A Supplier COA Is Not a Quality System

FDA warning letters are useful when teams read them correctly.

Not as entertainment.

Not as regulatory gossip.

Not as something to forward around with a subject line that says, "Can you believe this?"

The useful question is simpler:

Where could this happen here?

A June 2026 FDA warning letter to Sante Manufacturing Inc. gives pharma teams a very practical reminder. The cited issues include incoming component controls, supplier certificate of analysis reliance, process validation, and quality-unit responsibilities.

None of that is obscure.

None of it is exotic.

This is normal quality system territory.

Which is exactly why it matters.

Paperwork Can Support Control. It Is Not Control.

A supplier certificate of analysis can be useful.

A quality agreement can be useful.

A validation binder can be useful.

A batch record can be useful.

Useful is not the same as sufficient.

That distinction is where teams get into trouble.

A COA does not become reliable because it looks official.

A supplier does not become controlled because the supplier is on an approved list.

A process does not become validated because a protocol exists.

A quality unit does not have authority because the org chart says so.

The system has to work.

That means evidence.

Challenge.

Follow-up.

Decisions.

Ownership.

The boring stuff that saves you when someone starts asking direct questions.

The COA Is Not the Decision

There is a common failure mode in supplier quality.

The document is treated like the decision.

Supplier says the material passed.

COA is attached.

Box checked.

Everyone moves on.

That can feel efficient.

It can also be thin.

FDA expects firms to establish the reliability of supplier test results if they are going to rely on them. That is not a paperwork preference. It is a control expectation.

The practical questions are not complicated:

• Do we know this supplier is reliable?

• How do we know?

• What have we independently verified?

• What happens when results drift?

• Who reviews the trend?

• Who can stop use if the story does not hold?

If the answer is basically, "The COA was in the file," that is not supplier oversight.

That is document storage.

Very organized document storage, maybe.

Still not oversight.

Validation Is Not a Binder Either

Process validation has the same problem.

Teams can start to confuse the artifact with the state of control.

The protocol exists.

The report exists.

The signatures exist.

So the process must be fine.

Maybe.

But FDA's process validation guidance is built around a lifecycle view: process design, process qualification, and continued process verification.

In plain language:

Understand the process.

Show it can work.

Keep watching to make sure it still works.

That is different from treating validation as a one-time ceremonial event where everyone signs the binder and quietly hopes nothing gets weird later.

Validation should create confidence.

Not a false sense of closure.

The Quality Unit Has to Be Able to Say No

Quality-unit authority is another area where the paper version and the real version can separate.

On paper, the quality unit has responsibility.

In practice, pressure shows up.

Production needs material.

Commercial needs supply.

Leadership wants movement.

The customer is waiting.

The timeline is already bad.

That is when quality-unit authority becomes real or theoretical.

Can Quality challenge the supplier story?

Can Quality require additional testing?

Can Quality stop use?

Can Quality reject weak validation logic?

Can Quality slow the room down long enough to make a defensible decision?

If not, the problem is not only technical.

It is leadership.

And leadership problems have a habit of showing up as CGMP problems later.

Do Not Wait for FDA to Find the Thin Spots

The right response to a warning letter is not panic.

It is not smugness either.

The right response is a sober look at your own system.

Where are we relying on supplier paperwork without enough verification?

Where are we treating approved supplier status like permanent trust?

Where are validation packages complete but not convincing?

Where does the quality unit technically have authority but practically lack leverage?

Where do people know the system is thin but keep moving because the work has to ship?

Those are uncomfortable questions.

Good.

Comfort is not the goal.

Control is.

The System Has to Hold Before the Inspection

A supplier COA can support a quality decision.

It cannot replace one.

A validation binder can support process confidence.

It cannot create it by existing.

A quality unit can be named in a procedure.

It still has to be able to act.

This is the work that does not always look exciting.

Incoming component controls.

Supplier qualification.

Process validation.

Continued monitoring.

Quality-unit decisions.

Not flashy.

Not trendy.

Not conference-stage material.

But this is where the system either holds or it does not.

And when FDA asks why you trusted the material, why you accepted the process, or why Quality released the batch, the answer needs to be more than, "The paperwork was there."

The paperwork matters.

The ownership matters more.

Start there.