Ask for the control plan before you ask for the certificate of analysis

A supplier shipped us 40 cases of 2 mL autosampler vials with PTFE/silicone septa, and by the third injection on a 96-well sequence we were seeing area RSD of 4.8% on a standard that normally runs at 0.6%. The septa had been molded at the low end of the durometer tolerance, and the 22-gauge needle was coring them at about 0.4 mg of silicone per puncture instead of the 0.1 mg we had specified. The certificate of analysis said “conforms.” It did not say to what. That is the whole problem with vendor qualification in this business: most of the documents you get prove that a process exists, not that the process is capable. A lab chromatography supplier audit checklist has to be built around evidence that predicts drift, not paperwork that certifies a batch.

What follows is the checklist I actually use, organized by what the item tells you about future performance. I have run it against molders, column packers, membrane casters, and distributors who do nothing but relabel. The scoring model at the end is the part most people skip, and it is the part that separates a vendor you can qualify in a week from one you should walk away from.

A CoA is a rearview mirror. It tells you what one lot measured. The control plan tells you what the vendor does when a measurement drifts, and that is the document that predicts your next six months of pain. Request it as part of the initial lab chromatography supplier audit package, before any samples ship.

What a usable control plan contains, at minimum:

• Critical-to-quality characteristics named explicitly. For a syringe filter, that means membrane pore-size distribution (not just the nominal 0.45 µm), housing burst pressure, extractables by gravimetric residue after a defined flush volume, and hold-up volume. If the plan lists “appearance” and “dimensions” and stops there, the vendor is inspecting, not controlling.
• Sampling frequency tied to lot size. A plan that says “one sample per lot” on a 500,000-piece molding run is theater. Look for an AQL-based sampling scheme (ANSI/ASQ Z1.4 is the common one) with the inspection level stated.
• Reaction plan on out-of-control. Who quarantines, who dispositions, what triggers a customer notification. If the answer is “the QA manager decides,” there is no plan.
• Change control with a notification clause. Resin supplier change, mold cavity addition, sterilization method change, and site relocation must all trigger written notice. Get the notice window in days, not “reasonable advance notice.”

I weight the change-control clause heavily because it catches the failures the CoA never will. A molder that adds a 33rd cavity to a 32-cavity tool without telling you has just changed your septa, and your method validation no longer covers the part you are buying. That is a chemistry problem disguised as a procurement event.

The five quality-system items that actually predict failures

ISO 9001 certification is table stakes and tells you almost nothing. Every vendor in this space has it. These five items are where the predictive signal lives, and I have watched each one fail in a way that reached the bench.

1. Incoming material identity testing, not just supplier CoAs

Ask what the vendor does with incoming resin, membrane stock, and glass. The good ones run FTIR identity against a retained reference spectrum and check melt flow index on polymers. The weak ones file the upstream CoA and move on. When a PTFE membrane lot arrives with a different fibrillation, the extractables profile shifts and you get ghost peaks at 210 nm that nobody can trace. If the vendor cannot show you an incoming FTIR spectrum for the last three lots of membrane, assume they are trusting their supplier, and their supplier is trusting theirs. For a deeper look at how material identity drives contamination, the PTFE membrane filter reference material is worth reading before you write the spec.

2. Dimensional capability, expressed as Cpk, not tolerance

A tolerance is a drawing. Capability is a distribution you can measure. Ask for Cpk on the two or three dimensions that matter: septum thickness, vial neck ID, filter housing diameter. A vendor running Cpk below 1.33 on septum thickness is one tool-wear cycle away from a coring problem. I have seen a septum spec of 1.00 mm ± 0.05 mm where the actual distribution was centered at 1.04 mm with a Cpk of 0.9. Every part passed incoming inspection. Every part was also stiff enough to core at the needle gauge we used. Ask for the histogram, not the pass/fail.

3. Extractables data generated under conditions you recognize

For anything wetted by mobile phase, request extractables data with the solvent, temperature, and contact time stated. A filter vendor who reports extractables in water at 25 °C for 24 hours has told you nothing about a 60 °C acetonitrile gradient. Ask specifically for:

• Gravimetric non-volatile residue (NVR) in mg per filter or per cm² of membrane, at the worst-case solvent.
• UV absorbance scan of the extract at the wavelength you run (often 210 or 254 nm).
• Retention time markers for any peak above the method’s reporting threshold.

If they cannot produce this, the filter is not disqualified, but it moves to a “qualify by test” tier and you budget bench time for it. The HPLC filter technical pages have worked examples of what a usable extractables package looks like.

4. Calibration traceability with named standards

Every measurement in the CoA traces to an instrument. Ask which instruments and whether calibration is to NIST-traceable standards, with the calibration interval stated. A balance calibrated annually that weighs 2 mg septa is a problem. A torque tester used to verify cap tightness that has never been calibrated is a bigger one. For vial caps, ask for the target application torque (common values run 0.9 to 1.4 N·m for 9 mm screw caps, and the vendor should state a value and a tolerance) and the method used to verify it.

5. Complaint and CAPA history, summarized

This is the item vendors resist. Ask for a rolling 12-month summary of complaints by category and the corrective actions closed. You are not asking for customer names. You are asking whether coring complaints went up after a tool change, or whether extractables complaints cluster around one membrane supplier. A vendor that cannot summarize its own complaint data in a table is a vendor that does not review it.

Evidence to request in advance, and what each document proves

Send this list with the RFQ, not after the award. Vendors who balk at it are telling you something. The table below is the pre-award document request I use, with the specific claim each document supports.

Two of these deserve a note. Retained samples are the single most useful document in a dispute, because they let you retest the exact lot after a failure. Ask for the retention period (I want 24 months minimum for consumables tied to a validated method) and the storage conditions. And on the change-control window, get a number: 30 days written notice before a change ships is workable; 30 days after is not.

Field case: the filter that passed NVR and still ruined the run

A contract lab running EPA method 8330 for nitroaromatics kept getting a late-eluting peak at 11.2 minutes that appeared only on filtered samples. The filter vendor’s NVR was 0.8 mg per 47 mm disc, well inside the 1.5 mg spec. The problem was not total extractables. It was the identity of one component. We ran the extract on a GC column with an FID and matched the peak to a mold-release agent used on the housing, not the membrane. The fix was a housing change, not a membrane change, and the vendor’s extractables spec never covered the housing. The lesson: your extractables request has to name every wetted component, and the acceptance criterion has to include a chromatographic scan, not just a gravimetric number. NVR tells you how much. It does not tell you what.

Field case: the vial lot that shifted retention time by 0.15 minutes

A pharma QC group saw a retention-time shift of 0.15 minutes on a method with a 0.05-minute system-suitability window. The shift tracked to one pallet of vials. Incoming inspection passed: dimensions in tolerance, septa in tolerance. What had changed was the glass. The vendor had switched glass suppliers, and the new borosilicate had a higher surface silanol activity. The basic analytes were interacting with the vial wall during the dwell time in the autosampler. We caught it by running a blank injection from a freshly opened vial on the suspect pallet against a retained sample from the prior lot, same mobile phase, same column. The fix was a deactivation spec on the glass and a change-control notification requirement. If the vendor had been required to notify on glass supplier change, the pallet never ships. This is why the change-control clause earns its weight in the scoring model.

How to score a vendor objectively

Scoring is where most audit checklists collapse into opinion. The fix is to weight by predictive value and score against evidence, not against the vendor’s answers. I use a 100-point model with five weighted categories. The weights are not arbitrary; they reflect how often each category has actually caused a bench failure in my experience.

Score each category 0 to 5 against the evidence, multiply by the weight, divide by 5. The thresholds I use:

• 80 and above: qualified, standard incoming inspection.
• 60 to 79: qualified with a bench qualification protocol on the first three lots, and a re-score at 12 months.
• Below 60: not qualified for method-critical parts. Usable only for non-critical consumables where a failure does not reach a validated method.

The scoring discipline matters more than the numbers. Score against documents received, not promises. If the Cpk study is “available on request” and never arrives, that category scores zero. This is how you keep the audit from becoming a relationship exercise.

What to verify on the first three lots after award

Qualification does not end at the score. The first three production lots are where you confirm the vendor’s process is what the documents claimed. My post-award checklist:

• Retain a sample from each of the first three lots and store under the vendor’s stated conditions. This is your reference for every future dispute.
• Run the functional test your method actually uses. For a filter, that means the flush volume and the injection, not a generic NVR. For a vial, a system-suitability injection with your analytes.
• Verify the CoA numbers against your own measurements on at least one CTQ per lot. If the vendor reports 1.02 mm septum thickness and you measure 1.06 mm, the calibration chain is broken and you need to know now.
• Confirm the change-control notice actually fires. Ask the vendor in writing to confirm the last change to the part and the date notice was sent. If they cannot, the clause is decorative.

For method-critical consumables, I also run a SW-846-style blanks through the first lot to catch extractables the vendor’s package missed. The method you cite is the contract, and the contract is enforced at the bench, not in the audit room.

Where distributors fail the same checklist

Half the vendors you audit will be distributors, not manufacturers. They relabel, repackage, and sometimes re-certify. The checklist still applies, but the questions shift. Ask which manufacturing site produced the lot, and get the manufacturer’s name on the CoA. A distributor who will not disclose the originating site cannot support a change-control clause, because they do not control the process. For a distributor, the capability and material-control categories should be scored against the manufacturer’s documents, and the distributor is scored on traceability and complaint handling. If the distributor cannot produce the manufacturer’s Cpk study, score that category zero for the distributor even if the manufacturer is excellent. You are buying from the distributor.

I also ask distributors for their own incoming inspection records. A distributor who receives, verifies, and repacks has a quality system. One who drop-ships from a manufacturer’s dock does not, and the traceability chain has a gap where the repackaging happened. For consumables that touch a validated method, that gap is disqualifying. The Thermo Fisher chromatography and Restek technical libraries are useful benchmarks for what a complete manufacturer package looks like, so you can tell when a distributor is handing you a fragment.

The checklist in one page

If you want the short version to send with an RFQ, it is this: control plan with named CTQs and AQL sampling; Cpk of at least 1.33 on the two or three dimensions that matter; incoming material identity testing with FTIR or MFI; extractables data at your worst-case solvent with a chromatographic scan; NIST-traceable calibration with intervals stated; change control with a 30-day written notice window; 24-month retained samples; a 12-month complaint and CAPA summary. Score against documents received, weight process capability and material control at 55 of 100 points, and require bench qualification on the first three lots for anything method-critical. The Lab Chromatography supplier pages are a reasonable starting point for the product categories to attach these criteria to, and the COD vial line is a good example of a part where the glass deactivation spec matters more than the dimensional tolerance.

The decision rule: qualify a vendor on capability evidence, not conformance paperwork, and re-score at 12 months against their actual complaint history. If the Cpk study never arrives, the vendor is not qualified, no matter how good the relationship is or how fast the samples shipped.

References & further reading

Related resources from our lab consumables network:

• Lab Chromatography at labchromatography.com
• Hplc Filter at hplcfilters.com
• Ptfe Membrane Filter at ptfemembranefilter.com
• Cod Vial at codvial.com

External references and standards:

• Agilent chromatography consumables and columns
• Thermo Fisher chromatography and sample handling
• U.S. EPA SW-846 test methods for waste and materials
• Restek technical resources for chromatography