What supplier quality management is
Supplier quality management (SQM) is the set of processes a manufacturer uses to make sure purchased materials, components and services meet requirements, from the first decision to use a supplier to the day it is removed from the approved list. Supplier quality assurance (SQA) is the function that runs it.
In regulated industries SQM is not optional. The manufacturer stays responsible for everything it buys. ICH Q10 section 2.7 states that the pharmaceutical company “is ultimately responsible” for outsourced activities and purchased materials. FDA’s 2016 quality agreement guidance is blunter: “No matter who tests the products, the owners’ quality units are ultimately responsible for ensuring that the products are manufactured in accordance with CGMP.”
The requirements in brief
| Framework | Key supplier requirements |
|---|---|
| 21 CFR 211 (US drugs) | Components withheld until released (211.84(a)); at least one identity test per component (211.84(d)(1)); CoA reliance only with identity testing and periodic validation of supplier results (211.84(d)(2)); quality unit approves or rejects products made under contract (211.22(a)) |
| ICH Q10 section 2.7 | Assess suitability and competence; define responsibilities in written agreements; monitor performance; verify incoming materials come from approved suppliers via the agreed supply chain |
| EU GMP Chapters 5 and 7 | Documented supplier selection, qualification and approval (5.27); audits of active substance manufacturers with risk-based re-audit intervals (5.29); control of outsourced activities (Chapter 7) |
| ISO 13485:2016 clause 7.4 (incorporated in FDA QMSR since February 2, 2026) | Supplier evaluation and selection criteria; monitoring and re-evaluation; controls proportionate to risk; purchasing information and verification |
The SQM lifecycle
- Identify the need and risk. What is being bought, how critical is it, and what are the risks? See our guide to supplier risk assessment.
- Evaluate and qualify. Questionnaires, documents, samples, audits and trial lots. See our supplier evaluation and qualification guide.
- Agree. Quality agreements define responsibilities, specifications, change notification and audit rights.
- Approve. The supplier is added to the approved supplier list for defined materials.
- Control incoming material. Receiving inspection, identity testing, CoA review.
- Monitor performance. Scorecards, nonconformances, complaints, CoA reliability.
- Audit periodically. Frequency based on risk.
- Correct. Supplier corrective action requests (SCARs) for significant problems.
- Re-evaluate or disqualify. At set intervals and when performance or risk changes.
Each step produces documents, and inspectors read them as a chain. A gap anywhere (an expired qualification, an audit finding never closed, a CoA nobody verified) undermines the whole file.
What FDA cites
Supplier quality is a frequent theme in 2025–2026 warning letters:
- Identity testing and CoA reliance. On September 1, 2026, FDA cited Happy Farm Botanicals because records for an API lot showed only organoleptic testing, and because the firm had not validated its supplier’s test results. FDA wrote: “you do not have scientific evidence that components conform to appropriate specifications prior to use.”
- Lapsed qualification. The same letter found the firm “did not adequately qualify your (b)(4) supplier as the requalification date had lapsed” and asked for a comprehensive review of supplier selection, qualification and disqualification.
- High-risk excipients. Relying on supplier CoAs without verification is a recurring citation, and it matters most for components such as glycerin and sorbitol that can be contaminated with DEG or EG. FDA’s May 2023 guidance set testing expectations for these components.
- Contract manufacturer oversight. FDA’s quality agreement guidance states that owners remain responsible for approving or rejecting drugs made by a contract facility, including for final release, and that a quality agreement does not change that.
Supplier quality management software
SQM software brings the lifecycle into one system. Core functions:
| Function | Purpose |
|---|---|
| Supplier master and approved supplier list | Who is approved for what, and until when |
| Qualification workflows | Questionnaires, document collection, approval sign-off |
| Document management | Certificates, quality agreements, CoAs, with expiry tracking |
| Audit management | Planning, checklists, findings, follow-up |
| Nonconformance and SCAR | Linking supplier problems to corrective actions |
| Performance scorecards | KPIs from incoming inspection, NC and complaint data |
| Change notifications | Logging and assessing supplier changes |
| Supplier portal | Suppliers upload documents and respond to SCARs |
| Re-evaluation scheduling | Alerts before qualifications lapse |
The software holds GMP records, so it falls under 21 CFR Part 11 and EU Annex 11 and needs validation proportionate to risk.
Common weaknesses
- Approved supplier lists that include suppliers whose qualification has lapsed
- Quality agreements signed but never checked against practice
- CoAs accepted without periodic verification
- Distributors approved without knowing the actual manufacturer
- Audit findings without closure evidence
- No link between incoming nonconformances and supplier re-evaluation
Supplier quality management checklist
- Written SQM procedure covering the full lifecycle
- Risk-based supplier tiers with defined controls
- Quality agreements for critical suppliers and contract manufacturers
- Approved supplier list current, with qualification expiry dates
- Identity testing and CoA verification meet 211.84(d)
- Audit program based on risk
- Performance monitored and reviewed
- SCAR process with effectiveness checks
- Re-evaluation and disqualification criteria defined
- SQM software validated where used
Check supplier files with AskDona
Inspectors read supplier files as a chain of evidence. AskDona reads qualification records, quality agreements, CoAs, audit reports and SCARs together and flags breaks in the chain, such as expired qualifications, unclosed audit findings or CoA values that conflict with your test data, with links to the source page. Run a sample supplier file assessment on a critical supplier. AskDona shows the evidence; your supplier quality team decides.
FAQ
What is supplier quality management? The processes for selecting, qualifying, monitoring, auditing and improving suppliers so purchased items meet quality and regulatory requirements.
What is the difference between SQM and SQA? They are often used interchangeably. SQM usually refers to the overall system; SQA to the quality function and activities that carry it out.
What regulations cover supplier quality? In the US, 21 CFR 211 for drugs and the QMSR (incorporating ISO 13485) for devices; internationally, ICH Q10, EU GMP and ISO 13485.
What does SQM software do? It manages approved suppliers, qualification, documents, audits, nonconformances, SCARs, performance and re-evaluation in one validated system.
Can a company delegate supplier quality to the supplier? No. The manufacturer remains responsible for what it buys and what its contractors make.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| 21 CFR Part 211 (eCFR) | US regulation | 211.22(a), 211.84 |
| ICH Q10 (FDA) | ICH guideline | Section 2.7 |
| EU GMP (EudraLex Vol. 4), Chapter 5: Production | EU GMP guideline | EU GMP Chapter 5 |
| EU GMP (EudraLex Vol. 4), Chapter 7: Outsourced Activities | EU GMP guideline | Chapter 7 |
| ISO 13485:2016, Medical devices: Quality management systems | International standard | ISO 13485 7.4.1 |
| FDA warning letter, Happy Farm Botanicals (Sept 1, 2026) | FDA warning letter | Identity testing; lapsed qualification |
| FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements (Nov 2016) | FDA guidance | Owner responsibility for contract facilities |
| FDA, Testing of Glycerin, Propylene Glycol, Sorbitol Solution and Other High-Risk Drug Components for DEG and EG (May 2023) | FDA guidance | High-risk components |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR date |