When a vial lot fails halfway through a validated sequence, the audit you should have done last year suddenly becomes the most urgent project in the lab. Supplier audits are unglamorous until the day they save you a requalification.
I sat through one where the supplier proudly walked us past a wall of calibration certificates, then we found their raw-material intake records were kept on a whiteboard. Wiped weekly. That single finding changed our whole assessment, and it is exactly the kind of thing no quote or catalog page will ever tell you.
Here is a 12-point checklist you can carry into the meeting, whether the audit is on-site, remote, or somewhere in between.
The Short Answer
A consumables supplier audit checks whether the factory behind the catalog can consistently make what it claims. Cover 12 areas: quality management system, document control, incoming material control, production environment, process control, calibration, personnel training, lot traceability, change control, nonconformance handling, storage and shipping, and data integrity. Score each, classify the findings, and require corrective actions with deadlines.
Below is what to actually look for in each area, the red flags I have learned to watch for, and how to close out the audit without it turning into a paperwork exercise.
1. Quality Management SystemStart at the top. Does the supplier hold a real, current ISO 9001 certificate (or ISO 13485 if you buy sterile or diagnostic-adjacent items), issued by an accredited certification body? Check the certificate number and scope, not just the logo on the email signature (ISO 9001:2015).
Then ask to see the internal audit program and the last management review. A QMS that has never found a problem is not a good QMS; it is a blind one. Red flag: a single laminated quality policy and nothing behind it.
2. Document Control
Every SOP your process depends on should have a version number, an approval date, and an owner. Pull one SOP at random and ask how they know everyone on the floor is working from the current version.
The audit itself should be built on this same discipline. A good reference framework walks through quality policy, document control, and record retrieval as the backbone of supplier audits (CASRAI supplier audit guide). If the supplier cannot retrieve a two-year-old batch record in ten minutes, assume they cannot retrieve it for you either.
3. Incoming Material Control
Your vial is only as good as the glass tubing and resin pellets they started with. Ask how incoming raw materials are qualified, sampled, and released. Who is their glass supplier, and how is that supplier controlled?
Red flags: no approved-subsupplier list, or incoming inspections that only happen “when something looks wrong.”
4. Production Environment
For molded plastic consumables, look at the molding hall: dust control, segregated areas for sterile items, and whether packaging happens in the same room as molding. For vials, look at where silanization or cleaning happens and how wash-water quality is monitored.
The level of control you should expect scales with the claim. Dust-free packaging and sterilization are different tiers of promise, and our dust-free packaging vs sterilization guide breaks down what each claim actually requires.
5. Process Control
How do they know every cycle, every batch, every shift ran within limits? You want to see batch records that are filled in as production happens, not reconstructed at the end of the week. Ask to see one complete batch record from a recent lot, including any deviations.
Red flag: batch records with suspiciously uniform handwriting and zero corrections. Real processes generate real deviations.
6. Equipment Calibration and Maintenance
Check that measuring equipment (dimensional gauges, balances, thermometers) has calibration stickers traceable to a national standard, and that preventive maintenance schedules exist and are actually followed. A dropped gauge or a missed PM is how dimensional drift sneaks into 100,000 vials.
7. Personnel Training
Ask for training records tied to specific job functions, with competency checks rather than just attendance sheets. The operator who has run the line for nine years is an asset; the one who was shown the job once in 2019 is a risk.
8. Lot Traceability
This is the item I weight heaviest. Pick a lot number and ask them to trace it backward to raw materials and forward to shipments. Well-run suppliers do this in minutes. The exercise should end with a real answer, including which customers received the lot (CASRAI guide).
This also connects to your side of the fence: incoming inspection only works when lot identity survives the trip. If you have never stress-tested this, our lot failure playbook shows why traceability speed decides how painful a failure becomes.
9. Change Control
Ask directly: if you change a mold, a resin supplier, a cap design, or your packaging, when do I hear about it? The correct answer is “before, in writing.” The dangerous answer is “our quality is the same either way.”
Consumable changes can invalidate methods downstream. Regulated labs already know that incoming components must meet acceptance criteria and be re-examined after changes, the way pharmaceutical quality rules handle components (eCFR 21 CFR 211.84). Even if you are not a pharma lab, the logic transfers: change without notification equals revalidation you did not plan.
10. Nonconformance and CAPA
Every factory produces defects. The difference between a good supplier and a bad one is what happens next. Ask to see their CAPA log: how findings are root-caused, closed, and verified. A blank log is a red flag, and so is a log with 200 entries and zero repeat findings.
11. Storage, Handling, and Shipping
Walk the warehouse. Look for FIFO labeling, temperature and humidity where it matters, packaging that protects products in transit, and clean staging areas. Septa that sit for two years in a hot container arrive harder and crackier; storage conditions explain a surprising number of “mystery” field failures. Your own shelf has opinions on this too, and the storage side of that discipline is its own topic.
12. Data Integrity
Increasingly the last item, and increasingly the first question regulators ask. Electronic records behind certificates and test data should be attributable, legible, contemporaneous, original, and accurate, with access control and audit trails. The ALCOA+ framework is the shorthand (CASRAI audit guide).
Whiteboard batch records, shared logins, and test data edited “to make it match” are all fail conditions. No refund policy compensates for unverifiable data.
How Long and How Deep
A focused desk audit of one product line can run half a day: documents reviewed in advance, a video walkthrough of the relevant lines, and a trace exercise over screen share. A full on-site audit of a molding and assembly site usually needs a full day, sometimes two if sterile or OEM lines are in scope. The depth should follow the risk tier of what the supplier makes, not the convenience of the calendar (CASRAI supplier audit guide).
Whatever the format, protect the trace exercise. It is the one agenda item that cannot be faked with a tidy meeting room, because it requires real records for a real lot in real time.
Scoring and Closing Out the Audit
Classify each finding as critical, major, or minor. Critical means immediate risk to product quality or a regulatory violation; major means a systemic control breakdown; minor means an isolated lapse. Then require corrective actions with dates, verify them with evidence (photos, revised documents, a follow-up call), and only then close the finding (CASRAI guide).
Two practical notes from audits I have sat through:
- A conditionally approved outcome with dated corrective actions is a normal, healthy result. A clean score on a first audit usually means you did not look hard enough.
- Re-audit cadence should follow risk. High-volume or method-critical suppliers earn an annual look; low-risk vendors can be reviewed on documentation every two to three years.
And write the report while it is fresh. Findings recorded the same day carry specific detail (the gauge number, the lot, the operator’s exact words) that becomes a vague paraphrase by the weekend. The report is the audit’s only durable output; treat it with the same care you expect from the supplier’s batch records.
And if the audit goes badly enough that you need to exit, do it without breaking the lab: a parallel-run transition, where the new supplier ships alongside the old for one full order cycle, keeps operations moving while you make the change.
Before the Audit: Preparation That Decides the Outcome
Most audit value is created before anyone sets foot in the factory. Walk in unprepared and you will spend the day being shown the tour route; walk in prepared and you control the agenda.
Preparation that pays:
- Define the scope in writing. Which product lines, which processes, which claim tiers (standard, dust-free, sterile)? An audit without scope becomes a pleasant conversation.
- Send a document request two weeks ahead. Certificates (with scope and expiry), the last internal audit report, the CAPA log summary, org chart for the quality function, and a sample blank batch record. What they send, and how fast, is itself audit data.
- Pull your own history first. Complaints, lot rejections, dimensional drift, delivery slips. Every finding on your side is a question for their side, and suppliers take an auditor with data more seriously than one with opinions.
- Plan the unscripted parts. Decide in advance which three records you will ask to trace (one per product line), because trace exercises done live are the highest-signal hour of any audit.
Assign roles if you bring a team: one person talks, one person writes, and the quiet one watches the floor. Three sets of eyes catch what one pair misses, especially the small things (an uncalibrated gauge on the wall, a waste bin where a documented flow says nothing should be).
Five Red Flags I Have Seen More Than Once
Some findings repeat across suppliers and years. Watch for these specifically:
The tour route is cleaner than the plant
If the walkway walls are freshly painted but two rows over the same process shows clutter and unlabeled chemicals, the audit route is a set. Ask to see a process that is not on the agenda.
Batch records with no corrections
Real production generates deviations, crossed-out entries, and initials. A blank record is a reconstructed one, written for visitors.
Quality staff who cannot answer technical questions
If the quality manager cannot explain how a DNA-free claim is tested, or what the acceptance criteria for septa thickness are, the claims are coming from the sales department.
Certificates older than the current production
An ISO 13485 certificate that expired last quarter, or a scope that lists a different factory address, means the audit you prepared for and the site you are auditing are not the same thing.
“We can start that procedure next month”
Controls that do not exist on audit day do not exist. A promised future procedure is a finding, not a pass.
None of these is automatically disqualifying. All of them demand a written finding and a corrective action with a date, because each one has personally cost a lab somewhere a failed lot.
After the Audit: Closing Findings Without Drama
The audit report is where amateurs stop and professionals begin. A useful report classifies every finding (critical, major, minor), cites the objective evidence for each, and proposes a corrective action with a deadline and a verification method. Skip the evidence citation and every finding becomes negotiable; skip the deadline and none of them close.
Then comes the part that actually improves the supplier: verification. A corrective action is closed by evidence (a photo of the revised log, the updated SOP with version number, a re-run of the trace exercise), not by an email saying “done.” For major findings, verify in person or by live video at the exact location. I once watched a “closed” finding reopen in ninety seconds when the cabinet that was supposed to hold controlled documents turned out to hold mop heads.
Finally, feed the outcome back into your supplier file: the risk tier, the next audit date, and any conditions attached to continued approval. That file is what your own customers and assessors will ask to see, and it is the difference between a supplier-control program that exists on paper and one that exists in fact.
Conclusion
A supplier audit is not about catching anyone out. It is about answering one question: can this factory make the same product, to the same standard, for the next three years? Walk the 12 points, from quality system to data integrity, and let the findings classify themselves. Score honestly, demand dated corrective actions, and match your re-audit frequency to the risk each supplier carries. The labs that do this sleep better during lot failures, because they already know how their supplier behaves under pressure. If you are building the surrounding system, our procurement manager’s guide and the CoA vs CoC explainer are the natural next reads, and they slot directly into the paperwork this checklist will generate.
Frequently Asked Questions
How often should a lab consumables supplier be audited?
Base it on risk, not the calendar alone. Method-critical, high-volume suppliers deserve an annual audit, on-site if possible. Low-risk vendors can be covered by a documentation review every two to three years. Tier your suppliers and set the cadence per tier.
What is the difference between a supplier audit and vendor qualification?
Qualification happens before you buy: it establishes that the supplier can meet your requirements. Auditing happens after you buy: it verifies they are still meeting them. Most programs run an initial qualification, then repeat audits at a risk-based interval.
Can a remote audit replace an on-site audit?
Partly. Remote audits handle document reviews and interviews well, but they miss the warehouse walk, the molding hall, and the body language around uncomfortable questions. Use remote audits for lower-risk tiers and keep on-site audits for critical suppliers.
What is the biggest red flag in a supplier audit?
Batch or test records that cannot be traced, or that look reconstructed. If the supplier cannot show you what happened on a specific day for a specific lot, no certificate they issue afterward carries much weight.
