An Approved Supplier List (ASL) is the documented foundation of a regulated purchasing controls program. Under FDA QMSR (21 CFR Part 820) and ISO 13485, manufacturers must evaluate and select suppliers based on their ability to meet specified requirements before those suppliers are used. The ASL records which suppliers have been qualified, for which materials or services, and at what qualification tier. A supplier not on the ASL cannot supply regulated materials without going through a qualification process first. An outdated or poorly maintained ASL creates the same compliance risk as having no list at all.

What is an Approved Supplier List?

An Approved Supplier List is a controlled quality document that identifies every external supplier authorized to provide materials, components, or services used in the design, manufacture, or testing of regulated products. Each entry on the list specifies the supplier, what they are approved to supply, and the scope and basis of their approval.

The ASL answers the question that auditors always ask: how does your quality system prevent unapproved suppliers from entering your supply chain? The answer is the ASL, combined with the purchasing procedure that requires confirmation of ASL status before a purchase order is issued.

Supplier quality management encompasses the ASL and everything connected to it: the initial qualification process, supplier audits, performance monitoring, and requalification decisions. The ASL is the output of all that work, expressed as an approved status in a controlled document.

Why the ASL matters for regulatory compliance

FDA’s QMSR Section 820.50 requires manufacturers to establish and maintain documented procedures for evaluating and selecting suppliers, contractors, and consultants based on their ability to meet specified requirements. The results of evaluations and any follow-up actions must be recorded. The ASL is the primary record of these evaluations.

ISO 13485 Section 7.4.1 has nearly identical language. The standard requires that the type and extent of control applied to the supplier be based on the effect of the purchased product or service on the subsequent realization of product and on the output of those processes. In practice, this means suppliers of critical materials require more intensive qualification and monitoring than suppliers of low-risk commodities.

FDA Form 483 observations and warning letters consistently cite manufacturers for purchasing from unapproved suppliers, for failing to maintain current supplier evaluations, and for having ASLs that do not reflect the actual supply chain in use. These citations often arise not from deliberate violations but from informal purchasing decisions that bypass the quality system.

Step 1: Define the scope of your ASL

Before building the list, the quality team must define which suppliers are within the scope of the ASL. Not every vendor a company buys from needs to be on the ASL. The scope should include:

• Suppliers of raw materials and components that become part of the finished product
• Suppliers of critical packaging materials (primary packaging, device packaging)
• Suppliers of materials used directly in manufacturing (processing chemicals, cleaning agents)
• Contract manufacturers and contract testing laboratories
• Suppliers of calibration services for equipment used in manufacturing or testing
• Suppliers of services that have a direct impact on product quality (sterilization, warehousing of finished goods)

General business vendors, office supplies, IT services, and other non-quality-impacting suppliers are typically not included in the ASL scope. The procedure must define the scope explicitly so purchasing decisions are based on a consistent determination of which suppliers require qualification.

Step 2: Classify suppliers by risk tier

A tiered supplier classification system matches the intensity of qualification and monitoring to the risk that each supplier’s materials or services present to product quality. Most regulated manufacturers use a three-tier system:

Tier 1 (Critical suppliers): Suppliers of materials or services that have a direct and significant impact on product safety, efficacy, or regulatory compliance. Examples: API suppliers, contract sterilization services, primary packaging suppliers, contract testing laboratories performing release testing. Tier 1 suppliers require the most extensive initial qualification, including on-site audits, and the most frequent ongoing monitoring.

Tier 2 (Major suppliers): Suppliers of materials with a defined but indirect quality impact. Examples: secondary packaging suppliers, non-critical components, calibration service providers. Tier 2 qualification typically includes a supplier questionnaire, a review of quality system certifications, and periodic performance review without mandatory on-site audits.

Tier 3 (Standard suppliers): Suppliers of low-risk materials or services with minimal direct quality impact. Examples: laboratory reagents for non-critical tests, indirect process materials. Tier 3 qualification may consist of reviewing supplier quality certifications and conducting incoming inspection to specification, without formal audit requirements.

The tiering criteria must be written into the supplier qualification procedure and applied consistently. Auditors will compare how the company has tiered its suppliers against the actual risk profile of the materials supplied.

Step 3: Conduct initial supplier qualification

Initial qualification is the process of evaluating a new supplier before their first purchase order is placed. The qualification activities and documentation required depend on the supplier’s risk tier.

For Tier 1 suppliers, initial qualification typically includes:

• Completion of a supplier questionnaire covering quality system, regulatory compliance, manufacturing capabilities, and previous audit history
• Review of the supplier’s quality management system certificate (ISO 9001, ISO 13485, or equivalent)
• An on-site supplier audit conducted by qualified personnel from the manufacturer’s quality team
• Review and approval of the supplier’s specifications, test methods, and certificates of analysis format
• Evaluation of first-article samples or first-lot inspection data against specification
• A formal qualification decision documented in the supplier qualification file

For Tier 2 suppliers, on-site audits may be replaced by a documented desk review, but the decision to waive an audit must be justified in the qualification record. For Tier 3 suppliers, a review of quality certifications and confirmed ability to meet specifications may be sufficient.

Every initial qualification generates a qualification record tied to the specific supplier and the specific materials or services they are approved to supply. The qualification record is the basis for the ASL entry.

Step 4: Document the ASL correctly

The ASL is a controlled document, subject to the same document control procedures as SOPs, specifications, and other quality records. The document must have a version number, approval signatures, and an effective date. Changes to the list, adding new suppliers, removing disqualified ones, or changing approval scope, require a documented change record.

A complete ASL entry for each supplier includes:

• Supplier name and primary contact information
• Supplier location (facility address for the approved manufacturing or testing site)
• Materials or services approved for purchase from this supplier
• Risk tier classification
• Qualification basis (date of qualification, type of qualification conducted)
• Quality system certification status and expiry date
• Date of most recent supplier audit (if applicable)
• Current performance status (active, conditional, probationary, disqualified)
• Next scheduled review or audit date

The approved scope on the ASL must be specific. Approving a supplier “for all raw materials” is not acceptable for regulatory purposes. Each material or category of materials must be specifically enumerated. A supplier approved to provide excipient grade lactose is not automatically approved to provide API-grade materials without a separate qualification for that application.

Step 5: Maintain the ASL through supplier monitoring

An ASL that is not maintained is not a functioning quality control. Supplier status on the list must be reviewed regularly and updated when performance data, audit findings, or changes at the supplier’s facility affect their qualification status.

Regular maintenance activities include:

Annual performance reviews. Each Tier 1 and Tier 2 supplier should receive a documented annual performance review that summarizes their nonconformance rate, on-time delivery, complaint history, and SCAR closure record for the review period. The outcome of the review confirms, modifies, or removes their approved status.

Periodic requalification audits. Tier 1 suppliers typically require an on-site audit every one to three years, depending on their criticality and performance history. The audit schedule must be documented and executed.

Notification of supplier changes. Qualified suppliers in regulated industries are required to notify their customers of significant changes to their processes, materials, or facilities that may affect the quality of supplied goods. The ASL procedure should include a mechanism for receiving and reviewing supplier change notifications and triggering requalification when needed.

Monitoring of certificate of analysis trends. Incoming CoA data over multiple lots can reveal gradual drift in supplier processes before a lot actually fails incoming inspection. Quality teams that track CoA values over time catch supplier process problems earlier than those that review each lot in isolation.

Handling supplier changes: adding, modifying, and removing entries

Adding a new supplier to the ASL requires completing the initial qualification process and creating a qualification record before the ASL entry is created. Shortcutting this process, such as placing a purchase order and then retroactively qualifying the supplier, is a recurring FDA citation.

Modifying a supplier’s approved scope, for example, expanding an existing approved supplier to cover additional materials, requires a supplemental qualification assessment for the new materials. The existing qualification for other materials does not automatically transfer.

Removing a supplier from the ASL happens when a supplier fails requalification, fails to respond adequately to a supplier corrective action request, or the company decides to stop using them for other reasons. Disqualification must be documented with the reason for disqualification. If the supplier has materials currently in incoming inventory or in process, the quality team must decide how to handle those lots. Simply removing the supplier from the list without addressing outstanding inventory creates a gap in the quality record.

The connection between the ASL and purchasing procedures

The ASL is only as effective as the purchasing procedure that enforces it. The purchasing procedure must require that every purchase order for a regulated material or service is checked against the ASL before the order is placed. This means the purchasing team, not just quality, needs to understand the ASL requirement and have access to current ASL status for every supplier they use.

In a paper-based or spreadsheet-driven system, this enforcement is difficult. Purchasing teams work quickly, and checking a separate controlled document before every purchase order requires discipline and is often skipped under time pressure. An integrated QMS that surfaces ASL status at the point of purchase order creation removes the manual check requirement and makes compliance the default behavior.

How Cloudtheapp manages the Approved Supplier List

Cloudtheapp’s supplier quality module maintains the ASL as a live, controlled record within the QMS. Each supplier has a profile that records their qualification status, approved materials, audit history, performance metrics, and certification expiry dates. The ASL status updates automatically when a qualification record is closed or when a SCAR drives a status change.

When a purchase request is created in the system, the supplier’s current ASL status is visible to the purchasing team in real time. If a supplier is not on the ASL for the requested material, the system flags the request before it reaches the purchase order stage. This prevents the informal workarounds that generate FDA citations.

Supplier performance data from incoming inspection records feeds directly into the supplier’s profile, giving the quality team a rolling view of each supplier’s nonconformance rate without manual data compilation. Annual performance reviews are generated from this data rather than built from scratch.

For companies managing dozens of Tier 1 suppliers with audit schedules, certification expiry dates, and SCAR follow-up timelines, a spreadsheet-based ASL quickly becomes unmanageable. Cloudtheapp brings all of that into a single controlled system with automated reminders for upcoming audits and certification renewals. See how the supplier qualification module works at cloudtheapp.com/demo.

Conclusion

An Approved Supplier List is not a document that gets built once and filed. It is a living record that reflects the current state of a company’s qualified supply chain. Building it correctly means defining scope, classifying suppliers by risk, conducting appropriately intensive initial qualification, and documenting the approval basis for each supplier entry. Maintaining it correctly means conducting periodic reviews, tracking performance data, and keeping the list current when suppliers change or are disqualified. The companies that handle this well treat the ASL as a quality control, not an administrative task.

This post created by and appeared first on Cloudtheapp