Guide ยท Supplier quality
Supplier CoAs: trust but verify
- Short answer
- Trust but verify means relying on a supplier's certificate for routine release while checking that the reliance is earned. Buyers commonly run at least an identity test, compare periodic full tests with the certificate, and trend results by lot. Skip-lot and reduced testing describe doing less on-receipt testing once a supplier's record supports it.
Descriptive only, not regulatory, GMP or legal advice. How much testing you may reduce, and what you must document, depends on your sector, your rules and your quality system.
What guidance says, in outline
Quality guidance tends to describe the same arrangement. For makers of active pharmaceutical ingredients, ICH Q7 says at least one test should verify the identity of each batch of an incoming material, with limited exceptions, and that a supplier's CoA can replace other tests if there is a system to evaluate suppliers. Full analyses should be done on at least three batches before reducing in-house testing, and the reliability of certificates checked at regular intervals. US drug GMP regulations (21 CFR 211.84(d)) similarly describe accepting a supplier's report of analysis when the manufacturer runs a specific identity test and establishes the supplier's reliability at appropriate intervals.
For imported food, the US foreign supplier verification rule (21 CFR 1.506(e)) lists activities an importer chooses from, such as onsite audits, sampling and testing, and review of the supplier's food safety records. Other sectors and countries set their own expectations, and none of this is a recommendation for your site. Skip-lot testing is a sampling term: after a good record, only some lots are tested in full. Reduced testing means a shorter on-receipt list. Both are usually justified in writing.
A verification routine, built up in layers
Layers a buyer typically adds, from lightest to heaviest. Choose by risk.
Qualify the supplier
Collect the specification, a quality questionnaire, evidence of the supplier's quality system and sample certificates. For critical materials, buyers often add a quality agreement or an audit.
Review every certificate
Run the review checklist on each lot, even where testing on receipt is reduced.
Verify identity on receipt
Use a specific identity test where one exists, one that tells the material from look-alikes. Appearance alone is rarely specific.
Test in full at first
Run full testing on early lots and compare it with the certificates. Document how closely the two sets of results agree.
Test periodically afterwards
Keep a schedule of full confirmatory tests, by calendar or by number of lots, and compare each with its certificate. Skip-lot or reduced testing, where used, sits on top of this record.
Trend results by lot
Line certificate results up lot by lot. Flat, identical numbers and a steady drift are both worth a question, and a failure goes to the out-of-specification steps.
Write down the triggers to go back
A failure, a complaint, a change of site, process or method, or a long gap in supply are common reasons to return to full testing. A method change is easier to spot if you record the method on every row.
Verification approaches compared
From lightest to heaviest. None is right for every material.
| Approach | What it involves | What it does not give you |
|---|---|---|
| Certificate review only | Read each CoA against the specification | Independent evidence that the numbers are true |
| Review plus identity test | Add a specific identity test on each lot or container | Assurance on assay, impurities or microbial quality |
| Periodic full testing | Full tests on some lots, compared with their certificates | Coverage of the lots in between |
| Skip-lot testing | Full tests on a planned fraction of lots after a good record | A check on every lot; it relies on the record holding |
| Reduced testing | A shortened on-receipt list, backed by the certificate | Data for the tests you stop running |
| Full testing every lot | All specification tests on receipt | A view of how the supplier controls its process |
| Supplier audit | Onsite or remote review of the quality system | Proof about any one lot |
What goes wrong
- Reducing testing before reliability is shown. With no side-by-side data on early lots, trust rests on nothing.
- A record that never expires. A clean history from years ago says little about a changed process or site.
- Identity by appearance. A non-specific check, such as colour, cannot tell look-alike materials apart.
- Identical numbers lot after lot. Perfectly repeating results can reflect typical values or copied data. Query them.
- Unannounced changes. A new site, process or method that reaches you only through the certificate. Ask for change notification in the quality agreement.
- A distributor in the middle. A certificate that passes through a trader may no longer show who tested the lot.
How CertiClean helps
CertiClean covers the document side. Each certificate becomes the same set of columns, with method, specification and result for every test, so successive lots from one supplier can be lined up in a spreadsheet and a changed method or limit stands out. It does not test material, qualify a supplier or decide on reduced testing. See CoA to Excel and pricing.
Free allowance: 1 file per day, up to 10 pages, no account.
Questions people ask
What does trust but verify mean for a CoA?
Relying on the supplier's certificate for routine decisions while keeping checks that show whether the reliance is justified, such as identity tests, periodic full testing and trending of results by lot.
What is skip-lot testing?
A sampling approach in which, after a supplier has a good record, only a planned fraction of lots is tested in full and the rest are accepted on the certificate and lighter checks. Terminology and rules vary, so check your own procedure.
What is reduced testing?
Running a shorter list of tests on receipt than the full specification, usually an identity test plus selected attributes, and relying on the certificate for the rest. It is normally justified in writing and reviewed.
How many lots should I test before relying on a CoA?
There is no universal number. ICH Q7 refers to full analyses on at least three batches before reducing in-house testing of materials used to make active ingredients. Your risk assessment and procedures may call for more.
Which identity test is enough?
One that is specific, meaning it can tell the material from similar ones. For many materials that is a spectroscopic or other specific test. Appearance or colour alone is rarely specific. Your specification or the monograph may name the test.
Does laboratory accreditation replace verification?
Not by itself. Accreditation to a standard such as ISO/IEC 17025 says something about a laboratory's competence for the tests in its scope, but it does not confirm any particular lot. Buyers often treat it as one input to supplier approval.
When should I return to full testing?
Typical triggers are a failed or doubtful result, a complaint, a change in site, process or method, a long gap in supply or a deviation at the supplier. Write your triggers into the procedure.
Do I need to audit every supplier?
Not necessarily. Many buyers use a risk-based mix of questionnaires, document review, sample testing and audits, with more for higher-risk materials. Some rules, for example for imported food, list the activities to choose from.