Supplier Quality, COA & External Manufacturing — Controlling What Comes In (and What Partners Do in Your Name)

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated November 2025 • supplier quality management, vendor qualification, COA verification, incoming inspection, quality agreements, external manufacturing, SCAR, NoC, purchase-to-pay controls, traceability, VMI & 3PL flows • Pharma, Biologics, Devices, Food & Beverage, Meat, Bakery, Cosmetics, Dietary Supplements, Chemicals

Supplier quality and external manufacturing are where your plant’s quality system collides with everyone else’s reality. You can have perfect recipes, batch records and traceability inside your sites; if suppliers cut corners or contract manufacturers improvise, you own the consequences.

Regulators and customers know this. That’s why frameworks like GMP, ISO 9001/13485, GFSI and QMSR all lean hard on supplier controls, quality agreements, COA verification and oversight of external parties. A MES-only view that starts at goods-in is 10 years out of date.

“If you treat supplier choice as purchasing’s problem and CMO behaviour as ‘out of scope’, you haven’t outsourced risk. You’ve just moved it outside your firewall without a plan.”

1) Why supplier quality matters more than ever

Modern supply chains are brittle. Single-source actives, global ingredient suppliers, outsourced manufacturing, 3PL warehouses and contract labs mean that a lot of your risk footprint lives outside your four walls. Trends making this worse:

• Complex formulations. More functional ingredients, pre-blends, excipients and flavour systems; more chances for contamination, mislabeling, potency variance and adulteration.
• Cost pressure. Continuous pressure to switch to cheaper suppliers and regions, often with less history and weaker oversight.
• Regulatory scrutiny. Recent nitrosamine, allergen, cosmetic safety and food-fraud scares have made “supplier did it” an unacceptable explanation.
• External manufacturing models. Use of contract manufacturers (CMOs/CDMOs) and 3PLs where you may not see daily operations but you still own the product licence and liability.

Frameworks like GMP/cGMP, ISO 9001, ISO 13485, GFSI, BRCGS and SQF respond by putting supplier and external-party controls right in the spotlight.

2) Vendor Qualification (VQ) & Supplier Quality Management (SQM)

The starting point is choosing who you will trust with your raw materials and services. Two key entries:

• Vendor Qualification (VQ). Vendor Qualification covers initial assessment: questionnaires, audits, technical evaluations, financial checks, capability reviews and pilot orders.
• Supplier Quality Management (SQM). SQM is the ongoing process: monitoring performance, complaints, deviations, SCARs, audit findings and improvement actions over time.

In a mature SQM programme, each supplier has:

• A risk classification (critical, major, minor; strategic vs tactical).
• Approved product lists and specifications they are qualified to supply.
• A history of quality events (NCMRs, SCARs, audits, lab failures).
• Performance metrics (on-time, right-first-time COA match, complaint rates).

V5 QMS is where a lot of this lives (SQM, SCAR, audits), but the evidence for it comes from WMS/MES/LIMS: rejects at intake, OOS results, deviations triggered by raw materials, and so on.

3) Purchase orders, procurement & receiving control

The link between SQM and operations is the purchase-to-pay process. Your glossary already pinpoints the control points in:

• Purchase orders, procurement & receiving control. POs, procurement & receiving control describes how POs are created, approved and matched against receipts and invoices.
• Country of Origin (COO). COO captures origin details needed for labelling, tariffs and sometimes risk (e.g. allergen controls, feedstocks, regulatory regimes).

V5 fits here as follows:

• ERP (or QuickBooks) defines POs and suppliers, consistent with SQM decisions.
• V5 WMS receives POs and uses them at goods receipt to create lot records with supplier, COO, spec version and COA requirements.
• V5 QMS may require certain ingredients or suppliers to trigger extra checks or approvals before POs are released.

If POs can be raised for unapproved suppliers or specs, your SQM is already leaking before materials arrive.

4) COA verification, incoming inspection & identity testing

Once materials arrive, you need to confirm reality matches promises. That’s where:

• Supplier verification of COAs. Supplier verification of COAs describes how you check certificates of analysis from suppliers: identity, assay, impurities, micro, physical properties.
• Certificate of Analysis (CoA). CoAs summarise tests and results per lot supplied.
• Incoming inspection. Incoming inspection adds visual, packaging, labelling and sometimes physical checks (e.g. organoleptic, dimensions, damage).
• Identity testing. Identity testing may be required by regulations (e.g. certain APIs, excipients) or risk assessments.

In V5 terms:

• Lots arrive in quarantine status in WMS until COA checks and lab testing are complete.
• LIMS and QMS workflows handle COA verification, sampling and testing; once results pass, V5 updates lot status to released.
• MES/WMS will simply not allow quarantined lots to be picked or consumed.

This turns “COA verification” from a paper exercise into a gating condition on what can be used or shipped in the system.

5) Quality agreements & external manufacturing (CMOs, CDMOs, 3PLs)

For many companies, some or all production is outsourced. Your glossary hits this with:

• Quality agreements (sponsor–CMO expectations). Quality agreement entries define expectations around responsibilities, documentation, change control, audits, deviations, data ownership and regulatory interactions.
• Management of Change (MOC). MOC for process, equipment, materials and systems used at CMOs.
• Notification of Change (NoC). NoC for informing sponsors and regulators of significant changes.

Quality agreements should make explicit:

• Who owns which elements of the QMS (e.g. deviations, CAPA, training, validation) at the CMO.
• How data flows back to you (batch records, lab results, deviations, OOS/OOT, investigations).
• What level of system access or integration you have (e.g. CMO using their own MES vs V5 instance).

V5 can be deployed in several patterns here: as your own system inside your plants, as a shared platform with CMOs, or as the system that aggregates data from CMO exports into your host QMS and CPV universe. In all cases, the goal is the same: your licence responsibilities must be supported by actual data and controls, not just contractual language.

6) SCAR, complaints & supplier performance

Once you are running, the real SQM work is in day-to-day performance:

• Supplier Corrective Action Request (SCAR). SCAR is used when supplier-related nonconformances occur: they document the issue, required investigation, root cause and corrective actions on the supplier side.
• Complaints & returns. Customer-facing issues (defects, mislabelling, contamination) often trace back to suppliers; your returns / RMA and complaint handling glossaries feed into SQM metrics.
• Risk-based supplier review. Recurring SCARs, OOS results, failed audits and high complaint rates should drive reclassification, increased oversight or disqualification.

V5 QMS helps by:

• Linking SCARs directly to lots, batches and COA failures from WMS/LIMS.
• Aggregating supplier performance data across plants and products.
• Feeding SQM metrics into management review and purchasing decisions.

Done well, this closes the loop: supplier choice impacts quality; quality events feed back into supplier choice and management.

7) 3PLs, VMI & external warehouses — not a black hole

Many organisations use 3PL warehouses, consignment stock or Vendor-Managed Inventory (VMI). Even if inventory sits in someone else’s building, you still own:

• Lot traceability and status (released vs quarantined vs blocked).
• Storage conditions and zone segregation (e.g., allergens, temperature, hazard classes).
• Timely and accurate inventory data for planning and recalls.

With V5, there are two main patterns:

• Direct WMS deployment in external warehouses. Using V5 WMS as the operational system at 3PLs, so your bin/lot truth is global.
• Integration with 3PL systems. Using V5 Connect and EDI/ASN integration to keep V5 WMS in sync with 3PL inventory and movements.

Either way, supplier and external-party quality must incorporate 3PL performance: temperature excursions, mispicks, mislabelling and delayed ASNs are all quality-relevant issues, not just logistics cost.

8) How V5 Traceability operationalises supplier quality & external manufacturing

V5 Traceability helps turn SQM concepts into everyday behaviour:

• Supplier-aware receiving. V5 WMS captures supplier, COO, spec version and COA requirements at goods receipt, and routes lots into quarantine until checks are complete.
• Lot status enforcement. MES and WMS simply refuse to use or ship non-released lots, making COA verification and lab testing real gates, not suggestions.
• Integrated SQM & SCAR. V5 QMS links supplier-related issues (NCMR, lab OOS, complaints) to SCAR workflows and SQM dashboards.
• Quality agreements & MOC. V5 QMS manages quality agreements, change notifications and MOC records, providing traceability between external changes and internal configuration updates.
• ERP/QuickBooks alignment. Through V5 Connect, supplier master and PO data from ERP/QuickBooks align with SQM decisions and operational behaviours at intake.

Net effect: supplier quality is not a separate Excel file. It is embedded in how your plants receive, test, approve, consume and ship material every day.

FAQ — Supplier Quality, COA & External Manufacturing

Q1. Isn’t supplier quality mainly a purchasing and audit topic?
No. Purchasing and audits are important, but most signal comes from day-to-day performance: COA mismatches, incoming failures, rejections, complaints, SCARs. Those signals live in WMS, MES, LIMS and QMS. If supplier quality doesn’t have access to that data, it’s flying blind.

Q2. How strict should we be with COA verification vs in-house testing?
It depends on risk, regulations and supplier performance. Some materials and jurisdictions allow heavy reliance on COAs once suppliers are proven; others require routine in-house identity testing or full spec testing. Your supplier verification of COAs strategy should be risk-based and documented, with clear sampling and testing plans per ingredient and supplier class.

Q3. What’s the difference between a SCAR and a normal CAPA?
A CAPA addresses issues within your own organisation; a SCAR is specifically directed at a supplier. Many events will need both: you may change your incoming inspection, and you may also require the supplier to change their process, tests or training.

Q4. How detailed should quality agreements with CMOs/3PLs be?
Enough that there is no ambiguity about who owns which elements of GMP, QMS and data, and how changes, deviations, complaints and inspections are handled. Your quality agreement should be detailed enough that an inspector can see clear lines of responsibility and evidence flows—not just high-level intentions.

Q5. How does this tie into traceability and recalls?
Supplier lots form the “upstream” side of traceability. In a recall, you must know which finished lots used which supplier lots and where they went. Good supplier quality & COA processes ensure that those upstream lots are properly identified, tested, accepted/rejected and linked into genealogy so that mock recalls and mass-balance exercises work.

Q6. Where should we start if our supplier quality programme is mostly spreadsheets and email?
Start with critical suppliers and materials. Capture basic SQM master data (risk, specs, quality agreements), bring COA checks and incoming inspection into a simple digital workflow (V5 + LIMS), enforce lot status in WMS/MES and start logging SCARs and supplier-related deviations formally. Once the high-risk relationships are under control, you can expand to broader supplier segments.

Related Reading (Glossary)
• Supplier & COA: Vendor Qualification (VQ) | Supplier Quality Management (SQM) | Supplier Verification of COAs | CoA | Incoming Inspection | Identity Testing
• External Manufacturing & Change: Quality Agreement (Sponsor–CMO) | Management of Change (MOC) | Notification of Change (NoC)
• Performance & Risk: SCAR | Returns / RMA | Quality Risk Management
• Purchase & Logistics: Purchase Orders, Procurement & Receiving Control | Country of Origin (COO) | Goods Receipt
• V5 Platform: V5 Solution Overview | V5 QMS | V5 WMS | V5 MES | V5 Connect API