Supplier qualification software: what FDA inspectors expect from your approved supplier list

FDA inspectors want to see who approved each supplier, on what evidence and until when. Supplier qualification and approval software gives every supplier one dated record that answers those questions, in place of scattered certificates, emails and spreadsheet tabs. It supports the risk-based oversight expected under 21 CFR Parts 211 and 820, ICH Q10 and FDA quality agreement guidance.

Approval is inspection-ready when five things hold: a risk tier for every supplier, a traceable approval record, requalification set by risk, 21 CFR Part 11 controls on the electronic record and a clear rule for when a failure needs a CAPA.

Qualification gathers the evidence, approval records the decision and monitoring keeps it valid

Qualification gathers the evidence that a supplier can meet written quality requirements: questionnaires, certificates, quality agreements, audit reports and test data. Approval is the quality unit's documented decision to add that supplier to the approved supplier list (ASL). Monitoring keeps that decision valid.

Which suppliers need qualification? Active ingredients, excipients, packaging, contract manufacturers and laboratories

Drug makers cover suppliers of active pharmaceutical ingredients, excipients, containers and closures, plus contract manufacturers and testing laboratories. Device makers add component suppliers and contract sterilizers. The risk tier, rather than the category label, sets how deep the evidence goes.

What does FDA expect from approved suppliers?

No FDA regulation mandates specific supplier approval software. The expectation is a documented, risk-based process that the quality unit owns and can evidence on request.

Source	What it expects	What the record should show
21 CFR 211.22	The quality unit approves or rejects components and products made under contract by another company	Named quality unit approver, decision and date
21 CFR 211.84(d)(2)	A supplier's report of analysis is accepted only if the manufacturer runs at least one specific identity test and validates the supplier's results at appropriate intervals	Identity test results and a history of supplier result verification
FDA guidance: Contract Manufacturing Arrangements for Drugs: Quality Agreements	Owners and contract facilities define responsibilities in a written quality agreement	Signed quality agreement linked to the supplier record
ICH Q10, section 2.7	The pharmaceutical quality system extends to outsourced activities and purchased materials	Supplier assessment, monitoring and review records
21 CFR Part 820 (QMSR, effective February 2, 2026)	Incorporates ISO 13485:2016, where clause 7.4 requires supplier evaluation and selection criteria proportionate to risk	Documented criteria, evaluation results and re-evaluations

The approval evidence trail: five fields an inspector should be able to retrieve in one request

The approval evidence trail is the set of five fields that together prove a supplier approval was a controlled decision:

• Risk tier, supported by a written supplier risk assessment
• Evidence reviewed, such as certificates, questionnaires, audit reports and test results
• Named approver, with the meaning of the signature (approved, rejected or conditionally approved)
• Decision date and approved scope
• Status trigger, the event that changes approval status, such as an expired certificate or a failed identity test

Any missing field turns an approval from a decision into an assertion. UK sites work to a different framework, covered in how MHRA and EU GMP expectations shape supplier approval for UK sites.

What to look for in supplier approval software

Supplier qualification and approval software should hold one controlled record per supplier, enforce a workflow from request to approval and log every change with who, what, when and why.

Capability	What it does	Evidence it creates
Risk tiering	Assigns a tier from impact on product quality and supply criticality	Supplier risk assessment with written rationale
Qualification workflow	Issues questionnaires, collects certificates and agreements, routes them to the quality unit	Complete qualification file per supplier
Supplier result verification	Schedules identity tests and periodic checks of supplier analyses	Test records and verification history
Supplier audit scheduling	Plans audits by tier and stores reports and follow-up actions	Audit schedule, reports and closure records
Audit trail and e-signatures	Logs every change and captures signature meaning	Attributable, time-stamped record

Spreadsheet approved supplier lists drift out of date, while status triggers make lapsed evidence visible before the next order

A spreadsheet ASL is only as current as its last edit. Certificate dates sit in one tab and approval emails in an inbox, so a lapsed certificate changes nothing and a buyer keeps ordering. Software links each supplier to its certificates, alerts ahead of expiry and changes status when evidence runs out. Platforms that hold qualification, scorecarding, non-conformance and supply chain risk in one supplier quality lifecycle let status follow performance as well as paperwork, and configurable assessment templates that apply different criteria by supplier category and risk profile stop a packaging vendor and a contract manufacturer being assessed on the same form.

How do you tier suppliers by risk and decide when to requalify them?

FDA sets no fixed requalification interval. Section 211.84(d)(2) refers to validating supplier results "at appropriate intervals", so the interval is a documented, risk-based decision that each site justifies in procedure.

A supplier risk assessment sets the tier, and the tier sets how much evidence a supplier owes

• High risk (active ingredients, sterile components, contract manufacturers): quality agreement, supplier audit and ongoing verification of supplier results.
• Medium risk (excipients, non-sterile components): questionnaire, current certificates and report of analysis checked with an identity test.
• Low risk (general consumables): certificate check, with a full review only on a trigger event.

These tiers are examples, so each site should document its own rationale. Tools that combine audit scheduling by risk tier, standardized scoring and certificate expiry tracking keep the cadence tied to the tier.

When should a trigger event force supplier requalification ahead of schedule?

• A change of manufacturing site, process or ownership at the supplier
• A failed identity test or a discrepancy in a report of analysis
• Recurring deviations or complaints traced to the supplier
• A recall or regulatory action involving the supplier
• A change in FDA expectations, which regulatory change tracking can turn into an owned requalification task

What belongs in a quality agreement with a contract manufacturer?

Quality agreements assign responsibilities in writing, so link each one to the supplier record

FDA's quality agreements guidance keeps responsibility for product quality with the owner while letting the agreement define who does what. A workable agreement typically covers batch release, change notification, deviation and out-of-specification investigations, audit rights, record retention and subcontractor notification. Linking the signed agreement to the supplier record means a change in scope triggers a review of both.

When does a supplier failure need a CAPA, and when is a correction enough?

A CAPA is needed when a supplier failure is recurring, systemic or able to affect product quality or patient safety, such as the same defect across several lots. A one-off lapse with a clear cause, such as a single late shipment, is usually closed with a correction and a deviation record. A CAPA needs an owner, a due date and an effectiveness check, as in the CAPA lifecycle from identification through effectiveness verification, and supplier non-conformance notification lets the supplier respond in the same record.

How do 21 CFR Part 11 and computer software assurance apply to supplier approval software?

Audit trails and e-signatures must show who approved a supplier, what changed and when

Where approval records satisfy a predicate rule such as 21 CFR Part 211, Part 11 applies to the electronic version. Section 11.10(e) calls for secure, computer-generated, time-stamped audit trails. Section 11.50 requires signed records to show the printed name of the signer, the date and time and the meaning of the signature, such as approval.

Computer software assurance for devices and GAMP 5 for drugs: validation effort scales with risk

FDA's final computer software assurance guidance (September 24, 2025) covers production and quality system software for medical devices. Drug makers have no equivalent FDA guidance, so many apply ICH Q9 and the ISPE GAMP 5 categories. Both scale effort to intended use, so the approval workflow and audit trail deserve more assurance than reporting views. How the move from CSV to risk-based CSA changes validation of quality software sets out the mechanics.

What should you ask before choosing supplier approval software?

Before rollout, ask about record ownership, data migration, validation evidence and integration

• Ownership: who owns each supplier record and who can change approval status?
• Data migration: how will existing ASL entries, certificates and audit reports move across, and who verifies them?
• Validation evidence: what vendor documentation supports intended-use assurance, and how are releases handled?
• Integration: does supplier data sit alongside version control, approval workflows and audit trails for controlled documents and CAPA records, ideally within document control, CAPA and audits connected in one quality management system, so fewer interfaces need validating?

What an inspector should find when they ask who approved a supplier

An inspector's questions are short: who approved this supplier, on what evidence and what has happened since. Supplier qualification software earns its place when the answer takes minutes: a risk tier with a written rationale, a named approver and date, a quality agreement that matches the scope and an audit trail that stands up under Part 11. Settle those fields first, then choose software to hold them, and the approved supplier list is right on the day someone checks it.