Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Supplier Quality Management

    Also known as: Supplier quality assurance, Vendor quality management, Control of external providers

    Definition

    The controls an organisation applies to choose, approve, monitor and reassess suppliers whose materials, products or services affect its own quality, from the purchase requirements to supplier audits and the performance record.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/supplier-quality-management

    Scope: Supplier quality management is not the same as spend or relationship management. The FDA, WHO and EU wording is written for medicines, and the text of ISO 9001 is not reproduced.

    Example for your evaluation: Follow one rejected delivery to the supplier's corrective action request, an audit at its site and the approved-supplier status that results.

    Sources checked: . Examples are editorial illustrations.

    What FDA, WHO, the EU and ISO committee papers say about controlling suppliers

    On this page supplier quality management means the controls an organisation uses to decide which suppliers to buy from, what it asks of them, how it checks what they deliver and how it acts on problems. An ISO/TC 176 and IAF paper for ISO 9001:2015 calls them external providers and says they can be any source of processes, products and services: a supplier, partner, sister or parent organisation or customer. It says an auditor may find it enough to see an up-to-date list of approved providers, orders placed with providers that meet the criteria, effective performance monitoring and checks that confirm requirements are met, with risk-based thinking shaping the controls. It adds that purchase requirements should be checked before they go to a provider and include statutory and regulatory requirements. The paper asks whether providers are chosen on price alone, whether a listing rests only on registration to a standard without a look at its scope, and how often credit notes and concessions arise for goods first rejected. It notes that auditing the intended provider can help set out communication and specifications. The paper was not endorsed by ISO, and the committee site is managed by a third party. This is general information, not legal or certification advice.

    FDA's 2006 guidance on a quality systems approach is nonbinding and written for drug manufacturers. It treats any material that goes into the product as an input, whether bought or made in house. It says the CGMP rules require testing, or a supplier's certificate of analysis plus an identity test, and that reliability can be validated by comparing the manufacturer's results with the certificate. Initial tests should establish reliability and set a schedule for reassessment. As an element of purchasing controls, FDA recommends trending acceptance and rejection data for supplier performance. It also calls for periodic supplier audits based on risk, including a systematic examination of the supplier's quality system, and for changes of supplier or specification to go through change control. For outsourcing, it says to qualify the contract firm before signing, with a quality agreement describing the material or service, quality responsibilities and communication. The manufacturer's quality unit stays responsible for approving or rejecting what a contractor supplies.

    WHO's main principles say the person responsible for QC, with other departments, approves suppliers able to deliver starting and packaging materials to specification. Suppliers are evaluated before they join the approved list, taking account of history and the nature of the material, and an audit, where needed, tests their ability to meet GMP. Starting materials are bought only from approved suppliers, and it is beneficial to agree complaint and rejection procedures by contract. A supplier's certificate of analysis may replace full testing only where its reliability is established through periodic validation and on-site audits. The contract giver monitors and reviews the contract acceptor's performance, including improvements and their effectiveness.

    EU GMP Chapter 5 asks that selection, qualification, approval and maintenance of suppliers of starting materials be documented, with supervision proportionate to the risk and the evidence for each approval kept. Requirements are agreed in a formal quality agreement or specification. For active substances, audits cover the manufacturers and distributors, with an appropriate duration and scope, a report of what was done and seen, corrective and preventive actions implemented, and later audits at intervals set by quality risk management. For devices, FDA's QMSR FAQ says FDA may inspect supplier audit reports, and the earlier exemption for them was not kept.

    Sources opened :

    What a supplier quality record holds in software

    • The supplier, the materials or services it provides, and the sites that make them.
    • The approval decision, its date and basis, the status and the approver.
    • The purchase requirements or specification, and any quality agreement.
    • Receiving and inspection results by delivery or lot, with rejects and the reason.
    • Delivery data used for performance reviews, with the period it covers.
    • Audit reports, findings and the supplier's corrective actions, with the check that they worked.
    • Changes to the supplier's status, with the reason, and the date of the next planned reassessment.

    Supplier quality management, purchasing, a scorecard and a supplier audit

    Purchasing places orders, while supplier quality management decides which suppliers may receive them and watches their performance. On this page's own summary, not a source term, a scorecard is a record that summarises chosen measures for a supplier over a period. It draws on inputs the sources describe, such as acceptance and rejection data. An audit is one control. The ISO paper on auditing practices says auditing of suppliers is generally termed a second-party audit, and WHO describes quality audits extended to suppliers and contractors. A third-party certificate is a different thing, and the ISO paper asks that its scope be reviewed.

    A hypothetical example: a supplier of moulded housings put under review

    Everything in this case is invented and describes no real company. An assembly firm with 50 staff buys moulded housings from one supplier and reviews any supplier whose lots are rejected at more than 10% in a quarter. In the first quarter 20 lots arrive and 3 are rejected for flash on the moulding, which is 3 of 20, or 15%. Only 17 of 20 lots, or 85%, arrive on the agreed date. The supplier's status moves to approved with conditions, and the quality engineer raises a corrective action request.

    A one-day audit at the supplier's plant, a second-party audit, finds gaps in the records of mould maintenance. The supplier answers with a corrective action and a monthly check on every mould. In the second quarter 18 lots arrive and 1 is rejected, or 5.6%, and 17 of 18 are on time, or 94%. The firm keeps the conditional status for one more quarter before restoring full approval. The record links the rejected lots, the request, the audit report and each change of status.

    Common misunderstandings about supplier quality management

    • Approval is not a one-off event. FDA asks for a schedule of reassessment, and EU GMP has later audits at risk-based intervals.
    • A supplier's certificate does not end the question. The ISO paper asks whether the scope of a registration is reviewed, not only that it exists.
    • A certificate of analysis does not replace checks by itself. FDA's guidance still calls for an identity test, and WHO asks for periodic validation and audits.
    • Not every supplier gets the same control. EU GMP asks for supervision proportionate to risk, and FDA bases audits on risk assessment.
    • Outsourcing does not move responsibility. FDA says the manufacturer's quality unit approves or rejects what a contractor provides.
    • Supplier audit reports are not outside inspection. FDA's QMSR FAQ says FDA may inspect them for device manufacturers.
    • FDA, WHO and EU texts are written for medicines. Another sector's customer or standard may word the controls differently.

    How supplier quality management relates to other glossary terms

    Supplier controls feed the same records as the rest of the system. These terms sit beside them.

    • Contractor management: the related control of contractors who work on site.
    • Non-conformance: the record raised when a delivery fails its requirement.
    • CAPA: the cycle behind a supplier corrective action request.
    • Quality control: the incoming checks that produce rejection data.
    • ISO 19011: the guidance for first-, second- and third-party audits.

    Records and evidence that usually exist for supplier quality management

    • An approved supplier list with status, scope and date of last reassessment.
    • Evaluation and approval records, with the basis for each.
    • Purchase specifications and quality agreements.
    • Incoming inspection and rejection records, with trend data.
    • Supplier audit reports, findings and corrective action records.
    • Records of changes to a supplier, material or specification and their approval.

    What a software tool needs to capture for supplier quality management

    • An approved list with status, scope of approval and next reassessment date.
    • Rejections linked to supplier, lot and reason, so rates can be recomputed for any period.
    • Supplier corrective action requests that stay open until a check is recorded.
    • Audit reports with findings, evidence and the supplier's answers.
    • Status changes with the reason and approver, and a hold on orders where the rule says so.
    • Quality agreements and specifications held as versioned documents.
    • Export of a supplier's full history for an auditor or inspector.

    Catalog profiles documenting supplier quality records

    Listed profiles meet the supplier quality rule used by the supplier quality software guide. That rule does not show that a product holds second-party audits, scorecards or corrective action requests to suppliers, which should be tested with your own records.

    Same rule for every product: tagged “Quality Management”, “CAPA Management”, “Nonconformance”, “Nonconformance Management” or “Supplier Management”, with a sourced supplier quality (corrective requests, incoming inspection, qualification or supplier audits) capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 26 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    What is a second-party audit?

    An ISO/TC 176 and IAF paper says auditing of suppliers is generally termed a second-party audit. WHO says quality audits may extend to suppliers and contractors, and a contract should let the contract giver audit the acceptor. A certification body's audit is a third-party audit.

    Does a supplier need ISO 9001 certification to be approved?

    No source read says so. The ISO paper on external providers questions approving a supplier solely because it is registered to a recognised standard without reviewing the scope of the registration. WHO asks for evaluation of the supplier's history and the material, with an audit where required, and EU GMP scales supervision to risk.

    What should a supplier scorecard measure?

    The sources define no scorecard. FDA suggests trending acceptance and rejection data, WHO asks the contract giver to monitor performance and improvements, and the ISO paper asks about credit notes for rejected goods and concessions. Choose measures and thresholds in your own procedure.

    More quality terms

    Related guides