The Supplier Audit Checklist Every Raw Material Buyer Needs Before Approving a New Source

Most supplier audits are done wrong.

Not because the auditors are incompetent — in fact, most are experienced quality professionals. The problem is structural: the typical audit checklist is built to find paperwork, not problems. A supplier can produce a thick binder of SOPs, a valid ISO certificate, and a spotless conference room while the actual manufacturing floor tells a completely different story.

We see this pattern regularly. A client receives a new botanical ingredient from a newly approved supplier. The audit report was positive. The certificate of analysis checked every box. But the incoming identity test — HPTLC against a verified reference standard — comes back as a partial match. In one recent case, the ingredient contained less than 40% of the declared active compound. The supplier had passed a desk audit six months prior.

Approving a raw material supplier shouldn’t end with a signed questionnaire and an approved audit form. Here’s what a genuinely rigorous on-site evaluation actually looks like — and why independent analytical testing still has to follow it.

What a Supplier Audit Is Actually Designed to Catch

Under 21 CFR Part 111.70, dietary supplement manufacturers must establish specifications for every component they use in manufacturing. Part 111.75 takes it further: before using any component, you must conduct at least one appropriate test or examination to verify its identity — and you cannot rely solely on the supplier’s certificate of analysis to satisfy that requirement.

EU manufacturers face parallel obligations under EU GMP Part I, Chapter 5, which requires verified specifications and documented supplier qualification before any material enters production.

But regulations set minimums. A well-executed supplier audit catches things that COA review and incoming testing won’t surface on their own: systemic process failures, inconsistent practices between shifts, contamination control gaps, and quality culture problems that predict future OOS events.

Audits and testing aren’t interchangeable. They catch different failure modes. The audit evaluates the system. The analytical testing laboratory verifies the output of that system, lot by lot.

Before You Book the Flight: The Pre-Audit Document Review

A site visit without a thorough pre-audit document review is just a factory tour. Before you arrive, request and critically review the following:

Certificate of Analysis history — at least three consecutive lots of the specific material you intend to purchase. Look for inconsistencies in assay values, method references, or test dates. If potency results are suspiciously uniform — identical out to three decimal places across multiple independent lots — that’s a red flag. Real analytical data has natural variation.

Out-of-specification investigation records — ask specifically whether they’ve had OOS results in the past 24 months, and if so, request the investigation files. A supplier who claims zero OOS events in two years either isn’t testing thoroughly enough or isn’t being honest with you.

Equipment calibration and maintenance logs — note the calibration intervals and who performs them. Third-party calibration of critical instruments is preferable to in-house. And if every instrument in the log was calibrated the week before your visit, document that observation.

Current certifications — ISO 22000, FSSC 22000, GMP certificates, organic or halal certs as applicable. Don’t just accept a certificate in a document package. Verify currency directly with the issuing body where possible.

CAPA log summary — a 12-month summary of open and closed corrective actions is one of the most revealing documents a supplier can share. An empty CAPA log means one of two things: either nothing has ever gone wrong, or nothing ever gets formally investigated. Neither is reassuring.

Most quality teams can complete this review in two to three working days. If the supplier is slow to provide documents or claims certain records are confidential, that itself is a finding worth noting in your pre-audit report.

The On-Site Walkthrough: 8 Things to Examine Beyond the Conference Room

Here’s where most audits fail. Auditors schedule a conference room presentation, work through the document binder, and spend maybe 45 minutes on the manufacturing floor before sitting back down. Allocate a minimum of three hours for the physical walkthrough. Here’s what to evaluate:

1. Raw material receiving and quarantine controls — Is incoming material immediately segregated and labeled “quarantine” until formally released? Or do drums sit in an open warehouse with no status indication? Physical separation between released and unreleased material matters more than a sign on the wall.

2. Material identification at every processing stage — Every container, every tote, every bag should carry a label showing lot number, identity, status, and quantity. Spot-check five containers at random. An unlabeled container anywhere in the process is a critical finding.

3. Cleaning and sanitation practices — Request the cleaning SOP, then compare it against what you actually observe. What’s the validated cleaning protocol for shared equipment? Is there a signed cleaning log for each production run? This is especially critical for allergen control and botanical cross-contamination between runs.

4. Pest control records — A third-party pest control contract isn’t sufficient on its own. Ask to see inspection reports, bait station maps, and any corrective actions from the past 12 months. Rodent or insect evidence in a warehouse won’t appear on a COA, but it will eventually appear in your microbial test results.

5. Temperature and humidity monitoring in storage — Walk to where the actual material is stored — don’t accept a reading from a monitor by the office door. Is the displayed temperature consistent with what’s logged in the system? Do they use continuous data loggers or only manual spot readings? For hygroscopic botanicals or moisture-sensitive excipients, storage conditions directly determine shelf stability.

6. Sampling procedures and execution — Ask to observe a sampling operation or review the SOP in detail. Are operators using dedicated, clean sampling equipment? Is the sampling plan representative of the full lot — randomized across the container, not taken only from the top layer? Flawed sampling is one of the most common reasons a COA fails to reflect actual lot quality.

7. In-house laboratory equipment and documentation — If the supplier operates an in-house QC lab, check instrument status labels and calibration due dates on every major piece of equipment. Pull the analyst training records for two or three people you observe running tests. Ask to see a recent HPLC system suitability report — this tells you whether the instrument was performing within specification at the actual time of testing.

8. Employee training record accuracy — Pull records for three to five employees you observed on the floor and verify that current training covers the specific procedures they’re executing. A gap between what the SOP requires and what employees have been formally trained to do is a systemic finding, not a one-time deviation.

The Analytical Testing Layer That Audits Cannot Replace

A clean audit is encouraging. It is not sufficient.

Even the most thorough on-site evaluation can’t tell you whether the specific lot you’re about to receive meets its specification. That requires independent verification through an accredited analytical testing laboratory operating under ISO/IEC 17025:2017 — not a lab affiliated with the supplier.

For newly approved suppliers, regardless of audit outcome, this is the testing stack we recommend:

Identity testing — For botanical ingredients, high-performance thin-layer chromatography (HPTLC) against authenticated reference standards remains the gold standard. DNA barcoding is a useful secondary method but performs poorly with heavily processed or dried materials where DNA is degraded. USP chapter <561> provides framework guidance for botanical articles. For non-botanical raw materials, FTIR and NMR are the primary identity tools.

Potency and assay — HPLC is the standard method for most active constituent assays. For the first three to five shipments from any new supplier, test 100% of incoming lots. Once consistent results establish a documented track record, you can move to a skip-lot or reduced sampling program.

Elemental impurities — USP <232> and <233> establish limits and validated procedures for elemental impurities including lead, arsenic, cadmium, and mercury. Botanical ingredients sourced from certain growing regions in South Asia and parts of northern China have historically shown elevated heavy metal content that supplier COAs sometimes underreport.

Microbial enumeration and pathogen screening — USP <2021> for microbial enumeration and <2022> for specified organisms provide the testing framework. For high-risk botanical raw materials, additional Salmonella and Shiga toxin-producing E. coli screening is warranted regardless of what the supplier’s COA states.

The combination of a documented on-site audit and independent third-party testing gives you a supplier qualification package that will hold up under FDA inspection. Either one alone leaves a gap that regulators — and product failures — will eventually find.

Scoring Findings and Deciding What Happens Next

Not all audit observations carry the same weight. A structured classification system prevents both over-qualification of genuinely risky suppliers and over-rejection of suppliers with minor documentation gaps.

Critical findings represent direct risk to product safety, identity, or integrity. No quarantine system for incoming materials, no cleaning validation for shared equipment, falsified calibration records — any of these require immediate corrective action before approval can move forward.

Major findings are systemic weaknesses without immediate safety risk but with clear quality culture implications: OOS investigations that close without root cause identification, training records consistently months out of date, open pest control findings with no corrective action. Major findings require a written supplier CAPA with a defined timeline before you grant conditional approval.

Minor findings are isolated gaps with no systemic pattern. These go into the audit report with a request for correction within 30 to 60 days. They don’t block approval but they’re tracked at the next scheduled audit.

Once a supplier is approved, the cycle doesn’t stop. Most robust programs re-audit approved suppliers every 12 to 24 months, with frequency tied to the criticality of the material — higher-risk ingredients, higher audit frequency. Incoming testing continues for every lot, even from your best suppliers. The audit confirms the system is sound. Testing confirms this lot is right.

Don’t treat supplier approval as a checkbox. The strongest raw material qualification programs are built on an ongoing documented relationship — clear specifications, recorded performance history, and a defined consequence pathway when findings emerge. That combination of systematic auditing, independent analytical verification, and continuous incoming testing is what separates manufacturers with consistently clean products from those who discover supplier problems through a customer complaint.

If you’re building or revisiting your supplier qualification program, start with the pre-audit document review. It costs nothing but time, and it tells you more about a supplier’s quality culture than most site visits do.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing Contact us

Related from our network

• ISO 17025-Accredited Supplement Ingredient Testing — Qalitex Laboratories provides identity, potency, heavy metals, and microbial testing for raw materials, with fast B2B turnaround.