Supplier Qualification: FDA Requirements, 8-Step Process and Checklist

Supplier qualification is the documented process a manufacturer uses to prove, before and after approval, that a supplier can consistently deliver components, materials or services that meet its specifications and GMP requirements. For drugs, FDA anchors it in 21 CFR 211.84: an identity test on every lot, and reliance on a supplier's certificate of analysis only after you validate the supplier's results. For devices, ISO 13485 clause 7.4.1 applies under the QMSR.

This guide adds what generic checklists leave out: how often FDA investigators cite supplier control, measured across the Atlas Form 483 directory (release of August 15, 2026, forms issued January 2025 to July 2026), and how to read a supplier's own FDA record before you approve it.

Key facts:

• 21 CFR 211.84(d)(1) requires at least one identity test on each component lot, whatever the supplier's CoA says.
• Under 211.84(d)(2), a supplier's report of analysis can replace your other tests only after you establish the supplier's reliability by validating its results at appropriate intervals.
• In the Atlas directory, 21 CFR 211.84 appears on 22% of 779 human drug Form 483s that cite Part 211, issued January 2025 to July 10, 2026.
• ISO 13485 clause 7.4.1 appears on 62 of 349 device Form 483s (18%) issued after the QMSR took effect on February 2, 2026.
• No FDA regulation sets a fixed supplier audit interval; the frequency comes from your own risk assessment under ICH Q9.

What does FDA require for supplier qualification?

FDA requires supplier qualification through several specific rules, not one "supplier qualification" regulation. The drug GMPs set the testing and approval duties, ICH guidelines set the expectations for API makers and for the quality system, and the device QMSR adopts ISO 13485 purchasing controls.

Two points from the text are worth carrying into your procedure. ICH Q10 3.2.3 (change management) applies when a supplier changes its process or site, and ICH Q7 13.17 obliges API makers to notify dosage form manufacturers of changes that can affect API quality. Your quality agreement should require that notice in writing; our guide to FDA quality agreements covers the clauses.

How often does FDA cite supplier control on Form 483s?

FDA cites supplier control often enough that you should expect an investigator to ask for your supplier files. In the Atlas Form 483 directory (release of August 15, 2026), 21 CFR 211.84 appears on 22% of the 779 human drug Form 483s that cite Part 211, issued January 2025 to July 10, 2026. For comparison, 211.22 appears on 45% of the same forms and 211.192 on 38%, and both often sit next to 211.84.

The device side tells the same story. Of 349 device Form 483s issued from February 4 to July 17, 2026, after the QMSR took effect, 86 (25%) cite a purchasing clause, and clause 7.4.1 alone appears on 62 (18%). For 2026 drug forms alone, 33 of 323 human drug 483s issued January 8 to July 10 cite 211.84 (10%), and 23 of those 33 also cite 211.22. When the investigator finds a component problem, the quality unit that released the component usually gets cited too.

Four recent Form 483s show what the observations look like:

• iCRco, Inc., Goleta, California, July 17, 2026: two observations, one under clause 7.4.1 for records of supplier evaluation, selection and monitoring not maintained.
• Fresenius Medical Care Renal Therapies Group, Waltham, Massachusetts, June 3, 2026: six observations, including criteria for supplier evaluation and selection not established (7.4.1).
• American Regent, New Albany, January 29, 2026: four observations, including 211.84(e) on rejecting components that fail specifications, next to 211.22(d) and 211.192.
• Novel Laboratories (Lupin Somerset), Somerset, New Jersey, April 17, 2026: three observations, including 211.84(b) on representative sampling of incoming components.

A buyer qualifying any of these companies can read the same records to see what FDA found at its last visit, which is the cheapest input to step 3 of the process below.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

What are the steps in the supplier qualification process?

The supplier qualification process has eight steps, and the depth of each step depends on the risk tier you assign in step 1. A low-risk carton supplier may finish in a questionnaire and a document review; an API maker goes through every step with an on-site audit.

1. Risk classify the supplier. Rank the material or service by its effect on product quality and patient safety (API, sterile component, excipient, printed packaging, general service) using ICH Q9 risk tools. The tier sets the audit type and frequency.
2. Send a questionnaire. Ask for QMS scope, certifications, manufacturing sites, sub-suppliers, testing capability, and whether the supplier will notify you of changes.
3. Review documentation, including FDA history. Check specifications, sample CoAs, licenses and registrations. Pull the supplier's FDA inspection history: dates, outcomes, Form 483 citations, any warning letter or import alert. A supplier with a 211.84 or 211.192 citation in its own history tells you where to look during the audit.
4. Audit the supplier. Choose on-site, remote or paper (questionnaire-based) by tier. Record findings, agree CAPA with dates, and keep the report in the supplier file.
5. Sign a quality agreement. Define who tests what, who releases, change notification, audit rights, complaint and deviation handling, and data access, as ICH Q10 2.7(b) asks for outsourced work.
6. Approve the supplier. The quality unit approves under 211.22 and adds the supplier to the approved supplier list for the named materials and site only.
7. Monitor performance. Track lot acceptance, CoA verification testing, deviations, complaints and SCARs on a scorecard. Under 211.84(d)(2) and ICH Q7 7.31 you retest at appropriate intervals to keep CoA reliance valid.
8. Requalify. Re-audit on the tier cycle and also on events: a new Form 483 or warning letter at the supplier, a site or process change, or a trend of rejected lots. When a supplier fails, our SCAR process guide sets out the corrective action request.

How often should you audit a supplier?

Supplier audit frequency is set by your own risk assessment; FDA, ICH Q7 and ISO 13485 require planned re-evaluation but do not fix an interval. The frequencies below are common industry practice, not regulation, and an investigator will accept a different cycle if your risk rationale is written down and followed.

Remote audits are a common choice for tier 2. Investigators ask how a remote audit verified records and premises, so record what you saw live and what you only received as documents. For foreign suppliers, check the date of the last FDA inspection at the facility; our analysis of FDA foreign inspections shows how unannounced visits have changed that picture.

What goes on a supplier qualification checklist?

A supplier qualification checklist lists the evidence your supplier file must hold before the quality unit signs approval. Use it at step 6 and again at each requalification.

How do you check a supplier's FDA inspection history?

You check a supplier's FDA inspection history by finding its facility record, reading every inspection outcome, and then opening the Form 483s to see which sections FDA cited. Start at the FDA facility lookup, search the supplier name and city, and confirm you have the right site, since one company can run several facilities.

The Novel Laboratories (Lupin Somerset) facility page shows what a full record looks like: 20 FDA inspections on record, 16 of them ending in a Form 483, a warning letter outcome for the 2020 inspection, and a 2026 Form 483 citing 211.84(b), 211.192 and 211.22(d). The American Regent New Albany page lists 7 inspections and 5 Form 483s, with 211.22(d) cited four times across them. Both pages also name the investigators, which tells you whether a repeat citation came from the same person.

Read the record for three signals: a supplier-control or laboratory section cited more than once, a warning letter in the last five years, and a gap since the last inspection. For a large overseas supplier group, our Mylan and Viatris India inspection history applies the same reading to Viatris facilities in India. Add what you find to the supplier file and set your audit agenda from it.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe