Supplier quality agreement checklist

TL;DR

• Map each applicable supplier-quality control to responsible people, evidence, and verification; ISO/IAF external-provider guidance ties controls to risk and specified requirements.
• Apply certification, audit, FAI, PPAP, inspection, and formal agreement requirements only when the buyer's actual context justifies them.
• Separate supplier action, supplier disposition, buyer approval, and order release so silence or a completed spreadsheet never becomes authority.
• Close every owner, evidence, notification, retention, and review gap, then send the record to the authorized buyer and counsel for their decisions.

Set the boundary before you write requirements

A supplier quality agreement checklist is a decision map. It should show which quality subjects apply, which identified party performs each activity, who approves the result, what record proves completion, and what happens when evidence is missing. It should not become a copied collection of obligations that neither side can execute.

Start with the actual buyer and supplier legal entities, sites, products, services, drawings, processes, and order documents. Name the revision and effective date. A corporate supplier name without a site or product scope can leave both teams arguing about whether the record covers a second plant, an outsourced process, or a later revision.

Do not turn sector guidance into a universal rule

The FDA's quality-agreement guidance is a useful primary example of clear responsibility, communication, change control, audit, records, and final approval. Its stated scope is contract drug manufacturing under CGMP, and the document is nonbinding guidance. It does not make the same format mandatory for an ordinary machined part.

The same guardrail applies to ISO 9001. The current ISO 9001:2026 public page says the standard can be used across sectors and that certification is not mandatory. Require a certificate only when the buyer's real product, customer, sector, or procurement rule supports it. Then verify the entity, site, scope, issue status, and relationship to the work.

Map clause topics before drafting clause text

Build one row for each applicable control topic. The row is not legal wording. It is the negotiating and implementation brief: what decision must be made, who owns it, what evidence will exist, when notice is due, and whether action needs prior approval. Counsel can then review the governing language without discovering basic operating gaps late.

Link every topic to the governing document

The JPL Supplier Portal illustrates how a buyer can separate change control, flowdown, first article, inspection, records, nonconformance, corrective action, packaging, and access into purchase-linked quality topics. Those clauses are JPL-specific and several public pages are archived. The transferable lesson is structural: identify the topic and the exact purchase record that invokes it. Do not copy customer-specific wording or deadlines into another supply relationship.

Record Not applicable as a decision

A topic can be Not applicable, but it needs a basis. For example, a catalog fastener may not require a buyer-approved FAI, while a new safety-related casting may. An empty row hides whether the team forgot the control. A dated applicability decision shows that the buyer considered it and lets the team reopen it when scope changes.

Assign work and authority separately

Avoid a single Responsible column that mixes execution, approval, advice, and notification. A supplier can perform inspection without holding buyer acceptance authority. A buyer engineer can review a proposed change without holding contracting authority. Record the split at the activity level and name current people or controlled roles.

FDA's in-scope guidance allows charts, matrices, narratives, or a combination, but requires clarity about which party handles specific activities. It also states that a quality agreement cannot transfer applicable statutory or regulatory responsibilities. For general industrial purchasing, use the same operating discipline without claiming the drug-manufacturing rule applies outside its scope.

Keep release authority visible

The current Federal Acquisition Regulation Part 46 provides a public example of separating contractor quality control, government verification, evidence, nonconformance decisions, and acceptance authority. FAR governs federal contracts, not private sourcing by default. Its useful lesson here is that performance, verification, and acceptance are different acts with different owners.

Turn notice, evidence, and records into executable controls

A sentence that says Notify the buyer of significant changes leaves four disputes unresolved: what significant means, when the clock starts, what must be sent, and whether the supplier may proceed while waiting. Build the control as a sequence.

Separate nonconformance stages

1. Identify and segregate the suspected product without erasing the original record.
2. Contain related inventory, work in process, shipments, and sub-tier material under an identified scope.
3. Notify the required buyer contacts under the agreed trigger and clock, with known facts and uncertainties.
4. Investigate cause and propose correction, rework, repair, return, scrap, or deviation without assuming buyer approval.
5. Record the authorized disposition, changed-lot identity where applicable, corrective evidence, and effectiveness review.

Make records retrievable, not merely retained

State which record types are required, how they link to product and process identity, who holds the system of record, the retention basis, retrieval expectation, access limits, backup, and destruction control. A ten-year folder promise is not useful if neither party can find the result for the affected lot. Do not invent a universal retention period; derive it from the applicable contract, customer, product, regulatory, and lifecycle requirements.

Scope audit rights before a problem

Define routine and for-cause triggers, notice, sites, processes, records, people, sub-tiers, customer or regulator participation, confidentiality, safety, findings, response, and follow-up. An audit right supports verification. It does not replace a factory audit, prove continuing product conformity, or authorize shipment.

Copy the four-tab checklist and responsibility matrix

Create four tabs with the exact names below and paste each block into cell A1. Keep one agreement ID across all tabs. Complete Agreement_Control first. In Clause_Topics, use one unique topic ID per row and keep the formula in column V. In Responsibility_Matrix, link every activity to an existing topic ID and keep the formula in column P. Leave the Decision formulas intact.

The sheets contain the fictional Supplier Q example. Only Clause_Topics!L7 and N7 are intentionally blank. Use it to observe the Hold and closure transition, then replace every example value for real work. Allowed values are exact. Applicability accepts Required or Not applicable. Responsible party accepts Buyer, Supplier, or Both. Performing party accepts Buyer, Supplier, or Joint. Prior approval accepts Yes or No. Status accepts Agreed, Open, or Hold. Enter None when a required gap field has no exception.

Agreement_Control!T2 accepts Pending, Hold, Release, or Release with conditions. Pending has no decision evidence. A manual Hold needs a substantive reason in U2, a date in V2, and an approval reference in W2. Release uses None in U2. Release with conditions needs real conditions in U2, not None. Blank unused rows must be entirely blank. A partially cleared row remains used and stays on Hold.

Understand the decision outputs

• HOLD means identity, applicability, responsibility, evidence, timing, review, status, or linkage is missing or invalid.
• READY FOR BUYER REVIEW applies to a completed row. It is not approval.
• READY FOR BUYER DECISION means the formula checks are closed. It does not release a supplier, PO, payment, production, or shipment.
• BUYER HOLD RECORDED, BUYER RELEASE RECORDED, or CONDITIONAL RELEASE RECORDED appears only after the authorized buyer enters the matching evidence fields.

Worked example: an undefined change rule stops release

This example is fictional. Its names, quantities, timing, and consequence are demonstration inputs, not benchmarks, typical rates, or legal recommendations.

Why the Hold is correct

The topic name and owners alone do not tell Supplier Q when notice is due or which controlled record proves the rule. The formulas therefore treat the row as incomplete. The fictional quarantine shows a concrete consequence of resolving the rule after a change instead of before it.

How the gate closes without auto-approval

1. Confirm the starter state: only L7 and N7 are blank, V7 is HOLD: required field, Decision!C3 is 1, and Decision!C8 is HOLD.
2. Enter the controlled change-rule evidence reference in L7 while leaving N7 blank. The row must remain on Hold.
3. Enter the agreed notice due basis in N7. R7 changes to Agreed, S7 changes to None, and V7 changes to READY FOR BUYER REVIEW.
4. Confirm Decision!C3 changes to 0 and C8 changes to READY FOR BUYER DECISION.
5. Leave T2 as Pending until the authorized buyer acts. Decision!C9 then reads PENDING BUYER DECISION.
6. Record a buyer Hold or release with its required reason or conditions, date, and approval reference. The workbook never supplies the approval.

Ten supplier quality agreement pitfalls

Each consequence below is a fictional illustration, not a forecast or a typical industry result.

Using broad quality promises

A line saying Maintain good quality leaves a fictional 900-piece lot on Hold for five days because neither party can identify the required inspection record.

Leaving the site out of scope

The supplier moves finishing to Plant 3, and 420 pieces need new process evidence because the agreement names only the corporate supplier.

Naming departments instead of owners

A deviation waits four days in a shared Quality inbox while a fictional assembly line consumes its remaining buffer.

Treating notice as approval

The supplier emails a material change and starts production. Seven hundred pieces are quarantined because no authorized buyer approved effectivity.

Granting silent disposition authority

A supplier ships 260 reworked units under its internal use-as-is decision, forcing the buyer to segregate the entire receipt.

Ignoring sub-tier flowdown

A new heat treater omits the required lot link, leaving 180 finished shafts without the evidence needed for buyer review.

Choosing a universal retention period

A certificate is destroyed at the template's default date even though the customer record basis required it for the active equipment life.

Writing an unlimited audit phrase

The parties spend two weeks disputing notice, confidentiality, sub-tier access, and scope before a cause-based visit can begin.

Equating certification with product control

The buyer accepts an in-scope certificate but misses a drawing-specific test, delaying a fictional 300-piece release by three days.

Letting the spreadsheet approve

A green total is forwarded as release even though the authorized buyer never accepted one open concession, putting 120 pieces into transit prematurely.

Glossary

Supplier quality agreement

A controlled allocation of quality activities, communications, evidence, and authority for a defined buyer-supplier scope.

Clause topic

An operational subject that needs an applicability, responsibility, evidence, timing, review, and status decision before legal wording is finalized.

Applicability basis

The recorded reason a control is Required or Not applicable for the stated product, site, service, and requirement scope.

Responsible party

The buyer, supplier, or both parties assigned to execute or coordinate a defined activity.

Approver

The person or controlled role authorized to accept a result, exception, change, closure, or release within a stated scope.

Evidence reference

A stable identifier or location for the record that supports a status or decision.

Notification trigger

The defined event that starts a communication obligation.

Due basis

The event, milestone, or date from which a required notice, response, action, or review is measured.

Prior approval

Explicit authorization required before the supplier implements a stated action or moves to the next controlled stage.

Flowdown

Transmission of applicable buyer requirements to sub-tier providers whose work can affect conformity.

Nonconformance

Failure to meet a stated requirement.

Disposition authority

The bounded authority to decide what happens to identified nonconforming product or evidence.

For-cause audit

An audit triggered by a defined event or concern rather than only a routine schedule.

Agreement lifecycle

Issue, approval, effective use, review, revision, supersession, suspension, transition, and archive controls for the agreement.

Frequently asked questions

These answers are operational guidance. Applicable law, sector rules, customer requirements, and the buyer's authorized contract and quality owners govern the real arrangement.