Why supplier qualification keeps showing up in warning letters
Most quality teams review the certificate of analysis that arrives with a raw material shipment. Far fewer have a documented basis for actually trusting that certificate — and that distinction is exactly what FDA investigators are trained to probe during a cGMP inspection. A supplement manufacturer is permitted to rely on a supplier's COA in place of its own full testing, but only if it first establishes the reliability of that supplier's test results through a defined qualification process (21 CFR 111.75). Skip the qualification step, and every COA on file becomes a paper trail with no regulatory weight behind it — which is precisely why "identity testing not conducted, and no documented basis for relying on the supplier's certificate of analysis" is one of the most frequently cited findings in FDA warning letters to the industry.
The frustrating part is that the gap is invisible until someone asks for it. The COAs look complete, the products test fine, and the business runs for years without incident — until an inspection asks a simple question: show me how you determined this supplier's COA could be trusted. If the answer is "we've used them for years and never had a problem," that is not a qualification record, and it will not satisfy 21 CFR 111.75.
The regulatory foundation
Two sections of the dietary supplement Current Good Manufacturing Practice regulation govern this area. 21 CFR 111.70 requires you to establish component specifications for identity, purity, strength, composition, and any contaminant limits that could adulterate the finished product. 21 CFR 111.75 then governs how you determine whether an incoming component actually meets those specifications — and it is the section that permits COA reliance, conditionally, in place of your own confirmatory testing.
The default path in 111.75(a)(1) is to conduct your own testing or examination to verify each component meets its specifications. The alternative path — the one nearly every supplement company actually uses, because full identity and potency testing on every incoming lot from every supplier is not commercially realistic — is 111.75(a)(2)(ii): rely on a certificate of analysis from the supplier, provided you first qualify that supplier's ability to produce reliable test results.
The five-part COA-reliance test
21 CFR 111.75(a)(2)(ii) lays out what "qualifying" a supplier actually requires. The companion workbook breaks this into five tracked steps, each with its own documentation requirement:
| Step | What it requires |
|---|---|
| A. Establish reliability | Confirm, through an initial qualification review, that the supplier's testing methodology and laboratory practices are capable of producing accurate, reliable results for the specific specifications you're relying on them for |
| B. Periodic confirmation | Re-confirm that reliability on an ongoing basis at a defined interval — qualification is not a one-time event, it has to be revisited |
| C. Full documentation | Maintain documentation of both the initial qualification and every periodic re-confirmation, available for inspection |
| D. Certificate content | The COA itself must include the specific results obtained from actually testing the component against your specifications — not a generic statement of conformance |
| E. QC sign-off | Your quality control unit must review and approve the supplier's qualification, and that approval has to be documented before you begin relying on the certificate |
Note what this does not allow: a certificate that simply states "meets specifications" with no underlying data, from a supplier who has never been formally reviewed, approved by your own quality control unit. That arrangement — common in practice, and common in warning letters — fails steps A, C, and E simultaneously.
Reviewing a COA at receiving
Qualifying the supplier is the upstream step; reviewing each individual COA against your specifications at receiving is the downstream one, and both are required. A COA review at receiving should confirm, at minimum: the lot number on the certificate matches the lot physically received, the component identity matches your approved specification, potency or strength results fall within your accepted range, contaminant and purity results (heavy metals, microbial limits, pesticide residues where applicable) are within limits, the test methods used are ones your qualification review actually evaluated, the certificate is signed and dated by the testing laboratory, and any deviations are flagged and dispositioned before the lot is released to production.
A COA that is missing any of these — an unsigned certificate, a lot number that doesn't match the physical shipment, or a test method that was never part of the supplier's qualification review — should not be enough to release the lot on its own, regardless of how routine the shipment feels.
Risk-based audit cadence
Not every supplier warrants the same qualification depth. A risk-tiered approach lets you focus the most rigorous, most frequent requalification on the suppliers where a failure would matter most:
- High risk — novel or high-potency active ingredients, single-source suppliers with no qualified backup, any supplier with a prior deviation or out-of-spec result, or components with known adulteration risk (e.g., botanicals prone to substitution). Annual on-site or documented remote audit, full COA data review on every lot.
- Medium risk — established actives and functional ingredients from suppliers with a clean multi-year track record. Audit or documented reconfirmation every 18–24 months, periodic full-panel confirmatory testing on a sampling basis.
- Low risk — common excipients, flow agents, and capsule shells from long-qualified, multi-sourced suppliers with no history of deviation. Reconfirmation every 2–3 years, standard COA review at receiving.
Whatever cadence you set, treat it as a floor, not a ceiling — certain events should always trigger an off-schedule requalification regardless of where a supplier sits in the tier structure (see the triggers section below).
Personnel and QC oversight
Supplier qualification and COA review are quality control unit functions, and 21 CFR 111.12 requires that anyone performing them have the education, training, or experience needed to do the job — and that their qualifications are documented. An investigator reviewing a supplier qualification file will typically also ask who reviewed and approved it, and whether that person's training record supports doing so. A technically sound qualification review carries little weight if there's no record showing the reviewer was qualified to perform it.
A real warning letter, finding by finding
FDA's November 2024 warning letter to Western Innovations, Inc. illustrates how this plays out in practice. The letter cited the firm for failing to establish component specifications necessary to ensure control over those aspects of manufacturing that could affect whether the dietary supplement meets its specifications, and — the finding most relevant here — for relying on certificates of analysis from suppliers without first establishing the reliability of the supplier's test results through appropriate qualification, as required by 111.75(a)(2)(ii) (FDA Warning Letter, Western Innovations, Inc., Nov. 13, 2024). The firm's response, submitted after the inspection, was reviewed by FDA as inadequate because it did not include documented evidence of a completed supplier qualification program — a corrective action promised on paper, without the underlying qualification records to back it up.
This is a common pattern across warning letters in this area: the finding isn't that the company had no supplier relationships or no COAs on file. It's that the qualification step connecting the two — the documented basis for trusting those COAs — was never built.
What should trigger a requalification
Beyond the scheduled cadence for each risk tier, requalify a supplier immediately when:
- A lot arrives with an out-of-specification or deviating result, even if it's ultimately dispositioned as usable
- The supplier changes its test method, testing laboratory, or manufacturing site
- The supplier changes ownership or undergoes a significant facility change
- You haven't purchased from the supplier in longer than your qualification's stated validity period
- A component specification changes on your end, requiring re-verification that the supplier's testing still covers it
- Any adverse regulatory action (recall, warning letter, import alert) becomes public against the supplier
Turn this into a documented, inspection-ready system.
The Supplier Qualification & COA Review Bundle is a 6-tab workbook plus a practitioner's guide, built directly around the five-part test in 21 CFR 111.75(a)(2)(ii) — so every supplier qualification decision has the documentation behind it.
See the bundle — $29This guide is educational and reflects FDA dietary supplement cGMP guidance as of July 2026. It is not legal or regulatory advice, and does not replace review by qualified regulatory counsel for your specific suppliers and qualification program.
- 21 CFR 111.70 — Component Specifications (eCFR)
- 21 CFR 111.75 — Determining Whether Specifications Are Met (eCFR)
- 21 CFR 111.12 — Personnel Qualification Requirements (eCFR)
- FDA — Warning Letter: Western Innovations, Inc. (CMS #679737), Nov. 13, 2024
- FDA — Small Entity Compliance Guide: cGMP for Dietary Supplements