Supplier Qualification: When Nobody Checks the Answer

Supplier qualification has a paperwork problem, but not the one people usually assume. The firms in two recent FDA warning letters were not missing supplier qualification procedures. Both had questionnaires, quality agreements, and approval records. What they were missing was verification: someone whose job it was to actually check whether the answers on the page were true.

That distinction, between collecting supplier documentation and confirming it, is where both cases turned.

What the two letters found

FDA inspected AACE Pharmaceuticals after a separate inspection of its contract manufacturer, Brassica Pharma Private Limited, uncovered fabricated microbiology records, torn and dirty gowning in aseptic areas, and an inadequate media fill program. Brassica was placed on import alert and issued its own warning letter. But AACE's letter is really about a decision made years earlier: the firm had identified CGMP deficiencies at Brassica back in 2020, including a failure to maintain raw testing data, and qualified Brassica as an approved supplier anyway. It then requalified Brassica again in 2023, without ever evaluating whether the corrective actions from 2020 had actually worked.

Separately, FDA inspected Darmerica, LLC, an API distributor, and found that one of its suppliers had completed a vendor survey asking whether it had undergone any FDA inspections. In one year, the supplier answered that an FDA inspection had produced a "satisfactory" outcome, even though FDA had never inspected the firm. In a different year, the same supplier's survey stated it had never been inspected at all. The two answers contradicted each other. FDA found no indication that Darmerica had ever investigated the discrepancy before requalifying the supplier.

What 21 CFR actually requires here

21 CFR 211.22 gives the quality unit responsibility and authority to approve or reject components and materials, which includes the authority to approve or reject the suppliers those components come from. 21 CFR 211.84 requires testing and examination of incoming components before use. Neither regulation is satisfied by a supplier stating, in writing, that it meets requirements. FDA's guidance on contract manufacturing arrangements is explicit that a firm using a contractor remains fully responsible for the quality of what that contractor produces, regardless of the agreements in place between them. A quality agreement documents responsibility. It does not discharge it.

What a defensible supplier qualification programme actually contains

A supplier qualification system that survives an inspection has to include a verification step at every stage, not just a documentation step:

• Initial qualification with independent verification. A supplier's self-reported inspection history, certifications, and quality claims get checked against independent sources, not filed as submitted. For FDA-regulated suppliers, that includes checking FDA's own inspection classification database and import alert list, not just trusting the supplier's account of its own regulatory history.
• Audits proportionate to risk. Higher-risk suppliers, sole-source suppliers, and suppliers of critical materials get on-site audits, not questionnaires alone.
• Requalification that checks outcomes, not paperwork. When a known deficiency triggers a CAPA, requalification has to confirm that CAPA was effective, not simply that a CAPA plan exists on file.
• A live check against import alerts and enforcement actions. An approved supplier list is not static. A supplier's status can change the day after approval, and periodic screening against current FDA import alerts catches that.
• A disqualification path that actually gets used. A supplier qualification programme without a documented mechanism for disqualifying or suspending a supplier is a one-way door: qualification, in practice, becomes permanent.

Neither firm in these two letters was missing a documented process. AACE had a qualification and requalification programme; it simply never closed the loop on whether the 2020 corrective actions worked before requalifying in 2023. Darmerica had a vendor survey process; it simply never noticed, or acted on, the fact that one supplier's answers contradicted themselves.

Why a signed vendor survey is not verification

A vendor questionnaire is a starting point for supplier qualification, not the finish line. FDA's expectation, reflected clearly in the Darmerica letter, is that inconsistencies in a supplier's own self-reported history are a signal to investigate, not a data point to file away. A supplier that reports a satisfactory FDA inspection outcome one year and no FDA inspection at all the next has given two answers that cannot both be true, and a functioning quality unit is the one that notices before approving, not after an FDA investigator does.

Why "we conducted a CAPA" is not the same as "the CAPA worked"

The AACE case makes a similar point from a different angle. A corrective action plan filed in 2020 is not evidence that the underlying problem was fixed. FDA's expectation for requalification is that the firm actually confirms the corrective action addressed the root cause, ideally through a follow-up audit or objective evidence, before extending or renewing approval. Treating CAPA completion as self-verifying is one of the most common and most avoidable gaps in supplier oversight.

Key regulatory references

• FDA Warning Letter 320-26-24, Darmerica, LLC, December 8, 2025
• FDA Warning Letter 320-25-72, AACE Pharmaceuticals, Inc., May 13, 2025
• 21 CFR 211.22 — Responsibilities of quality control unit
• 21 CFR 211.84 — Testing and approval or rejection of components
• FDA Guidance: Contract Manufacturing Arrangements for Drugs: Quality Agreements
• FDA Import Alert database (accessdata.fda.gov/cms_ia/ialist.html)