QC-MAT-003 — Supplier Status & Tier Impact Specification

Field	Value
Document ID	QC-MAT-003
Title	Supplier Status & Tier Impact Specification
Document Type	Authoritative QC Specification
Owner	Quality Unit (QU)
Approver	Quality Unit (QU)
Effective Date	03/01/2026
Version	v1.0
Change Control Reference	QMS-1344

2. Purpose

This specification establishes objective supplier qualification tier controls governing sourcing eligibility, identity verification requirements per lot, Certificate of Analysis reliance authorization boundaries, monitoring frequency, reassessment triggers, and mandatory QMS escalation entry.

This specification mitigates risks of adulteration, substitution, fraudulent certificates of analysis, supplier instability, regulatory enforcement exposure, and inappropriate analytical reliance that may compromise product safety, identity, strength, quality, or composition.

21 CFR Part 111 requires that suppliers be qualified, identity of each dietary ingredient be verified, and quality control operations be defined and approved. Failure to define objective supplier status controls creates regulatory exposure under inspection and undermines QU authority over material acceptance decisions.

3. Regulatory Basis

21 CFR 111.70 — Requirement to establish specifications for components and suppliers.
21 CFR 111.75(a)(1) — Requirement to conduct at least one appropriate test or examination to verify identity of each dietary ingredient.
21 CFR 111.75(a)(2) — Requirements governing reliance on supplier Certificates of Analysis.
21 CFR 111.80 — Requirement to establish and follow written procedures for quality control operations.
21 CFR 111.103 — Requirement for quality control review and approval of material decisions.
21 CFR 111.605 — Requirement to retain supplier qualification and testing records.

4. Scope

Applies To: All suppliers providing components, packaging materials, labels, or GMP-impacting services used in products governed under 21 CFR Part 111.

Excludes: Laboratory method validation protocols, audit execution methodology, investigation mechanics, and CAPA procedural instructions.

5. Definitions

Compliant State: All acceptance criteria satisfied.

Nonconforming State: One or more acceptance criteria not met.

Invalid State: Record incomplete, missing required element, missing authorization, or control parameter undefined.

Escalation Trigger: Objective condition that requires mandatory entry into a defined QMS process.

Stop-Execution Condition: Execution is prohibited until resolution under QMS governance.

Tier 1 Supplier: Supplier with demonstrated high reliability, consistent compliance, and verified performance history. Eligible for extended monitoring intervals and conditional reliance on supplier-provided data where permitted.

Tier 2 Supplier: Supplier with moderate reliability requiring routine monitoring and periodic verification. May require increased oversight relative to Tier 1.

Tier 3 Supplier: Supplier with elevated risk, limited history, or identified performance concerns. Requires increased monitoring frequency, reduced reliance on supplier data, and heightened Quality Unit oversight.

6. Acceptance Criteria

Attribute	Compliant State	Nonconforming State	Invalid State	Escalation Trigger	Required QMS Process Entry	QU Authorization Required?
Tier Assignment	Tier defined, documented, and QU authorized	Tier misapplied or used outside authorized scope	Tier undefined or not QU approved	Tier discrepancy identified	Deviation	Yes
Tier 1 Monitoring	Performance review completed ≤365 days	Review >365 days	No documented review	Review interval exceeded	Deviation	Yes
Tier 2 Monitoring	Performance review completed ≤180 days	Review >180 days	No documented review	Review interval exceeded	Deviation	Yes
Tier 3 Monitoring	Performance review completed ≤90 days	Review >90 days	No documented review	Review interval exceeded	Deviation	Yes
Identity Verification Per Lot	≥1 scientifically valid predefined identity test per lot documented	Identity test not performed per lot	Identity method undefined	Lot received without identity verification	Deviation	Yes
COA Reliance Authorization	Supplier reliability documented and periodically verified ≤365 days	COA relied upon without verification	Reliability verification record missing	COA discrepancy identified	Deviation	Yes
Confirmed Supplier Fraud	No confirmed fraud	Fraud suspected but unassessed	Fraud confirmed without disqualification action	Confirmed fraud	Quality Defect + Change Control	Yes
Repeated Supplier Deviations	<3 supplier-attributed deviations within 6 months	≥3 supplier-attributed deviations within 6 months	Deviation attribution not documented	≥3 supplier-attributed deviations within 6 months	CAPA	Yes

7. Decision Logic Matrix

Trigger Condition	Execution May Continue?	Required Action	QMS Process Entry	Workflow (W)?	QU Authorization (A)?	Required Record
Compliant State	Yes	Continue approved sourcing	None	No	No	Approved Supplier List Record
Nonconforming State	No	Enter Deviation workflow	Deviation	Yes	Yes	Deviation Record
Invalid State	No	Execution is prohibited. Enter Deviation workflow.	Deviation	Yes	Yes	Deviation Record
Systemic / Repeated Failure	No	Enter CAPA workflow.	CAPA	Yes	Yes	CAPA Record

8. Exception Handling

When identity verification per lot is not performed, Deviation workflow entry is mandatory.
When two COA reliability failures occur within 12 months, Deviation workflow entry is mandatory.
When three supplier-attributed deviations occur within 6 months, CAPA workflow entry is mandatory.
When confirmed fraud is identified, Quality Defect and Change Control workflow entry are mandatory.

9. Required Records

Base Execution Records

Approved Supplier List Record
Supplier Qualification Record
Tier Assignment Record
Tier Monitoring Review Record
Identity Verification Record (per lot)
COA Verification Record

Conditional Workflow Records (Triggered by Escalation)

Deviation Record
CAPA Record
Quality Defect Record
Change Control Record

QU Authorization Records

Tier Authorization Record
Supplier Disqualification Authorization Record
Supplier Reinstatement Authorization Record
Final Supplier Status Authorization Record

10. Authority Classification (E / W / A)

E — Execution: Personnel verify supplier tier status and document identity verification results. Execution does not confer supplier approval, downgrade, disqualification, reinstatement, sourcing authorization, or quality decision authority.

W — Workflow Entry: When trigger conditions are met, entry into the defined QMS process is mandatory.

A — Authorization: Tier assignment, downgrade, disqualification, reinstatement, sourcing authorization, and final supplier status decisions require independent QU authorization.

11. Control State Definitions