What supplier compliance means
Supplier compliance means a supplier meets the requirements you have set for it: your specifications, your quality agreement and the regulations that apply to the material or service. In regulated manufacturing, the burden of proof sits with you, the buyer. Inspectors will ask how you know your suppliers are compliant, and the answer has to be in documents.
A supplier quality assessment is the periodic check of that evidence. It is lighter than an audit and more frequent.
Which documents to review
| Document | What to check | Common problems |
|---|---|---|
| Certificate of analysis (CoA) | Matches your specification; issued by the actual manufacturer; lot number, test methods, results, signatures | CoA from a distributor, not the manufacturer; results that match spec limits suspiciously exactly; missing tests |
| GMP / ISO certificates | Valid dates; scope covers the site and products you buy | Expired certificates; scope that excludes your material |
| Quality agreement | Current version signed; terms match practice | Outdated agreement; change notification terms ignored |
| Questionnaire | Answers consistent with certificates and audits | Site or subcontractor information that conflicts with other documents |
| Change notifications | Received, assessed and closed | Changes discovered by accident |
| Audit reports and responses | Findings closed with evidence | Open findings past due |
| Regulatory status | No new warning letters, import alerts or GMP non-compliance | Regulatory action not noticed |
| Specification and drawings (devices) | Current revision on both sides | Supplier working to an old revision |
| TSE/BSE, allergen, residual solvent, elemental impurity and similar statements | Present and current where required | Statements older than the current process |
Verifying certificates of analysis
CoAs deserve special attention because regulators keep finding problems with them.
Under 21 CFR 211.84(d)(2), a US drug manufacturer may accept a supplier’s report of analysis instead of full testing only if it conducts at least one specific identity test on each component and establishes the reliability of the supplier’s analyses through validation at appropriate intervals. In its September 1, 2026 warning letter to Happy Farm Botanicals, FDA required “a commitment to always conduct at least one specific identity test for each incoming component lot” and a summary of testing that evaluates each manufacturer’s CoA reliability.
FDA’s 2023 guidance on diethylene glycol and ethylene glycol in high-risk components highlighted another problem: the CoA “was often a copy of a COA on the letterhead of the distributor.” Supplier document review should confirm that the CoA traces to the actual manufacturer.
A practical CoA verification routine:
- Confirm the CoA comes from the manufacturer, or that the manufacturer’s original CoA is attached.
- Check every specification item is reported, with method references.
- Compare results with your own identity (and periodic full) test results.
- Trend differences between CoA and in-house results by supplier.
- Re-evaluate CoA reliance when discrepancies appear.
How often to review
| Document type | Typical review trigger |
|---|---|
| CoA | Every lot |
| Certificates | Before expiry; on renewal |
| Quality agreement | Every 2–3 years or on change |
| Regulatory status | Continuous monitoring or at least quarterly for critical suppliers |
| Full supplier quality assessment | Annually for critical suppliers; at requalification for others |
The EU view: ongoing review of excipient suppliers
The EU’s 2015 guidelines on formalized risk assessment for excipients require ongoing review after the initial assessment, using “defect tracking, trend analysis, audits and questionnaires,” and say the control strategy should be “reviewed and revised if needed” (section 4.1). That is a good model for any supplier compliance program: a cycle, not a one-time check.
Common weaknesses
- Supplier files with expired certificates that nobody flagged
- CoAs accepted from distributors without the manufacturer’s original
- Quality agreements signed years ago and never reviewed
- Questionnaire answers that conflict with audit findings
- No trending of CoA versus in-house results
- Regulatory actions against suppliers discovered months late
Supplier compliance checklist
- Document requirements defined per supplier tier
- CoAs traced to the actual manufacturer
- Identity test on each lot; periodic full testing to validate CoAs
- CoA versus in-house results trended
- Certificate expiry dates tracked
- Quality agreements current and checked against practice
- Change notifications assessed and closed
- Regulatory status of critical suppliers monitored
- Periodic supplier quality assessment completed and recorded
Review supplier documents with AskDona
Supplier document review is detailed, repetitive work across many file types. AskDona reads CoAs, certificates, quality agreements, questionnaires and audit reports together and flags expired documents, inconsistent site or product information, missing tests and CoA values that conflict with your specifications, each linked to the page it came from. Run a sample supplier document review on one supplier’s file. AskDona shows the evidence; your supplier quality team decides.
FAQ
What is supplier compliance? A supplier’s adherence to the specifications, quality agreement terms and regulations that apply to what it supplies, demonstrated through documents and audits.
What is a supplier quality assessment? A periodic review of a supplier’s quality evidence, such as certificates, CoAs, performance data and audit status, to confirm it remains compliant.
What documents should be in a supplier file? Qualification records, certificates, quality agreement, questionnaire, CoAs, audit reports and responses, change notifications and regulatory status checks.
Can I accept a distributor’s CoA? Only if it traces to the actual manufacturer. FDA has warned that distributor CoAs have sometimes been copies on the distributor’s letterhead.
How do I validate a supplier’s CoA? Test initial lots fully, then at defined intervals, and compare with the CoA. Keep identity testing on every lot.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| 21 CFR Part 211 (eCFR) | US regulation | 211.84(d) |
| FDA warning letter, Happy Farm Botanicals (Sept 1, 2026) | FDA warning letter | CoA reliance requirements |
| FDA, Testing of Glycerin, Propylene Glycol, Sorbitol Solution and Other High-Risk Drug Components for DEG and EG (May 2023) | FDA guidance | Distributor CoAs |
| EU Guidelines on formalised risk assessment for excipients (2015/C 95/02) | EU guideline (Official Journal) | Ongoing review |
| ICH Q10 (FDA) | ICH guideline | Section 2.7 |