Why supplier performance is a regulatory topic
In most industries, supplier performance management is a procurement discipline: cost, delivery, service. In pharma and medical devices it is also a regulatory requirement. Regulators expect manufacturers to keep watching suppliers after approval and to act when performance slips.
- ICH Q10 section 2.7 says the pharmaceutical company is ultimately responsible for outsourced activities and purchased materials, and should monitor and review “the performance of the contract acceptor or the quality of the material from the provider,” identifying and implementing any essential improvements.
- ISO 13485:2016 clause 7.4.1, which FDA’s QMSR has incorporated since February 2, 2026, requires monitoring and re-evaluation of suppliers, with controls proportionate to the risk associated with the medical device.
- EU GMP Chapter 7 requires the contract giver to control and review outsourced activities using quality risk management principles (7.4) and to “monitor and review the performance of the Contract Acceptor” (7.7).
FDA’s view of contractors makes this concrete. Its 2016 guidance on quality agreements states that when an owner uses a contract facility, the owner’s quality unit “is legally responsible for approving or rejecting drug products manufactured by the contract facility, including for final release.” A supplier’s failure is your failure.
What to measure
Good supplier KPIs combine quality, compliance and delivery. The table below shows a practical set for regulated manufacturers.
| Category | KPI | Why it matters |
|---|---|---|
| Quality | Incoming lot rejection rate | Direct measure of material quality |
| Quality | Nonconformances per 100 lots | Captures problems found after receipt |
| Quality | Complaints traced to supplier material | Patient-facing impact |
| Quality | CoA discrepancies found by your own testing | Tests whether the supplier’s data can be trusted; required under 21 CFR 211.84(d)(2) |
| Compliance | Open supplier corrective actions and their age | Shows responsiveness |
| Compliance | Audit findings (critical / major / minor) | Shows system health |
| Compliance | Change notifications received on time | Unnotified changes are a major risk |
| Compliance | Regulatory status (warning letters, import alerts, GMP certificate status) | External signal of problems |
| Delivery | On-time, in-full delivery | Supply continuity |
| Delivery | Lead time stability | Shortage risk |
The CoA reliability KPI deserves special attention. Under 21 CFR 211.84(d)(2), a manufacturer may accept a supplier’s report of analysis instead of full testing only if it performs at least one specific identity test and establishes the reliability of the supplier’s analyses “through appropriate validation of the supplier’s test results at appropriate intervals.” In a September 1, 2026 warning letter, FDA cited Happy Farm Botanicals for failing to do this and asked for “a summary of component testing results” evaluating each manufacturer’s CoA reliability.
Building a supplier scorecard
- Segment suppliers by risk. Critical suppliers (APIs, sterile components, critical device components, contract manufacturers) get full scorecards. Low-risk suppliers get a lighter review.
- Pick a small set of KPIs per segment. Five to eight metrics are usually enough.
- Define targets and thresholds. For example: green, amber, red bands per KPI.
- Collect data from systems, not by hand. Incoming inspection, nonconformance, complaint and CAPA systems should feed the scorecard.
- Review at a set frequency. Monthly for critical suppliers, quarterly or annually for others.
- Share with the supplier. A scorecard the supplier never sees cannot drive improvement.
- Link to actions. Define what happens at each threshold: discussion, corrective action request, audit, probation, disqualification.
From scorecard to action
| Signal | Typical action |
|---|---|
| One-off nonconformance | Nonconformance report; supplier notified |
| Repeated or serious nonconformance | Supplier corrective action request (SCAR) |
| CoA discrepancy | Increased testing; investigation; reassess reliance on CoA |
| Unnotified change | SCAR; quality agreement review; possible audit |
| Red score for consecutive periods | For-cause audit; probation; search for alternative source |
| Regulatory action against supplier | Immediate risk assessment; possible hold on material |
The link to re-qualification matters. The Happy Farm letter also cited a supplier whose “requalification date had lapsed.” Performance data should feed directly into the re-evaluation schedule.
Quality agreements as the foundation
Performance expectations need a written basis. FDA’s 2016 guidance on quality agreements for contract manufacturing recommends written agreements that define which party does which activity, kept separate from commercial contracts because FDA may review them during inspections. ICH Q10 calls for responsibilities to be defined in a “written agreement between the contract giver and contract acceptor.” The scorecard measures what the agreement requires.
Common weaknesses
- Measuring delivery, not quality. Procurement scorecards that ignore nonconformances and CoA reliability.
- No link to re-qualification. Suppliers stay approved regardless of performance.
- Manual data. Scorecards built in spreadsheets from memory are late and inconsistent.
- Change notification not tracked. Unannounced changes in materials or processes are among the biggest supplier risks.
- No action thresholds. Everyone sees a red score; nobody is obliged to act.
Supplier performance checklist
- Suppliers segmented by risk
- KPIs defined per segment, including quality and compliance measures
- CoA reliability verified at defined intervals for suppliers whose CoAs you rely on
- Targets and action thresholds documented
- Data collected from QMS systems
- Review frequency set and followed
- Results shared with suppliers
- Performance feeds re-qualification decisions
- Quality agreements define expectations being measured
Review supplier files with AskDona
Scorecards show trends. The evidence behind them sits in documents: CoAs, audit reports, quality agreements, change notifications and SCAR responses. AskDona reads these together and flags gaps, such as CoA values that conflict with your test results, expired qualifications or quality agreement terms that are not being met, each linked to the source page. Run a sample supplier file assessment on one critical supplier. AskDona shows the evidence; your supplier quality team decides.
FAQ
What is supplier performance management? The ongoing measurement and review of suppliers against quality, compliance and delivery expectations, with defined actions when performance falls short.
Is supplier monitoring required by regulators? Yes. ICH Q10, EU GMP Chapter 7 and ISO 13485 (incorporated into FDA’s QMSR) all require ongoing monitoring of suppliers and contract manufacturers.
What KPIs should a supplier scorecard include? Incoming rejection rate, nonconformances, complaints, CoA reliability, open corrective actions, audit findings, change notification compliance and delivery performance.
How often should supplier performance be reviewed? Based on risk: often monthly for critical suppliers and annually for low-risk ones.
Can we rely on a supplier’s certificate of analysis? In US drug manufacturing, only with at least one specific identity test per lot and periodic validation of the supplier’s results, under 21 CFR 211.84(d)(2).
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| ICH Q10 (FDA) | ICH guideline | Section 2.7 outsourced activities |
| ISO 13485:2016, Medical devices: Quality management systems | International standard | ISO 13485 7.4.1 |
| EU GMP (EudraLex Vol. 4), Chapter 5: Production | EU GMP guideline | EU GMP Chapter 5 |
| EU GMP (EudraLex Vol. 4), Chapter 7: Outsourced Activities | EU GMP guideline | Chapter 7 |
| 21 CFR Part 211 (eCFR) | US regulation | 211.84(d) |
| FDA warning letter, Happy Farm Botanicals (Sept 1, 2026) | FDA warning letter | CoA reliance; lapsed requalification |
| FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements (Nov 2016) | FDA guidance | Owner responsibility for contract facilities |
| FDA Law Blog, FDA issues final quality agreement guidance (2016) | Law firm blog | Quality agreements |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR date |