Building a supplier qualification program from scratch is a substantial undertaking, but it does not need to be paralyzingly complex. This article walks through the regulatory requirements, the practical steps for qualifying suppliers at different risk levels, and how to maintain oversight after initial qualification is complete.

What FDA and ISO 13485 require from a supplier qualification program

Both FDA QMSR (21 CFR Part 820) and ISO 13485:2016 require that regulated companies control the quality of externally provided products and services. The specific requirements include:

• A documented procedure for evaluating and selecting suppliers based on their ability to meet your requirements
• Defined criteria for supplier selection and re-evaluation
• Records of evaluation results and any actions arising from evaluations
• An approved supplier list (or equivalent controlled document) that restricts purchasing to qualified sources
• Incoming inspection or other verification activities to confirm that purchased product meets specifications
• Controls proportionate to the risk the supplier and their product presents to your finished device or drug product

Neither regulation tells you exactly how to qualify a supplier — they specify what the outcome must achieve: confidence that the supplier can consistently provide conforming product. Your procedure determines how you get there.

Step 1: Classify your suppliers by risk

Not every supplier requires the same depth of qualification. A risk-based approach — formally required by both FDA QMSR and ISO 13485 — allows you to focus qualification resources where quality failures would have the greatest impact on patient safety and product quality.

A practical three-tier classification system:

Critical suppliers (Tier 1)

Suppliers providing materials, components, or services whose failure would directly cause product failure or patient harm, with no downstream detection step. Examples: active pharmaceutical ingredients (APIs), sterile packaging components, critical electronic assemblies in life-sustaining devices, contract sterilization services. These suppliers receive full qualification including documentation review, on-site audit, and ongoing performance monitoring.

Major suppliers (Tier 2)

Suppliers providing materials or components that affect product performance but are subject to incoming inspection or in-process testing that could catch non-conformances before product release. Examples: excipients, non-critical components, contract testing laboratories. Qualification typically includes documentation review and questionnaire, with on-site audit triggered by poor performance or elevated risk factors.

Standard suppliers (Tier 3)

Suppliers providing off-the-shelf materials, maintenance services, or administrative services with minimal direct impact on product quality. Examples: cleaning supplies, calibration services for non-critical instruments, office consumables. Qualification may consist of a basic assessment and approved vendor registration with periodic review.

Document your classification criteria in your supplier qualification procedure. Every supplier on your list should be classified and the classification rationale documented, so an auditor reviewing your program can see how the risk decisions were made.

Step 2: Define your qualification requirements by tier

Once classification is established, define exactly what each tier requires to achieve qualified status. This becomes the checklist your quality team works from when adding a new supplier.

For Tier 1 (critical) suppliers, a complete qualification package typically includes:

• Completed supplier questionnaire covering quality system, manufacturing process, regulatory certifications, and change control practices
• Review of relevant quality certificates — ISO 9001, ISO 13485, GMP certification, or equivalent
• Review of product specifications and certificates of analysis for the material or component you will purchase
• On-site audit of the supplier’s quality system and manufacturing process
• Evaluation of a qualification batch or first article inspection results
• Signed quality agreement defining responsibilities, change notification requirements, and right-to-audit provisions
• Approval decision documented with the qualification findings and approved by the quality manager

For Tier 2 and Tier 3, elements can be reduced proportionately to the risk, as documented in your procedure. The key is that the reduction is intentional and documented — not just that you skipped steps because no one got around to them.

Step 3: Build your supplier questionnaire

The supplier questionnaire is the primary tool for evaluating a supplier you have not visited. A well-designed questionnaire gives you enough information to assess whether a full on-site audit is warranted, and whether the supplier’s quality system is likely to be compatible with your requirements.

Core areas to cover in a supplier questionnaire:

• Quality management system — What standard do they operate to? Are they certified? When was their last external audit and what were the findings?
• Regulatory history — Have they received any FDA warning letters, 483 observations, or equivalent regulatory actions in the past three years?
• Process controls — How do they control the manufacturing process that produces the material or component you are purchasing?
• Change control — What is their process for notifying customers of changes to materials, specifications, manufacturing processes, or facilities?
• Non-conformance handling — How do they handle non-conforming material? What is their process for investigating customer complaints?
• Sub-supplier controls — Do they use sub-suppliers for any part of the process? What controls do they apply?
• Document control — How do they control the specifications and procedures that govern your product?

The questionnaire response becomes a qualification record. Inconsistent or incomplete responses should trigger follow-up requests or escalation to an on-site audit. A supplier who cannot clearly describe their quality system is itself a risk signal.

Step 4: Conduct supplier audits for critical suppliers

On-site supplier audits are the highest-confidence qualification method for critical suppliers. An audit lets you observe the actual manufacturing process, examine quality records, speak with personnel, and identify gaps that questionnaire responses can obscure.

Supplier audit planning should include:

• A defined audit scope — what processes, facilities, and quality system elements you will review
• An audit inspection plan or agenda shared with the supplier in advance
• An audit team with the appropriate technical expertise to evaluate the specific manufacturing process
• A documented audit report recording observations, findings, and conclusions
• A corrective action request process for any audit findings that must be resolved before the supplier can be approved

Audit findings that are not resolved before qualification approval represent an accepted risk that should be documented, time-limited, and tracked through your Supplier Quality Management system to ensure they are eventually closed.

Step 5: Establish your approved supplier list

The approved supplier list (ASL) is the controlled document that restricts your purchasing function to qualified suppliers. It should include for each supplier: the supplier name, address, and contact information; the materials or services they are approved to supply; the tier classification; the date of initial qualification; the date of most recent re-evaluation; and the approval status.

The ASL must be controlled under your document control procedure — versioned, approved, and distributed only in its current form. Purchasing should only be authorized to place orders with suppliers on the current-version ASL. This link between the ASL and your purchasing controls is what gives the approved supplier list regulatory meaning. An ASL that purchasing ignores is a documentation exercise, not a quality control.

Step 6: Define incoming inspection requirements

Supplier qualification reduces the probability of receiving non-conforming material; it does not eliminate it. Incoming inspection provides the verification layer that catches non-conformances before they enter your production process or inventory.

Your incoming inspection procedure should define, for each material or component type, the inspection method, the sampling plan, and the acceptance criteria. For critical materials, incoming inspection may include dimensional verification, certificate of analysis review, identity testing, or other verification appropriate to the material and risk level.

For qualified suppliers with a demonstrated track record of consistent quality, your procedure may allow reduced incoming inspection — fewer samples, visual inspection only, or skip-lot plans — based on supplier performance data. This reduction should be documented and subject to re-evaluation if the supplier’s performance changes.

Every incoming inspection result — whether pass or fail — must be recorded. Non-conforming materials must be segregated, identified, and processed through your non-conforming material procedure before any disposition decision is made.

Step 7: Set up ongoing supplier monitoring

Initial qualification establishes that a supplier could meet your requirements at the time of evaluation. Ongoing monitoring confirms they continue to do so.

A practical ongoing monitoring program includes:

• Supplier scorecards tracking delivery performance, incoming inspection reject rates, complaint-related escapes, and responsiveness to quality issues
• Periodic re-evaluation — annual for Tier 1 critical suppliers, less frequent for lower-tier suppliers based on risk and performance
• Change notification review — when a supplier notifies you of a change to their material, process, or facility, evaluate the change against your qualification criteria and determine whether re-qualification activities are required
• Escalation triggers — defined thresholds at which a supplier’s performance automatically triggers a corrective action request, increased incoming inspection, or formal re-audit
• Annual review in your management review process — supplier quality performance should be a standing agenda item, not an afterthought

The escalation trigger mechanism is important because it removes subjectivity from the decision to intervene with a poor-performing supplier. If your procedure says three consecutive incoming inspection failures trigger a corrective action request, the action is required regardless of how much your operations team values that supplier’s delivery performance.

Quality agreements with critical suppliers

A quality agreement is a formal contract between your company and a supplier that defines quality responsibilities, documentation requirements, change notification obligations, and right-to-audit provisions. For critical suppliers, particularly contract manufacturers, contract testing laboratories, and sterilization providers, quality agreements are required under FDA QMSR and expected under ISO 13485.

A quality agreement should cover:

• Which party is responsible for each quality activity (testing, record retention, deviation management)
• The supplier’s obligation to notify you before making changes to materials, processes, or facilities that could affect your product
• Your right to audit the supplier’s facility with defined advance notice requirements
• How non-conformances and customer complaints that trace to the supplier’s product will be handled
• Record retention periods and your right to access supplier records during audits or regulatory inspections

The quality agreement supplements — it does not replace — your purchase orders and technical specifications. All three documents should reference each other and be controlled as a set.

Common mistakes when building a supplier qualification program

Several patterns appear repeatedly in companies building their first supplier qualification program:

Qualifying suppliers retroactively without documentation. If you have been purchasing from a supplier for two years and now need to formalize their qualification, the qualification records need to reflect the actual evaluation done, not a fictional first-article inspection that never occurred. Retroactive qualification requires documenting what was actually done to evaluate the supplier and completing any gaps through current evaluation activities.

Treating qualification as approval without ongoing oversight. Some companies build rigorous initial qualification processes but have no mechanism to catch supplier deterioration over time. A supplier that was excellent at qualification three years ago may have changed ownership, processes, or key personnel since then — without ongoing monitoring, you would not know until a quality escape reached your production floor.

Building an ASL that purchasing does not use. If your procurement team places orders outside the ASL — for faster delivery, better price, or because the ASL approval takes too long — the program has no actual quality control function. The ASL controls must be embedded in your purchasing process, not parallel to it.

Under-resourcing the audit function. On-site supplier audits for critical suppliers require qualified auditors with relevant technical knowledge. Companies that rely on their quality manager to conduct all supplier audits often find that audits slip because the quality manager is needed for other things. Build a realistic audit schedule that matches your available auditor capacity, and use contract auditors for gaps in technical expertise.

How Cloudtheapp supports supplier qualification programs

Cloudtheapp’s Supplier Quality Management application manages the complete supplier qualification lifecycle — from initial questionnaire and qualification documentation through approved supplier list maintenance, incoming inspection records, corrective action requests, and supplier performance scorecards — in a single validated platform.

Suppliers can be tiered directly in the system with qualification checklists that mirror your procedure requirements. The platform generates qualification tasks, routes approvals, and stores all qualification documentation with a complete audit trail. The approved supplier list is version-controlled and connected to purchasing controls, so any attempt to purchase from an unapproved supplier is flagged before the order is placed.

Supplier scorecards pull data from incoming inspection records, deviation reports, and corrective action requests automatically, giving you a current performance picture without manual data aggregation. Re-evaluation triggers are configurable based on your procedure’s escalation criteria.

With 60+ applications covering the complete quality management system, Cloudtheapp connects your supplier qualification program to your incoming inspection process, CAPA management, audit scheduling, and management review — so supplier quality data flows through your entire quality system rather than sitting in an isolated supplier management tool.

To see how Cloudtheapp manages supplier qualification from initial evaluation through ongoing monitoring, request a demo.

Summary

A supplier qualification program that satisfies FDA QMSR and ISO 13485 requires documented criteria for supplier selection, risk-based qualification depth, an approved supplier list that controls purchasing, incoming inspection verification, and ongoing performance monitoring. Building this program from scratch takes time, but the structure is straightforward: classify by risk, define what each tier requires, execute qualification activities, maintain the approved list, and monitor performance continuously.

The most common failure modes are not in the initial qualification process — they are in the ongoing oversight. Suppliers that were qualified years ago without subsequent re-evaluation, ASLs that purchasing bypasses, and escalation triggers that exist in the procedure but are never activated are where programs break down under inspection pressure.

A supplier quality management system embedded in your QMS — with automated scorecards, triggered escalations, and full audit trail — removes the manual burden that causes these ongoing oversight failures in paper-based or spreadsheet-managed programs.

This post created by and appeared first on Cloudtheapp