{"id":16876,"date":"2026-10-29T01:01:02","date_gmt":"2026-10-29T06:01:02","guid":{"rendered":"https:\/\/flevy.com\/blog\/?p=16876"},"modified":"2026-10-28T15:43:39","modified_gmt":"2026-10-28T20:43:39","slug":"vendor-qualification-in-regulated-supply-chains-a-management-framework-for-supplier-quality","status":"publish","type":"post","link":"https:\/\/flevy.com\/blog\/vendor-qualification-in-regulated-supply-chains-a-management-framework-for-supplier-quality\/","title":{"rendered":"Vendor Qualification in Regulated Supply Chains: A Management Framework for Supplier Quality"},"content":{"rendered":"

\"\"Ask a procurement director how some specialist vendor ended up on the approved list. Quite often the true answer is that someone in the lab needed it by Friday. Pharma services, specialty chemicals, university spin-outs: same story. So it’s worth noticing when smaller suppliers put their testing approach in public; some research reagent vendors now spell out their third-party batch testing standards<\/a> on their own websites, which gives a buyer something concrete to question before anyone signs a purchase order.<\/p>\n

Then there’s the paperwork. A certificate of analysis you can’t tie to the lot on your receiving dock is close to worthless, yet buyers file them by the hundred and never look twice. One vendor’s plain-English guide to supplier quality documentation for procurement teams<\/a> shows roughly what a buyer could ask of any vendor, whatever they sell. Lot-level records. Named test methods. How long files are kept.<\/p>\n

So here is a framework, written for the executives and consultants who look after supplier networks where a bad batch means a regulator, a retracted result or both. None of it is proprietary. The pieces are old friends (ISO 9001, Deming’s Plan-Do-Check-Act, Kraljic’s portfolio matrix from 1983); what’s offered is an order for using them that tends to hold up once real people and real deadlines get involved.<\/p>\n

Where Qualification Usually Breaks<\/h2>\n

The way it goes wrong hardly varies. Somebody technical finds a vendor. The project is late, so procurement pushes the PO through, and quality gets the approval form after the first box has landed, maybe after it’s been opened and used. Approval at that stage is a rubber stamp, put on a decision other people made for other reasons.<\/p>\n

Nobody notices for a while. Then a batch fails incoming inspection, or worse, fails downstream, and the investigation discovers that the supplier’s “independent” testing was done in-house, or that the certificates on file were generic PDFs with the lot number typed in. The cost is no longer one order. It’s weeks of investigation, a stalled project and, in a regulated setting, an audit observation that someone has to answer for.<\/p>\n

Decent supplier management<\/a> treats qualification as its own decision, with criteria, an owner and evidence, taken before money moves. That sounds obvious. It is still, in a lot of companies, the exception.<\/p>\n

Four Stages, Roughly following PDCA<\/h2>\n

Think of it as four stages. Each one should leave behind something written, a document an auditor or your successor could pick up cold and follow.<\/p>\n

Segment first.<\/b> Giving every vendor the full treatment sounds rigorous, but in practice it means everyone gets a thin one. Kraljic split purchases by profit impact against supply risk. The high-risk half of his grid (strategic and bottleneck items) is where proper qualification earns its keep; routine and leverage buys can usually make do with something lighter. In lab and research supply, though, spend is a bad proxy for risk. That cheap reagent nobody thinks about can sink a six-month program if it arrives out of spec. Sort by what happens when it fails, then.<\/p>\n

Write the evidence standard before you talk to anyone.<\/b> Skipped all the time, this one, and it matters more than it looks. Without criteria on paper beforehand, the review drifts toward whatever the slickest vendor decided to send over. For a high-risk category you’d want answers on the supplier’s own quality system (certified, or only described?), who runs the batch testing and how independent that lab really is, what has to appear on every certificate, how a finished lot traces back to raw material, storage and shipping, and how complaints actually get closed.<\/p>\n

Verify rather than collect.<\/b> Anyone can gather a stack of certificates in an afternoon. Checking them is slower work. Is this certificate for the lot you actually got? Is the lab real, and does the vendor own it? Is the method even suitable for what’s being claimed? If the risk is high enough, test part of the first delivery yourself and see whether the numbers agree. A questionnaire, remote audit or site visit can be added depending on segment, though flying someone out to audit a low-risk supplier mostly wastes a week.<\/p>\n

Monitor, then requalify.<\/b> An approval goes stale. Staff turn over, contract labs change, processes wander without anybody signing off on it. So pick a requalification interval for each segment and in the meantime keep an eye on a few numbers, such as incoming inspection failures, missing documents per delivery and how long complaints sit open. What you learn feeds back into the evidence standard. That’s the Check and Act part of Deming’s cycle, and it’s what stops the framework from simply getting older.<\/p>\n

Tying It into the Quality System<\/h2>\n

ISO 9001<\/a> requires organizations to control externally provided processes, products and services, but it deliberately stops short of telling you how. That flexibility is useful, and it is also why two sites in the same company can run supplier control in completely different ways. A documented qualification framework is one of the more convincing things you can show an auditor, because it demonstrates that control is a system and not a series of favors.<\/p>\n

There’s an internal benefit too, often overlooked. Supplier performance data belongs next to internal nonconformance data. When the two live in separate tools owned by separate teams, a recurring defect gets logged as an internal problem three times before anyone traces it back to the same vendor.<\/p>\n

Who Actually Owns the supplier?<\/h2>\n

Here is the governance gap that turns up most. Procurement owns the commercial relationship. Quality owns the standard. The scientist or engineer owns the need. Each quietly assumes one of the others is watching the vendor, and so nobody is.<\/p>\n

A one-page RACI fixes most of this. Quality is usually accountable for the approval decision; procurement is responsible for assembling evidence and managing the contract; technical users are consulted on specifications and kept informed of status changes. And senior leadership should see a short periodic view of supplier risk for strategic vendors, since a failure there lands well outside the purchasing budget.<\/p>\n

Four Questions for a Consultant’s First Week<\/h2>\n

If you’re reviewing a client’s supplier base, you can learn a surprising amount from four questions. Can they show the written criteria used to approve their five highest-risk suppliers? Were any of those suppliers approved after the first delivery? Is anyone comparing certificates against received lots, or do they just get filed? And when was each strategic supplier last requalified? Clients tend to answer the first one confidently and the fourth one slowly. The gap between those two answers is roughly the size of the problem.<\/p>\n

A Closing Note<\/h2>\n

Vendor qualification almost never reaches the board agenda until something has gone wrong, which is a shame, because the tools are old, cheap and well understood. Segment by risk, write the standard down, verify what you’re sent, and come back on a schedule. Suppliers who publish their testing and documentation practices make that job easier. Buyers ought to reward them for it, and then ask every other vendor on the list why they don’t do the same.<\/p>\n","protected":false},"excerpt":{"rendered":"

Ask a procurement director how some specialist vendor ended up on the approved list. Quite often the true answer is that someone in the lab needed it by Friday. Pharma services, specialty chemicals, university spin-outs: same story. So it’s worth noticing when smaller suppliers put their testing approach in public; some research reagent vendors now… Vendor Qualification in Regulated Supply Chains: A Management Framework for Supplier Quality<\/span><\/a><\/p>\n","protected":false},"author":97,"featured_media":16877,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"off","neve_meta_content_width":70,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-16876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/posts\/16876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/users\/97"}],"replies":[{"embeddable":true,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/comments?post=16876"}],"version-history":[{"count":1,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/posts\/16876\/revisions"}],"predecessor-version":[{"id":16878,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/posts\/16876\/revisions\/16878"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/media\/16877"}],"wp:attachment":[{"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/media?parent=16876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/categories?post=16876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flevy.com\/blog\/wp-json\/wp\/v2\/tags?post=16876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}