Supplier quality software: qualification to incoming evidence

Why Supplier Quality Software Matters

Qualio's public pages cover supplier categories and approvals, while 1factory's cover working with suppliers on manufacturing records. Neither page tells you what your sampling rules are, who may release a lot, or whether a supplier can reply without a licence of its own.

Supplier quality is the part of purchasing that begins after the purchase order: what arrived, whether it met the drawing, what the supplier was told to fix and whether the fix held. This guide covers that chain, from the request for corrective action to the status of the supplier, and leaves general supplier onboarding, carbon and ESG questions to the supplier management guide.

A corrective action request is a record with a clock and a lot number

A supplier corrective action request (SCAR) is the formal request that a supplier investigate a defect found on its product and send back evidence. Companies name and format it differently; many use the eight-discipline (8D) layout. One published example is an OEM's 8D instruction for its own suppliers (2024 revision). It puts the 8D on the supplier that shipped the defective part, wherever the part was made, and it opens with facts: the part number, the fault description, who raised the nonconformance report and when, the quantity affected now and earlier, and whether the problem repeats an earlier report. In software terms, the request should point at the nonconformance record and the receiving lot rather than carry a retyped summary.

The same instruction asks for causes at three levels: why the defect was made, why it reached the customer, and why the supplier's own quality system failed to stop it. It also separates verification, which tests a fix before rollout, from validation, which watches the fix under normal production. Ask any vendor whether the response form holds those answers separately, and whether a request can be closed with only the first one filled in. The document says nothing about response deadlines, so the due date belongs to your supply agreement; the software should store the date you agreed rather than one it assumes.

Containment and escalation

Containment is the temporary action that keeps a defect away from the customer while the cause is still unknown. The OEM instruction above lists a replacement shipment, a stop on deliveries until stock is checked and a quality alert as examples, and says a containment action should be verified, documented, monitored and removed once the permanent fix has been validated. For a buyer, the equivalent steps are usually holding the lot, sorting stock and tightening inspection on the next deliveries.

Escalation needs a written trigger or it depends on who happens to be watching. An FDA training deck on the purchasing process says the frequency and extent of supplier re-evaluation may rest on the supplier's performance as shown by statistical monitoring, complaints and nonconformities tied to its product, and corrective or preventive actions related to the supplier. Choose your own triggers, for example a repeat defect, a rejected response or a missed due date, and check that the software turns them into a visible status change and a new review date instead of an email.

Core Capabilities

Incoming inspection: a decision on a lot, not an estimate of quality

The NIST engineering statistics handbook describes acceptance sampling as picking a sample at random from a lot and using what it shows to decide the lot's disposition. It adds that the main purpose is to decide whether the lot is likely to be acceptable, not to estimate its quality, and that such plans test short-run effects while quality control is the long-run discipline around them. Three consequences follow for software.

First, an accept or reject result is meaningful only with the lot, the part revision, the sample size and the plan that produced it, so all four belong on the record. Second, a pass says little about whether the supplier's process is capable; a string of passes should not quietly convert into qualification. Third, if the software lets sampling become stricter or lighter, the rule for that change should be yours, with an approver, rather than a vendor default. 1factory's profile describes receiving-inspection plans, certificates, dimensional or visual results, supplier scorecards and stricter or reduced sampling by part and supplier risk, while noting that any sampling change still needs an approved statistical policy and that incoming quality may not sit within the purchased quality-control scope.

Approved status and what should reopen it

Approval is a status attached to a supplier and a scope, and it needs triggers that can change it. FDA's October 2025 draft guidance on quality management system information (nonbinding, and written for premarket submissions) describes ISO 13485 purchasing controls as criteria for evaluating and selecting suppliers based on their ability to meet requirements, their performance and the effect of their product on the device, in proportion to risk, plus a plan to monitor and re-evaluate them and an account of how failures to meet purchasing requirements are handled. The FDA purchasing deck listed above tells auditors to prioritise suppliers with problems in supplied product and newly approved suppliers, to be wary of a one-size-fits-all approach, and to look for a written agreement under which suppliers tell the buyer about product changes.

Two points about the US text itself. Part 820, as it stood in the eCFR on 29 September 2026, requires a manufacturer to document a quality management system that complies with the applicable requirements of ISO 13485, and the version we read contains no separate purchasing section; supplier controls arrive through the incorporated standard, which this guide has not reproduced. Part 820 also says it does not apply to makers of components or parts of finished devices, so a supplier may sit outside the rule that binds you, and your purchasing agreement is what carries your requirements to it. This is buyer context for medical device makers, not legal advice, and other sectors have other requirements.

Production part approval (PPAP) as a concept

PPAP was developed by the Automotive Industry Action Group for the automotive supply chain. A customer's published supplier manual (2018 revision) gives its purpose as evidence that the customer's design and specification requirements are understood and met, and that the supplier's process can consistently meet them in a production run at the quoted rate. The same manual leaves the decision to require a submission with the customer and lists triggers such as a new part, a new supplier, a changed material or sub-supplier, tooling moved to another site and a change in test or inspection method. A general reference summary describes five submission levels that set how much evidence goes to the customer, with a Part Submission Warrant summarising the package.

We did not read the AIAG manual, so this guide does not list the required elements. If PPAP matters to you, ask the vendor to show your own submission elements being collected, reviewed and approved for a named part revision, with the approval status, the submission level and any re-submission date held on the record, rather than accepting a checkbox labelled PPAP.

Scorecard limits and supplier audit follow-up

A scorecard is a summary of lots, requests and dates, and a summary hides its denominator. Two suppliers of different parts, order volumes and risk levels are not comparable on one number, and this guide does not rank suppliers or products. Judge a scorecard by whether each figure opens the lots and requests behind it, whether the weighting is yours to set and whether a supplier can see its own entries.

Audit findings need the same trail. FDA's FAQ on the quality management system regulation answers yes to whether inspectors may review supplier audit reports, which the former rule had exempted, and says the exception was not kept. Whatever your sector, keep each audit finding linked to the request it created, the response, the verification and the supplier's status afterwards. The audit platform guide covers the audit side in more detail.

What the software must hold at each step

Worked example (fictional): one rejected lot of gaskets

Distinguish qualification from part acceptance

The exercises on this page are proposals for a vendor demonstration; none reports a result from testing done for this guide. Take a typical record, one deliberate mistake and the user roles you need, then write down what was shown, under which configuration, and what is still open.

Ask the vendor to show permissions, earlier values and the export you would use on exit. Check the quote for outside contributors, reviewers, API access, migration, validation support and training. A published connector or API page is not evidence that a customer has completed that integration.

Buyer acceptance criteria

Researched products whose records name supplier quality work

Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

Same rule for every product: tagged “Quality Management”, “CAPA Management”, “Nonconformance”, “Nonconformance Management” or “Supplier Management”, with a sourced supplier quality (corrective requests, incoming inspection, qualification or supplier audits) capability in its record, or one the vendor stated to us, labelled as vendor-stated. 26 qualify; the first 8 are shown, then the other 18.

• Effivity

  Documented: Supplier approval and incoming inspection linkage. Source: effivity.com

• SimplerQMS

  Documented: Supplier qualification records. Source: simplerqms.com

• 1factory

  Documented: Incoming inspection and risk-based sampling. Source: 1factory.com

• Greenlight Guru

  Documented: Supplier qualification and monitoring. Source: greenlight.guru

• qmsWrapper

  Documented: Audit management. Source: qmswrapper.com

• QT9 QMS

  Documented: Supplier qualification and portal evidence exchange. Source: qt9software.com

• SafetyChain

  Documented: Supplier evidence and corrective requests (conditional). Source: safetychain.com

• Scilife

  Documented: Audits, findings and supplier qualification (conditional). Source: scilife.io

Questions for the vendor