How many suppliers are on your approved list right now, and how many of those approvals would you be comfortable signing again this morning?
Most heads of quality I ask know the first number and pause on the second. That pause is what this post is about. Supplier quality management is usually run by capable people on thin tooling: a spreadsheet list, qualification files on a shared drive, corrective-action requests in email, audit reports wherever the auditor saved them. Each piece is defensible on its own. Together they have to agree with each other, and only the people make them agree.
This is the first in a series on supplier quality, and it is deliberately the wide view: what the programme has to produce, what fragmentation costs, where the regulators put the load, and what to demand from a system.
What the programme has to produce, whoever runs it
Supplier quality management is how a regulated company decides which suppliers may supply what, proves that decision with evidence, checks it against every delivery, and reopens it when a supplier fails. Strip the procedures away and five outputs remain. If you cannot put your hand on each in a minute, the programme is running on memory.
| Output | The question it answers | The date it carries |
|---|---|---|
| Approved-supplier list | Who may supply what, to which site, today | Granted; lapses |
| Qualification decision | Why this supplier was approved, on what evidence, by whom | Decided; re-qualification due |
| Receiving inspection tied to status | Was the supplier approved when this lot arrived | Receipt date against the approval window |
| Supplier corrective-action requests (SCARs) | What we asked the supplier to fix, and whether it was fixed | Raised; due; closed; escalated to CAPA |
| Supplier audit schedule | Which suppliers we go and look at, how often, and why | Last audit; next audit; the tier that set it |
Look at the third column: every output is really a date. Supplier programmes rarely fail because a document is missing. They fail because a date passed and nothing happened.
Or a SCAR fell due and nobody chased it. Or a critical supplier's audit interval drifted from twelve months to twenty.
What it costs when it lives in spreadsheets and email
I do not have a clean industry figure for what a fragmented supplier programme costs, and I distrust anyone who says they do. The cost lands as hours across purchasing, receiving, QA and the warehouse, and as a few bad afternoons a year. Here is where it shows up.
The approved list nobody trusts. Two versions exist: the controlled one on the quality drive and the working one purchasing keeps because the controlled one is stale. Receiving checks neither. When an inspector asks whether this supplier was approved on the date of this receipt, three people go to three files.
The SCAR that never closed. Raised by email after a rejected lot; the supplier replied with a root cause and a promise, and the thread went quiet. Nobody decided whether it should have become a CAPA in your own system. Eighteen months later the same defect arrives, and the only evidence you saw it coming is in a mailbox.
The audit nobody can find. The report exists. The auditor left. It is in a personal folder or filed under the wrong supplier name, and the next audit is scoped from scratch.
The change that arrived by phone. The supplier moved a process to a new site, or swapped a sub-supplier, and told your buyer on a call. It never became a change in your system, so nothing was re-evaluated and the approval stayed green.
The pattern is the same every time: the outputs exist, but nothing connects them to the event that should have consumed them. Receiving did not consume the approval status. Your CAPA process did not consume the SCAR. Your audit plan did not consume the last audit. People did the connecting, and people leave, go on holiday and get busy.
Where the regulators put the load
I will keep this at the level a buyer needs and leave the clause-by-clause reading to Vijay's clause map, which covers 7.4 and 8.2.4. What matters here is who carries the responsibility, and every framework gives the same answer: you, the purchaser.
For medical devices, ISO 13485:2016 clause 7.4 asks you to set criteria for selecting, evaluating and re-evaluating suppliers, to make the depth of control proportionate to the risk the purchased product carries, to keep records of all of it, and to verify what arrives. Since 2 February 2026 that is also the US rule: the FDA's Quality Management System Regulation incorporates ISO 13485:2016 into 21 CFR Part 820 by reference, and the old purchasing-controls section (§820.50) is no longer in the current text. For devices sold in the United States, clause 7.4 is what an investigator now reads.
For drugs, the load sits in 21 CFR 211.84. Every lot of a component, container or closure is withheld until your quality control unit has sampled, tested or examined it and released it. For components, you may lean on a supplier's certificate of analysis instead of full testing, but only if you run at least one specific identity test yourself and have established, and keep re-establishing at intervals, that the supplier's results are reliable. As a business rule: the certificate is worth what your own qualification of the supplier says it is worth, and the regulation even tells you to size your sampling partly on the supplier's past quality history.
In Europe, EU GMP Chapter 5 (paragraphs 5.27 to 5.29) requires the selection, qualification, approval and maintenance of starting-material suppliers to be documented in the pharmaceutical quality system, supervised in proportion to risk, with the evidence for each approval kept and a formal quality agreement or specification in place. Chapter 7 covers outsourced activities and puts the same weight on the contract giver: assess the contractor's suitability before signing, then control and review what you outsource. ICH Q10 section 2.7 ties the two together: assess before you select, define responsibilities in a written agreement, monitor performance, and check that incoming material came from approved sources through the agreed supply chain.
One scope note, because it is the mistake I see most in vendor decks. ISO 13485 and the QMSR are device frameworks; Part 211, Chapters 5 and 7, and Q10 are pharmaceutical. If you make both, you carry both, and a device-shaped supplier workflow is not a pharma answer until the 211.84 receiving rule has been walked through it.
The chain is one decision, not five records
Here is the reframe to take into your next budget conversation. A supplier programme looks like five records. It is one decision, made repeatedly: is this supplier allowed to supply this material, to this site, today? Every output above is either an input to that decision or a consequence of it.
Qualification is the decision made for the first time; the approved list is that decision written down with a date range. Receiving inspection tests it against a real lot. A SCAR is the decision challenged by a failure; a CAPA reopens it in your own system because the failure was systemic. A supplier audit re-examines it on the supplier's floor, and re-qualification makes it again on purpose, before the date forces it.
Seen that way, "five records in five places" stops being an inconvenience and becomes a design fault. Every hand-off is somewhere the decision can be lost. Whatever you run supplier quality in should read as one record, from the day the supplier was first assessed to the last lot you received.
Start with one file per supplier
You do not need software to start behaving this way. You need one file per supplier that carries the whole decision, and the discipline to keep it current.
Our supplier qualification checklist is the version of that file we hand to buyers: an Excel workbook, one per supplier, that walks thirteen requirements through classify (the risk tier and why), evaluate (certificates, questionnaire or audit, technical trials), approve (the quality agreement and the exact approved scope) and monitor (complaints, deviations, delivery trending, the re-qualification date, the disqualification path). Each row carries an evidence reference, an owner, a date and a status. Its job here is simple: it forces the five outputs into one place per supplier, so that when you do move to a system you migrate a decision rather than reconstruct one.
Spreadsheets and email versus one record
Run the comparison output by output. I have been fair to the left-hand column, because spreadsheets are not stupid. They are just unconnected.
| Spreadsheets and email | One supplier record | |
|---|---|---|
| Approved-supplier list | Easy to edit, which is the problem: nobody can say who changed a status or when | Status changes carry who, when and why; one list |
| Qualification decision | Evidence in a folder; the decision in someone's head | Decision, evidence, approver and re-qualification date on the supplier |
| Receiving inspection | Checks the list if someone remembers | Tied to the supplier's status at the moment of receipt |
| SCAR | A thread; closure is whoever stopped replying | Raised, owned, due, closed; escalation to CAPA is linked, not retyped |
| Supplier audit | A report file and a calendar entry | Findings sit on the supplier; the next date follows from the risk tier |
The right-hand column is not a wish list; it is what the programme has to produce anyway. The only question is whether the system does the connecting or your senior QA people do it at the end of the day.
Re-qualification and audit dates are budget decisions
A risk-tiered supplier programme is a promise about how many hours you will spend per supplier per year. A critical-tier supplier with an annual on-site audit, a quality agreement review and a re-qualification decision is a real cost; a low-risk consumables supplier on a questionnaire every three years is a small one. Setting tiers is setting a budget, and dates slip when that budget was never made explicit.
So write three things down: how many suppliers sit in each tier, the interval for each, and who owns each date. Then ask whether your tooling can show which dates fall due next quarter without somebody building a report. If it cannot, that blind spot will surface as an overdue audit on an inspector's list.
One question for your next management review
For each critical supplier, can we show the last approval, the last receipt, the last SCAR and the last audit as one story? If the answer is "with some work", the programme still runs on people, whatever the procedures say.
That question is also how to evaluate a system, if you are moving the programme into software. Evaluate the chain, not the screens: bring a real supplier with a messy history and ask the vendor to walk it.
- Show me the approved-supplier list for one site and one material. Who changed the last status, when, and why?
- Show me a qualification. Who approved it, on what evidence, and when is it due again?
- Raise a receiving inspection against a supplier you have just put on hold. What happens?
- Take a rejected lot to a SCAR, and that SCAR to a CAPA. Is the CAPA linked back, or retyped?
- Show me the suppliers whose re-qualification falls due in the next ninety days, without an export.
- Tell me what the supplier can see and do. "Nothing, your team operates it" is a legitimate answer; I would rather hear it than see a portal that is still on a roadmap.
Whichever way those come out, take the one question above into the review. It is the only one whose answer does not depend on the vendor.
How Complere carries the supplier chain
One supplier, one record. Master details, the qualification that put the supplier on the list, its approved-list entries, its receiving inspections and any corrective-action requests sit on one supplier record, so the story reads top to bottom without a search.
An approval with its own scope and expiry. Approval is granted per site, material and scope, with a validity window. A business approval and a separate quality sign-off are recorded by two different people, and the person who opened the file cannot release it. When a window lapses, new receiving against that entry stops.
Receiving that knows the supplier's status. A supplier on hold or disqualified cannot be chosen for a new receiving inspection, whoever is on the dock that day; lots received while it was in good standing stay readable and workable.
A SCAR that becomes a CAPA in one step. When a supplier issue turns out to be systemic, the request is promoted to a CAPA once, and the CAPA keeps its reference back to the supplier and the request that started it. Supplier audits sit in the same audit programme as your internal audits; a finding can be opened as a SCAR.
Immutable audit trail — database-enforced. Audit records cannot be modified or deleted, enforced by database-level constraints. When an inspector asks who changed a supplier's status and when, the trail answers.
Your team still decides who stays on the list and why; the software's job is to make that decision cheap to prove, lot after lot.
