A supplier failed our audit on a single number: 0.8% RSD. That was the relative standard deviation across six consecutive injections of a mid-level calibration standard on the vendor’s own QC bench, run on a column they had supplied to us for three years. Their certificate said ≤1.5% RSD. Their bench said 0.8%. The gap between the two was the audit finding. The column was fine. The problem was that nobody at the vendor had run the certificate method in eleven months, and the “QC” sheet we had been receiving was a templated document filled in from memory. That is the kind of thing an analytical testing supplier audit checklist exists to catch, and it is not caught by a questionnaire that asks “do you have a quality system?”

Most supplier audits I have sat through are structured to confirm that a quality manual exists. The ones that actually predict failure are structured to confirm that a specific number on a specific certificate was produced by a specific measurement on a specific date. This article is about the second kind. It assumes you already buy columns, vials, standards, and sample-handling consumables from vendors who claim ISO 9001, and you need a checklist that separates the ones whose paperwork tracks reality from the ones whose paperwork tracks their marketing.

The first quality-system item that predicts problems is not certification scope. It is whether the vendor can reproduce a value printed on a CoA or specification sheet on demand. Ask for a re-test of a lot you already hold, performed on their bench, with the raw chromatogram or the raw data file attached, inside the audit window. If they cannot produce it in 48 hours, the certificate is a document, not a measurement.

What to request in advance, before anyone books travel:

• Three CoAs from the last 12 months, one of which is a lot you purchased. Cross-check the lot number against your receiving records. I have found lots on a CoA that were never shipped to us.
• Raw data behind one certificate value. Not a summary. The instrument file, the injection sequence, the integration parameters. If they cannot export it, their LIMS is a filing cabinet.
• Calibration status of the instruments used for release testing, with certificate numbers and due dates. An out-of-calibration balance is the most common finding I have written up, and it is invisible on a CoA.
• The method reference each certificate value was produced under, by version. A USP <621> claim and a vendor internal method are not the same promise. The EPA SW-846 series is a good example of how version control changes what a method actually demands, and vendors who cite a method without a revision number are telling you something.

I weight this section at roughly 30% of the total score. A vendor with a thin manual but reproducible data beats a vendor with a thick manual and no traceable measurement every time.

Ask for the dimensional stack and the mold history, not the drawing

For consumables, the quality-system item that predicts failure is dimensional control at the cavity level, and the evidence is a capability study, not a drawing. A drawing tells you what the part should be. A capability study tells you what the mold actually holds over a production run. Ask for Cpk on the two or three critical dimensions for the part you buy, with the sample size and the date.

For a 2 mL HPLC vial the critical dimensions are the ones that decide fit: the 11.6 mm outside diameter tolerance, the 32 mm height, the 6 mm neck finish, and the GPI 8-425 or 13-425 thread depending on the closure. If the vendor cannot tell you which cavity produced the lot you are holding, they cannot tell you whether the lot drifted. Cavity traceability is the single most useful field on a consumable CoA and the one most often blank.

Evidence to request for consumables specifically

• Cavity-level Cpk on the seal-critical dimension, with sample size and date. Below 1.33 on a seal dimension, I flag it.
• Resin lot and supplier for the last two production runs. A resin change without a re-qualification is a silent failure mode.
• Septum puncture data if you buy closures: puncture count to failure, needle gauge used, and whether the test was on a fresh needle each time. A septum rated for 10 punctures with a 22-gauge needle is not rated for 10 punctures with a 26-gauge.
• Closure torque and seal integrity data, with the torque value in N·cm and the test method. Hand-tight is not a specification.

This is where the HPLC vial supply chain separates: the vendors who can hand you a capability study per cavity are the same ones who can tell you why a lot of vials started coring after a mold repair. The ones who cannot are the ones who send a new drawing and call it a corrective action.

Trace the chain from resin to your bench and count the undocumented links

Every consumable has a chain: resin or glass supplier, molder, converter (if any), distributor, you. Most labs document three of those links and assume the rest. The audit item that predicts failure is whether the vendor can name every link and produce a certificate at each one. A distributor who buys from a molder who buys from a resin broker is a chain with two unknowns, and unknowns are where lot-to-lot drift lives.

Ask for the chain map in writing, with the name of each entity and the document that links them. Then ask which link changed in the last 24 months. A supplier change at the molder level is the most common root cause of a drift you cannot explain from the CoA, because the CoA was regenerated against the new supplier’s data and looks identical.

For chromatography consumables specifically, ask how the vendor handles the chromatography consumables they resell versus manufacture. A reseller who cannot produce the original manufacturer’s CoA is a document relay, not a quality system. That is not automatically disqualifying, but it changes how much of the certificate you can trust and how you should weight the score.

Score the vendor on a weighted rubric, and publish the weights before the audit

An audit without a scoring rubric produces an opinion. A rubric published before the visit produces a decision. I use a five-section weighted score, and I fix the weights before the first document request so the vendor cannot argue the weighting after the fact.

Score each section on a 0 to 10 scale per sub-item, sum to the section maximum, multiply by the weight. A vendor below threshold on any single section fails the audit regardless of total, because a supplier who cannot reproduce a certificate is not rescued by good chain documentation. I have seen a vendor score 78 out of 100 overall and still fail because certificate reproducibility came in at 18/30. That is the correct outcome.

What a passing score looks like in practice

A vendor at 85 or above, with no section below threshold, goes on the approved list with a 12-month re-audit cycle. A vendor between 70 and 85 goes on the list with a 6-month re-audit and a documented corrective action plan with dates. Below 70, or any section below threshold, and I move the volume to a second source. The rubric is not a courtesy. It is a purchasing decision with a number attached.

Two field cases where the checklist caught what the CoA did not

Case 1: the drift that lived in the septum

Symptom: a mid-level standard drifted 1.8% in peak area across a 40-injection sequence on a system that had been stable for months. The drift was monotonic, which pointed at the autosampler rather than the column. We swapped columns, swapped the needle, and the drift persisted.

The measurement that identified it: we ran the same standard from a fresh vial set with a different septum lot and the drift dropped to 0.4%. We then pulled the septum lot’s CoA and found no puncture data and no resin lot. The audit item we had skipped was the puncture-count evidence. The vendor had changed silicone suppliers six months earlier and never re-qualified the septum against the needle gauge we use.

The fix: we added a septum puncture test to incoming inspection (10 punctures, 22-gauge, area RSD ≤ 1.0% on the tenth injection) and put the septum resin lot on the audit checklist as a change-control trigger. The drift did not recur.

Case 2: the column that passed the CoA and failed the method

Symptom: a new lot of columns gave tailing factor 1.9 against a method limit of 2.0. Technically passing, but the previous lot had run at 1.3 and the shift was large enough to change our resolution margin on a critical pair.

The measurement that identified it: we asked the vendor for the raw data behind the CoA tailing value. Their certificate said 1.4. Their raw data, when we finally got it, was run on a different mobile phase pH than the method specifies. The certificate value was real, but it was not a measurement of our method.

The fix: the audit checklist now requires the vendor to state the exact method conditions behind each CoA value, and we reject any certificate that does not name the mobile phase, pH, and column temperature. The next lot came in at 1.35 and we had a documented basis to accept it. This is the same principle that governs analytical testing generally: a number without its method is not a result.

Change control is the item that predicts the failure you will have next quarter

If I could keep only one section of the checklist, it would be change control. Every unexplained drift I have chased in fifteen years traced back to a change the vendor made and did not tell us about: a resin swap, a mold repair, a mobile phase component from a new supplier, a method revision. The audit question is not “do you have a change control procedure.” It is “show me the last three change notifications you sent to customers, and the re-qualification data behind each one.”

What to demand in the notification clause and the audit evidence:

• Pre-shipment notification for any change to resin, glass, mold, method, or sub-supplier, with a re-qualification report attached. Post-shipment notification is a recall, not a control.
• A re-qualification protocol that names the acceptance criteria in numbers: RSD, tailing factor, puncture count, dimensional Cpk. “Meets specification” is not a criterion.
• A change log covering the last 24 months, which you cross-check against your own incoming inspection records. Any change on their log that you did not receive a notification for is a finding.

I weight change control at 20% and I have never regretted it. The vendors who score well here are the ones who cost more per unit and cost less per failure. The unit price conversation belongs in procurement, not in the audit, but the two talk to each other: a vendor who cannot produce a change log is a vendor whose price advantage is a down payment on your next investigation.

The document request list, in the order I send it

Send this before the audit window is agreed. The response time and the completeness of the response are themselves audit data.

1. Quality manual and certification scope, with the certificate number and expiry. Not the marketing PDF.
2. Three CoAs from the last 12 months, one for a lot we purchased.
3. Raw data behind one CoA value, exported, with integration parameters.
4. Instrument calibration certificates for the instruments used in release testing, with due dates.
5. Capability study (Cpk) on the seal-critical dimension, per cavity, with sample size and date.
6. Resin or glass lot and supplier for the last two runs.
7. Septum puncture data and closure torque data, with the test method and needle gauge.
8. Chain map from raw material to us, with a certificate at each link.
9. Change log for 24 months, plus the last three customer notifications with re-qualification data.
10. Prior NCRs and corrective actions from the last 24 months, with closure evidence.

If the vendor pushes back on item 3 or item 5, that is your answer. A supplier who cannot export raw data or a capability study is telling you their quality system produces documents, not measurements. The Thermo Fisher chromatography and sample handling resources and the Agilent chromatography consumables and columns technical libraries are useful references for what a credible method condition sheet looks like; if your vendor’s CoA is thinner than a public technical note, that is a finding. The Restek technical resources are another benchmark for the level of method detail a serious supplier publishes as a matter of course.

Operational precautions that belong in the audit, not the SOP

Three things I check on every audit that never appear on a standard questionnaire:

• Storage and shipping conditions for the consumable, with a temperature record. A vial lot that sat in a hot warehouse for a month before shipping is a lot with an unknown dimensional history. Ask for the shipping temperature log for the last shipment.
• Incoming inspection at the vendor, with the sampling plan and the AQL. The defect class matters more than the AQL number, and a vendor who samples 5 pieces from a 10,000-piece lot is not inspecting, they are hoping.
• The re-test interval on retained samples. A vendor who re-tests retained lots at 6 months and 12 months has a drift early-warning system. One who never re-tests has a certificate that was true on the day it was written.

None of these are exotic. All of them are missing from most supplier questionnaires I see, which is why the audits that use those questionnaires keep passing vendors who keep failing.

Decision rule

Approve a vendor only if they can reproduce a certificate value from a lot you already hold, on demand, with raw data, inside 48 hours; if their capability study shows Cpk ≥ 1.33 on the seal-critical dimension with cavity traceability; if every link in the chain is named with a certificate at each link; and if they notify you before shipment of any change to resin, mold, method, or sub-supplier. Score the five sections on the published weights, fail any vendor below threshold on certificate reproducibility, dimensional capability, chain traceability, or change control regardless of total, and move the volume to a second source if the score falls below 70. The vendors who pass this are the ones whose paperwork is a record of a measurement. The ones who fail are the ones whose paperwork is a promise, and a promise is not a specification. For a broader view of how these consumable and method decisions play out on the bench, the lab vials reference material is a reasonable starting point for the dimensional side.

References & further reading

Related resources from our lab consumables network:

• Analytical Testing at testinganalytical.com
• Hplc Vial at vialforhplc.com
• Chromatography Consumables at chromatographyconsumables.com
• Lab Vials at labvials.com

External references and standards:

• Agilent chromatography consumables and columns
• Thermo Fisher chromatography and sample handling
• U.S. EPA SW-846 test methods for waste and materials
• Restek technical resources for chromatography