Supplier qualification
The documents your purchasing controls procedure asks for, in one request.
Quality policy, Form W-9, mutual non-disclosure agreement and independence declaration: four documents assembled to answer a procedure written against 21 CFR 820.50 or ISO 13485 clause 7.4.1, and sent on request. What sits outside the pack, and what answers it instead, is listed beside them.
In short
What a supplier qualification record has to show
Supplier qualification is the record showing you evaluated an outside supplier before you bought from them, and set how much control you apply. For a packaging validation consultant that means competence, quality system, confidentiality, independence and vendor setup. Four documents answer four of those and are sent on request. Competence is evaluated from the published work: the methodology, the worked arithmetic and the clause citations behind it are all on this site, free to read.
The obligation
What your procedure is actually asking you to prove
Your file is the one that gets read. An investigator or a notified body auditor asks you for the evaluation record, and what we control is whether closing it takes an afternoon or a month of collecting documents one email at a time.
Purchasing controls procedures written before 2026 cite 21 CFR 820.50, which named suppliers, contractors and consultants together and set three obligations: evaluate and select on the ability to meet your specified requirements including quality requirements, and document that evaluation; define the type and extent of control you apply, based on what the evaluation found; and maintain records of acceptable suppliers, contractors and consultants.
Since 2 February 2026 the Quality Management System Regulation has incorporated ISO 13485:2016 into Part 820 by reference, at 21 CFR 820.7(b), and 21 CFR 820.10(a) requires your quality management system to comply with it. So the same obligation is now read at clause 7.4.1 of that standard: documented criteria for evaluation and selection, based on the supplier's ability to meet your requirements and proportionate to the effect of the purchase on the device, with records of evaluation, monitoring and re-evaluation retained.
One disclosure about that last paragraph, because this page sells document control and the rule we publish applies to us first. ISO 13485:2016 is a paid standard and we have not bought it. What clause 7.4.1 contains is stated here from FDA's own published descriptions of it, in the MDSAP audit approach and in the preamble to the Quality Management System Regulation, not from the text of the standard. The regulation sections are free to read and we have read them; the clause is second-hand and we would rather tell you that than let it pass as first-hand.
The two read the same way in practice, so a procedure that still cites the old section number is answered by the same pack and needs no rewriting before you buy.
TABLE 1
Each requirement a purchasing controls procedure places on you, and what answers it. The pack is sent on request, and where the answer sits outside the pack the row says where it comes from.
| Where the requirement comes from | What your file has to show | What answers it |
|---|---|---|
| Where the requirement comes from21 CFR 820.50(a)(1) / ISO 13485:2016 cl 7.4.1 | What your file has to showAbility to meet your specified requirements, evaluated and documented | What answers itOutside the pack: the published methodology, worked examples and clause citations on this site, which show how the work is performed and against which standards. Free to read, with nothing asked in return |
| Where the requirement comes from21 CFR 820.50(a)(2) / ISO 13485:2016 cl 7.4.1 | What your file has to showType and extent of control, decided from the evaluation | What answers itThe decision is yours to make and record. The quality policy is the input to it: scope of work, controls applied, retention period. The quality manual is available on request if you need more to decide |
| Where the requirement comes fromYour outsourcing procedure, where a validation program is treated as an outsourced process | What your file has to showA written quality agreement | What answers itOutside the pack: we work to your quality agreement. Our master services agreement is available on request if you prefer to reference ours |
| Where the requirement comes from21 CFR 820.50(a)(3), where a procedure still cites it, and ISO 13485:2016 cl 7.4.1 for the records | What your file has to showA record of the suppliers you have found acceptable. The words 'contractors and consultants' are the old FDA section's own, and a consultant supplying a service is in scope under the current regulation too | What answers itCompleted Form W-9, so vendor setup can proceed. The pack is the evidence you evaluate; the record of acceptable suppliers stays yours to establish and maintain |
| Where the requirement comes fromYour confidentiality procedure | What your file has to showConfidentiality in force before any document moves | What answers itMutual non-disclosure agreement, our template or yours |
| Where the requirement comes fromYour conflict of interest procedure | What your file has to showThat the adviser does not profit from what the advice recommends | What answers itIndependence declaration, signed |
21 CFR 820.50 is listed because procedures written before February 2026 cite it. Since 2 February 2026 the operative text is ISO 13485:2016, incorporated into Part 820 by the Quality Management System Regulation. The pack answers either wording.
The pack
Four documents, sent on request
Each document below goes to a named person at a named company, which is how a supplier qualification pack normally moves. What is in each one is described here, so you can decide what your file needs before you ask.
- Quality policy
PDF
Type and extent of control
One page, signed and dated. It states the scope of work, the controls applied to it, and the record retention period, which is seven years from the close of an engagement. The quality system beneath it is aligned with ISO 13485 supplier control expectations, and the full quality manual is available on request if your evaluation needs to read the system rather than the summary of it.
- Form W-9
PDF
Vendor setup
Completed and signed, ready for accounts payable. It is in the pack because vendor setup is where a supplier file can stall over a document that takes two minutes to produce.
- Mutual non-disclosure agreement
PDF
Confidentiality
Our template, ready to sign, or send yours and we work to it. It is mutual, and it is signed before the first document moves, because what you send is unreleased product drawings, packaging specifications and sterilization records.
- Independence declaration
PDF
Conflict of interest
A signed and dated statement, which is the difference between an independence claim and an independence control. Your samples go to the accredited laboratory that fits the method and the schedule, and we hold no ownership or financial interest in any of them, so the choice is made on merit. We have no packaging, film, tray, pouch or sealing equipment to sell you, so a recommendation can only ever be about your evidence. Laboratory charges are passed through at cost and our handling appears as its own disclosed line on the invoice, so the margin is visible rather than buried in a test price. Our fee comes from you and from nowhere else: no commission, referral fee or rebate reaches us from a laboratory or a supplier, and any referral fee paid to a third party in connection with your work is disclosed to you. That is what your conflict of interest procedure can point at, in writing.
The absences
What is not in the pack, and what answers it instead
A supplier evaluation is partly a search for what is missing, so four absences are worth naming here rather than leaving you to find them. Each one has something standing in its place, and both halves are below.
- No ISO/IEC 17025 accreditation certificate
We hold none and we claim none. Accreditation attaches to the entity that generates the test data, which is the laboratory, and that is where the certificate belongs. The control that matters to your file sits inside the method instead: accreditation is scope specific, so a laboratory can hold ISO/IEC 17025 and still not be accredited for the method your device needs. The method requires, for every program, a record of which laboratory was selected, the accredited scope verified for each method, and why that laboratory rather than another.
- No ISO 13485 or ISO 9001 certificate
The quality system is aligned with ISO 13485 supplier control expectations, and the quality manual is available on request so your evaluation can read the system itself and form its own view. A certificate we do not hold is worth less to your file than a manual you have actually read.
- References, and what you can weigh right now
References come from real engagements and are given on request, never published as a logo wall and never invented: a reference that did not happen is worth nothing to your file and is not worth the firm to give. What your evaluation can weigh right now is already in front of you: the documents in this pack, the method published on this site down to the arithmetic behind an aging schedule, and thirty minutes on a call about your device.
- Continuity from the first call to the filed report
The specialist on your call writes your protocols, and that same specialist answers a regulator's question about them two years later. The work stays with the person who does it, so nothing is lost in a handover, and that continuity is the part worth writing into your file. If your criteria set an expectation about named independent review inside a supplier, raise it before you buy and you get a straight answer on the call, in whatever the true state is on the day.
Closing the file
How the rest of your evaluation gets done
- Ask for the pack
One email, naming the documents your procedure needs and the person they should go to.
- Send your own questionnaire if you have one
Some quality systems require the supplier to complete your own form rather than accept a pack. Send it, and it will be returned completed in your format.
- Send your quality agreement
Where your procedure asks for a written quality agreement because a process affecting product conformity is outsourced, we work to yours, and if a clause in it conflicts with something in our own terms we tell you which clause before signature rather than after. Our master services agreement is available if your procedure prefers the supplier's paper.
- Schedule an audit if your procedure calls for one
Remote or on paper, at the level your risk assessment sets. Send the scope and the questions, and it is scheduled around the date your file has to close.
Re-evaluation
What re-evaluation asks for, eighteen months from now
Clause 7.4.1 of ISO 13485:2016, as FDA describes it, asks for records of monitoring and re-evaluation, not just of the initial selection. The method therefore closes each program with a delivery record written for that purpose: what was delivered, on what date, against what was agreed, every deviation raised and how it was handled, and the laboratory used with its accredited scope for each method. When re-evaluation comes round, supplier performance is a document you already hold rather than an email thread you have to reconstruct.
Supplier file questions
Answered in the order a supplier file asks them
- Do you hold ISO/IEC 17025?
No. Accreditation attaches to the laboratory that generates the data, and the laboratory selected for your program holds it, with its scope verified for each method before any samples ship.
- Are you certified to ISO 13485?
No. The quality system is aligned with ISO 13485 supplier control expectations and the quality manual is available on request, so your evaluation can read the system rather than take a certificate's word for it. Anyone in this field who blurs the line between aligned and certified is worth a second look.
- Who owns the validation?
You do. You are the manufacturer. Protocols, data and deliverables are your property from the day they are written, and our name is never in your approval block.
- Can you guarantee our submission clears?
No. Nobody can, and a guaranteed outcome is the documented red flag your own supplier evaluation exists to catch. What is committed to is scope, schedule and the sampling rationale in writing, plus regulatory-response support for 24 months after delivery: four hours included in a validation program, one hour in a gap assessment, and chargeable at the rate in your statement of work beyond that. It covers questions from a regulator, notified body or certification body about our work.
- Do you work for our competitors?
Client names stay confidential in both directions: yours is never mentioned to anyone else, and nobody else's is mentioned to you. The mutual agreement is what makes that binding rather than polite. If a specific conflict would matter to you, name it before we start and you will get a straight answer on whether it exists.
- How long do you keep our records?
Seven years from the close of the engagement. Your own retention obligation is separate and longer in most cases, which is why every deliverable is issued to you in a form you can file rather than held on a portal.
- Can we use this pack if we only ever buy a gap assessment?
Yes. The gap assessment is designed to be the smallest purchase that opens the file, and the pack does not change between a gap assessment and a full program. Whether one evaluation record then covers both is your call, not ours: clause 7.4.1, again as FDA describes it, asks you to set control proportionate to the effect of the purchase on the device, and a program that involves laboratory testing and an outsourced process may sit at a different level in your procedure than a document review does.
Ask for the pack, or bring your questionnaire to a call
An email starts it, and the documents go to whoever your procedure names. If you would rather ask the questions out loud before you file the evaluation, the call is thirty minutes, it is your questions rather than slides, and your own questionnaire is welcome on it.
Book a 30-minute callRead the background behind the work