record is what FDA investigators and ISO auditors look for when they evaluate your supplier controls.

A SCAR differs from an internal CAPA in that it is directed outward. Your QMS captures the supplier’s response and ties it back to your incoming inspection records, approved supplier list, and risk classification. The two processes are linked — a SCAR can trigger an internal CAPA if the supplier failure affected released product.

When FDA and ISO 13485 Require a SCAR

Neither FDA’s Quality Management System Regulation (QMSR, 21 CFR Part 820) nor ISO 13485 uses the term “SCAR” explicitly. Both, however, require manufacturers to maintain procedures for evaluating and controlling suppliers, monitoring supplier performance, and taking action when suppliers fail to meet requirements.

ISO 13485 Section 7.4 requires organizations to establish and maintain documented procedures for supplier evaluation, selection, and re-evaluation. When a supplier fails to meet purchasing requirements, the organization must take appropriate and proportionate actions — and document them. Section 8.5.2 (Corrective Action) applies equally to supplier-caused nonconformances as it does to internal ones.

Under QMSR, 21 CFR 820.50 requires documented supplier selection criteria and ongoing evaluation. FDA investigators routinely review whether manufacturers actually follow up on supplier nonconformances and whether those follow-ups produce evidence of real improvement.

In practice, a SCAR is the mechanism that satisfies both frameworks. It creates the paper trail that shows your organization identified a supplier failure, required an investigation, received a response, evaluated it, and verified effectiveness.

The 7-Step SCAR Process

Step 1: Identify the trigger

A SCAR is triggered by a specific event. Common triggers include:

• Incoming inspection rejection — material fails dimensional, chemical, or visual checks
• In-process detection — nonconforming material identified after release from receiving
• Customer complaint linked to a supplier component
• Supplier audit finding — a significant finding from an on-site or remote audit
• Out-of-specification (OOS) result traceable to a raw material or component
• Repeat occurrence — the same type of failure from the same supplier within a defined window (commonly 12 months)

Not every supplier nonconformance warrants a SCAR. Minor, isolated issues may be handled through informal communication. Your procedure should define the severity thresholds and repeat-offense criteria that make a SCAR mandatory.

Step 2: Issue the SCAR

The SCAR document — whether paper or electronic — should capture:

• Supplier name, address, and contact
• Part number, lot number, and purchase order reference
• Description of the nonconformance, including measurements or test data
• Applicable specification or acceptance criteria that was violated
• Quantity affected and disposition (return to supplier, scrap, rework)
• Requested response date (30 days is standard; 14 days for critical issues)
• Required sections: containment, root cause, corrective action, preventive action, verification plan

Send the SCAR to the supplier’s designated quality contact, not just a sales rep. In regulated industries, routing a SCAR through commercial channels delays response and creates confusion about who owns the quality record.

Step 3: Require immediate containment

Before root cause analysis begins, the supplier should confirm containment. This means:

• Quarantine of any affected inventory at their facility
• Identification of whether nonconforming product was shipped to other customers
• Interim controls to prevent further shipments of potentially affected material

Your team should confirm containment on your side as well — checking whether affected lots are in your own warehouse, in-process, or in distributed product.

Step 4: Evaluate the root cause investigation

This is where most SCAR programs fail. Suppliers submit a response that says “operator error” or “we will retrain our staff,” and quality teams accept it and close the SCAR. That is not a root cause — it is a symptom. A year later, the same failure reappears.

A credible root cause investigation should:

• Use a structured methodology — 5-Why, fishbone (Ishikawa), or fault tree analysis
• Identify the specific process or system failure, not the person who made the error
• Distinguish between the direct cause, the contributing causes, and the systemic cause
• Include supporting data — measurements, inspection records, process parameters

When you receive a supplier response, ask: if this root cause is real, why did the failure not happen on every part? If they can answer that clearly, the root cause is plausible. If they cannot, send the SCAR back for further investigation.

Step 5: Review and accept the corrective action plan

The supplier’s corrective action must address the root cause, not the symptom. Acceptable corrective actions include process changes, updated inspection procedures, control plan revisions, equipment calibration corrections, and procedure rewrites. Unacceptable responses include “we will be more careful” or “we added a visual check” without any documented change to the process or system.

Review the corrective action for:

• Specificity — what exactly changed, where, and when
• Ownership — who is responsible for implementation
• Evidence — what records will confirm the action was taken
• Timeline — when implementation is complete

If the corrective action requires a process change, confirm whether your supplier agreement or your QMS requires formal notification of Process Change Notifications. Some changes at a supplier site may require your review and approval before implementation.

Step 6: Verify effectiveness

The corrective action is not complete when the supplier says it is complete. It is complete when you have evidence the failure rate dropped. Effectiveness verification options include:

• Enhanced incoming inspection of subsequent lots over a defined period
• Review of the supplier’s internal inspection data from production after the change
• A follow-up audit — either on-site or remote — that reviews the changed process
• Statistical process control data from the supplier showing the process is now in control

Define the verification criteria in advance: what result, over what sample size or time period, constitutes success. Do not let SCARs sit in “effectiveness pending” status indefinitely. Set a maximum verification window, and if the criteria are not met, escalate.

Step 7: Close and document

Closure requires your quality team — not the supplier — to formally close the SCAR in your system. The closure record should reference: the original nonconformance, the root cause accepted, the corrective action implemented, the verification result, and the date of closure. This record becomes part of your audit trail for this supplier.

Update your approved supplier list and supplier scorecard to reflect the SCAR history. A supplier with three unresolved SCARs in 12 months is a different risk profile than one with zero.

Common SCAR mistakes that invite FDA observations

Accepting inadequate root causes

FDA investigators look at whether you accepted a supplier’s root cause analysis or challenged it. When a SCAR says “retraining” and you closed it without verification data, that tells the investigator your SCAR process is procedural theater rather than a quality control tool.

No effectiveness verification

ISO 13485 Section 8.5.2(f) explicitly requires verification that corrective actions did not adversely affect the ability to meet requirements. Effectiveness checks are not optional. A common FDA 483 observation reads: “Firm failed to verify the effectiveness of corrective actions taken for supplier nonconformances.”

SCARs not linked to your internal CAPA system

If a supplier failure resulted in nonconforming product reaching your process or your customers, that is an internal quality event as well. Your CAPA system should capture what your organization did in response — not just what you asked the supplier to do. Missing that linkage is a gap auditors find frequently.

Inconsistent triggering criteria

If your procedure says SCARs are required for all Class 1 and Class 2 rejections but your records show some Class 1 rejections were handled informally, that is a procedure non-compliance. Document your triggering criteria clearly and apply them consistently.

Verbal closure

Closing a SCAR because you “called the supplier and they said it was fixed” does not constitute documented evidence. Closure must be based on objective evidence in your QMS — not phone calls.

How to set SCAR response time requirements

Standard practice in regulated industries distinguishes between severity tiers:

• Critical (potential patient safety impact, risk of product recall): 24-hour containment confirmation, 14-day root cause, 30-day corrective action plan
• Major (significant nonconformance, process failure): 3-day containment, 30-day root cause and corrective action plan
• Minor (isolated occurrence, low risk): 30-day response with root cause and corrective action

Include these response time requirements in your supplier agreements and quality agreements. A supplier who does not know the expected response time is more likely to delay or deprioritize. Build non-response escalation triggers into your procedure — for example, if a supplier does not respond within seven days of a critical SCAR, escalate to supplier re-evaluation or temporary hold on new purchase orders.

Linking SCARs to supplier performance metrics

A SCAR should not exist in isolation from your broader supplier management program. Each SCAR contributes to your supplier scorecard. Track:

• SCAR frequency per supplier per period
• Average response time against required response time
• Rate of accepted versus rejected root cause submissions
• Effectiveness verification pass rate
• Repeat nonconformances after SCAR closure

Suppliers with high SCAR frequency or poor response quality should trigger re-evaluation under your approved supplier list criteria. Some organizations define thresholds: three SCARs in 12 months triggers a supplier audit; five within 24 months triggers re-qualification or disqualification proceedings.

Using your QMS to manage SCARs

Paper-based SCAR workflows have two problems that become critical at scale: you cannot systematically track status across dozens of open SCARs, and you cannot easily demonstrate to an auditor the full history of a supplier’s SCAR performance over time.

A purpose-built Supplier Quality Management module in a modern eQMS handles this automatically. Cloudtheapp’s Supplier Corrective Action Request application lets you issue SCARs directly to suppliers — the supplier receives a notification, completes their investigation and response inside your QMS, and the entire record is captured with timestamps, audit trail, and electronic signatures. No email chains, no disconnected spreadsheets, no version confusion.

When a SCAR triggers an internal CAPA, Cloudtheapp creates the linkage automatically. Auditors can see the full chain: the supplier nonconformance, the SCAR issued, the supplier’s response, your verification record, and the internal corrective action your team took — all in one connected record.

Ready to see how Cloudtheapp handles supplier quality management end to end? Book a demo to walk through the SCAR application with a Cloudtheapp specialist.

SCAR and your approved supplier list

Your approved supplier list is only meaningful if you use SCAR data to inform re-evaluation decisions. ISO 13485 requires periodic re-evaluation of approved suppliers. That re-evaluation should include SCAR history: how many SCARs were issued, how the supplier responded, whether effectiveness was verified, and whether repeat failures occurred.

A supplier who consistently responds quickly, provides credible root cause analyses, and has no repeat failures is a low-risk supplier. A supplier who routinely submits inadequate root causes, misses response deadlines, and shows repeat failures on the same failure mode is a high-risk supplier — regardless of how long they have been on your approved list.

Documenting SCARs for inspection readiness

During an FDA inspection, you may be asked to produce all supplier corrective action requests issued within the past two years, along with evidence that each was resolved. That is a straightforward request if your QMS captures everything. It is a two-day scramble if SCARs live in email folders and shared drives.

Your SCAR records should be retrievable by: supplier name, date range, part number, severity level, and status (open, pending verification, closed). Each record should be complete — from the initial trigger through the closure sign-off — without needing to pull supporting documents from other systems.

If your current QMS cannot produce that report in under five minutes, that is a gap worth addressing before your next inspection.

Summary

A well-run SCAR process does three things: it forces suppliers to investigate failures seriously, it gives your quality team documented evidence of supplier controls, and it creates the data you need to make rational supplier risk decisions over time. The seven steps — trigger, issue, contain, investigate root cause, review corrective action, verify effectiveness, close — are not bureaucratic checkboxes. They are each a specific control point that prevents the same failure from recurring.

The difference between a SCAR program that satisfies auditors and one that actually reduces supplier-related quality failures is whether you challenge inadequate root causes, verify effectiveness with data, and use SCAR history in your supplier re-evaluation. Most programs do the first two inconsistently and skip the third entirely.

Want to see how Cloudtheapp’s 60+ quality and compliance applications connect supplier SCARs, CAPAs, incoming inspection, and your approved supplier list in one platform? Schedule a demo today.

]]>