The Supplier Vetting Checklist: What to Ask Before the First Order

Most supplier vetting happens after the money moves

The usual sequence in this category runs backwards. An operator finds a supplier, places a small order, waits for it to arrive, inspects the vials, and only then starts asking questions about documentation, testing and traceability.

By that point the relationship has already started and the questions are harder to ask. Nobody wants to interrogate a vendor who has just shipped them something.

This is the checklist run before the first order instead. Every item is a question with a checkable answer, and each one is here because its absence creates a specific problem downstream rather than because it sounds prudent.

Before you contact anyone

Two things are worth deciding in advance, because both change how you read every answer you get.

What you are actually buying. A distributor and a manufacturer are different relationships with different failure modes. A distributor can be excellent and still cannot answer a synthesis question, because they were not there. Ask which one you are speaking to before anything else, and expect the answer to shape the rest of the conversation.

What documentation you require, in writing, before you order. Deciding this after seeing what a supplier volunteers means your standard becomes whatever they happened to provide. Write it down first.

Section 1: identity and traceability

• What is the legal entity name and where is it registered? A trading name with no entity behind it is a relationship with nobody.

• Where is the material manufactured? Country and, ideally, facility. A supplier who cannot say has a supply chain they do not control.

• Are you the manufacturer or a distributor? Both are legitimate. Confusing the two is not.

• How long have you supplied this specific compound? New to a molecule is not disqualifying. It changes how much weight the answers below can carry.

Section 2: documentation

Documentation is the section that separates suppliers, and the questions are ordered so an early failure saves you the rest.

• Will you send the certificate matching the lot number on the vial I receive? The single highest-value question in the whole checklist. A yes that arrives without hesitation is worth more than any marketing page.

• Is that certificate generated per batch, or is one document used across production? The difference is covered in batch-specific or generic lot.

• Which laboratory performed the analysis, and is it independent of the manufacturer? Independence has a structural definition, set out in what third-party tested actually means.

• Does the certificate name the analytical methods? A purity figure with no named chromatographic method is a number without a measurement behind it.

• What mass tolerance does the laboratory apply, and in what unit? Daltons or a percentage. This one line decides whether identity was confirmed, and the reasoning is in the mass spec tolerance red flag.

• How long are batch records retained, and can I request one later? A retention period of zero means a question in six months has no answer.

• What happens to material that fails specification? The most diagnostic question nobody asks. A real specification is a gate, and a gate means some material does not pass. A supplier with no disposition process has a specification that has never actually stopped anything.

Section 3: handling and shipping

• How is material stored before shipping, and at what temperature?

• How is it shipped, and is temperature controlled in transit?

• What is the stated shelf life, and from what date does it run? Manufacture or testing, and they are not the same date.

• What happens if a shipment arrives compromised? Ask before you need to know.

None of these is exotic. All of them are routinely unanswered, and the pattern of answers tells you whether you are dealing with an operation or a storefront.

Section 4: the claims they make about themselves

This section exists because a supplier's own marketing becomes your problem the moment you repeat it.

• Which claims on your site apply to every batch, and which to a specific one?

• Can you supply the evidence for the purity figure published on the product page?

• Who set the acceptance criteria on your certificates?

If you republish a supplier's purity or testing claim on your own site, that claim is now yours. Under the FTC's Health Products Compliance Guidance, claims about health-related products require substantiation in the form of competent and reliable scientific evidence, held at the time the claim is made. A supplier's assurance is not documentation, and the guidance defines advertising to cover the wide variety of marketing techniques and promotion methods that marketers engage in rather than only formal ads.

The practical rule is simple. Do not publish a claim you cannot substantiate from documents in your own possession.

Section 5: your own regulatory posture

The last section is not about the supplier at all.

• What will your product pages say, and does that language establish a therapeutic intended use? Intended use is defined in the Code of Federal Regulations (CFR) by 21 CFR 201.128 as the objective intent of the persons responsible for labeling, shown by labeling claims, advertising matter, or oral or written statements. The background is in Research Use Only.

• Who reviews claims before they publish, and is that recorded with a date?

• Have you read a month of the FDA warning letter record for this category? It is free and it is specific. See what FDA warning letters actually say.

A supplier cannot fix your representations. The best documentation in the world sits behind a page whose copy is doing something else entirely.

Scoring the answers

Resist the urge to build a weighted matrix. In practice three tiers are enough.

Disqualifying. No entity name. No batch-linked certificate. Refuses to name the testing laboratory. No answer on out-of-specification disposition. Any one of these on its own is enough to stop.

Requires a decision. In-house testing only. Representative certificate with a batch record available on request. Short retention period. Each is workable with eyes open, and each should be recorded as a decision rather than absorbed silently.

Green. Batch-linked certificate, named independent laboratory, methods stated, tolerance in daltons, retention period defined, disposition process described.

The middle tier is where most real suppliers sit, and the point of writing the decision down is that a year later you will not remember which compromises you accepted deliberately.

What this checklist does not cover

Being explicit about the boundary keeps the checklist honest.

It does not assess anything about what any compound does in a person. That is not a supply question and no supplier document answers it. It does not replace legal review of your own regulatory position. And it does not evaluate payment processing, fulfillment or platform risk, which are separate operational problems covered in high-risk payment processing and anatomy of a compliant product page.

Why this runs before the order and not after

One last framing point, because it changes whether the checklist gets used.

Vetting after delivery is not vetting, it is inspection. By then the money has moved, a relationship exists, and the questions carry an implication that something is wrong. Most operators quietly skip them at that point, which is exactly how a supplier with weak documentation stays in a supply chain for years.

Run before the first order, the same questions are ordinary commercial diligence and nobody takes offence. A supplier who finds them intrusive at that stage has told you something useful for free.

The other reason to front-load it is that the answers change what you can publish. Your product page inherits your supplier's documentation. If the certificates are representative rather than batch-linked, your page cannot honestly say every batch. Discovering that after the page is written means rewriting the page rather than choosing a different supplier, and rewriting is the more expensive option.

Frequently asked questions

How many suppliers should I run this against?

At least three, in parallel. The answers are far more informative in comparison than in isolation, because you learn what a normal answer sounds like.

A supplier says the certificate is confidential. Is that reasonable?

For the batch you are purchasing, no. Confidentiality is a reasonable position about their internal process documents and an unreasonable one about the analysis of material you are buying.

They answered everything but the out-of-specification question. How bad is that?

The out-of-specification question is the one that reveals whether the specification functions as a gate. An evasive answer there is more informative than a weak answer anywhere else.

Should I require independent testing on every batch?

Require it where the claim you publish depends on it. If your page says every batch is independently tested, then yes, on every batch, or the sentence changes.

Is this article legal advice?

No. It is an operational checklist with links to primary sources. Your specific regulatory position belongs with qualified counsel.

All compounds referenced anywhere on this site are supplied strictly for laboratory research purposes only. Nothing here is for human consumption, and nothing here is intended to diagnose, treat, cure, or prevent any disease.