Supplier qualification for manufacturers: process, documents, risk scoring and audit trail 

What is supplier qualification?

Qualifying a supplier means checking, before you buy from it, that it is who it says it is, that it meets your legal, tax, quality and compliance requirements, and that its risk is acceptable for what you will buy. In manufacturing, where a supplier's part ends up in your product, it also covers the supplier's quality system and its capacity to deliver to specification.

It is not the same as creating the vendor. Qualification is the evaluation and the approval; creating the vendor in the ERP is the administrative step that follows, and it should always come after. Spain and Latin America call the same process homologation.

What does a poorly qualified supplier cost a manufacturer?

The obvious cost is quality: a supplier without a working quality system ships parts that fail inspection or reach your customer. The less obvious ones are financial and legal. A payment to an entity on the OFAC list is a sanctions violation. A missing or wrong TIN can mean backup withholding and corrected 1099s. A bank detail changed by email without a call-back is the most common route to payment fraud. And in an audit, whether ISO, customer or regulatory, you need to show why each supplier was approved.

What documents should you request from a new supplier?

Not every supplier needs every document. This is a starting set for a US manufacturer, to adapt by category, country and spend. It is illustrative, not a legal checklist.

How to turn a list like this into rules that are applied the same way to every file is in the guide to applying a supplier policy to documents. For subcontractors who work on your sites, the construction prequalification guide adds safety records, licensing and bonding.

What is the supplier qualification process, step by step?

1. Set the requirement set by category, country and spend

   A packaging supplier and a supplier of machined safety-critical parts do not need the same file. Write down which documents, minimum limits and checks apply to each category, country and expected spend, so nobody asks for too much or too little.

2. Request the documents with a closed checklist

   Send the supplier one list of what you need and in what form. Follow up on what is missing; most of the elapsed time in qualification is waiting for documents.

3. Read each document against the requirement

   Do not just file it. Check issuer, holder, limits, scope and expiry, and that everything is consistent: same legal name, same TIN, same address across the W-9, the COI and the certificates.

4. Screen the entity, owners and officers

   Check the entity and the people behind it against the OFAC SDN list and other lists that apply to you. If you hold federal contracts, also check SAM.gov exclusions.

5. Score the risk

   Apply the pass or fail gates first, then score the rest on a defined scale. Record the reason behind every point.

6. A person approves

   The approver sees one file: what was checked, against which source, what passed, what is unclear and a recommendation. Below the threshold it is a standard sign-off; above it, a person reviews the specific issue and decides: approve, approve with conditions, or reject.

7. Create the vendor in the ERP

   Only after approval is the vendor created in the vendor master, with the validated legal name, TIN, bank details and terms.

8. Monitor and re-qualify

   Insurance and certificates expire. Re-check before each expiry, on a schedule set by risk, and whenever something material changes: ownership, bank details, a quality escape or a corrective action that stays open.

How do you score supplier risk?

A useful score combines few dimensions and explains itself. Apply the gates first; a gate failure is not averaged away by good scores elsewhere. Then score the rest on your own scale, set a threshold, and send everything above it to a person with the reason attached.

The weights depend on what you buy; a sole-source machined part and a commodity packaging supplier should not be scored the same way. The construction guide shows an illustrative weighting. If forced-labor exposure is part of the geographic dimension, the supplier regulation library covers UFLPA and the evidence to collect.

What audit trail do you need?

ISO 9001 asks you to keep documented information of how you evaluated, selected and re-evaluated each supplier. In practice that is one record per supplier with what was checked, against which source, with what result, who approved, when, and the documents attached. If that evidence lives across inboxes and shared drives, the qualification happened but cannot be shown.

What about suppliers you already have?

Most of the work is in the existing supplier base, not in new suppliers. Certificates and insurance expire, ownership changes, and suppliers that were approved years ago may never have had a complete file. Three checks are worth running on the existing base: which documents expire in the next 90 days, which suppliers are missing a required document today, and, if you can cross POs and invoices against the file, how much spend goes to suppliers with an open or expired requirement.

Common mistakes

• One checklist for every supplier, regardless of category or risk.
• Creating the vendor in the ERP before the file is validated, then never closing the gaps.
• Accepting a bank detail change by email without calling back on a known number.
• Filing a COI without reading the limits, the endorsements or the expiry date.
• Not watching expiries: the supplier was qualified, but its insurance lapsed months ago.
• Keeping the evidence across inboxes and shared drives, with no single record per supplier for the audit.

What should supplier qualification software do?

Whatever you evaluate, a procurement suite module, a specialized risk or prequalification tool, or an AI agent on top of your existing systems, check it against what the process above needs:

• Requirement sets by category, country and spend, written by your team rather than fixed by the vendor.
• A way to reach suppliers who will not log in to another portal, since many reply by email.
• Reading each document against the requirement, not just storing it: limits, scope, holder, expiry.
• Sanctions screening of the entity and its owners, with matches routed to a person.
• Risk scoring on your own scale, with the reason behind each score.
• An approval step with a named approver, and an audit trail of what was checked, against which source, by whom and when.
• Expiry tracking and re-qualification for existing suppliers, not only new ones.
• Write-back to your ERP or SRM after approval, with the ERP kept as the vendor master.

The supplier onboarding software comparison explains where each type of tool fits, and the guide to onboarding software without a supplier portal covers the options when suppliers will not log in to another system. If you already run SAP Ariba or Coupa, see how an agent works on top of an SRM.

Which part can be automated, and where does a person decide?

The execution can: requesting and chasing documents, reading them against the requirement, screening the entity and its owners, scoring the risk and preparing the approval. The decision to approve, any sanctions match and any score above your threshold stay with a named person. The ERP stays the vendor master.

Nora, Traza's supplier qualification agent, works that way. She emails the supplier a checklist built from your requirement set; the supplier replies with documents attached, with no portal and no account. She follows up every 3 business days on what is missing, reads each document, validates the tax ID, screens the entity and its directors against sanctions and PEP lists, and scores the risk on your scale. Your team gets one approval pack in Microsoft Teams or Slack. A person approves, and only then is the vendor written to your ERP or SRM. Traza connects to SAP, SAP Ariba, Oracle, NetSuite, Coupa, Ivalua, Jaggaer, Microsoft Dynamics and Workday, among others; which fields it reads and writes is agreed when the pilot is scoped.

Nora is not a vendor master, a supplier portal or a risk rating provider, and she does not audit sites or certify compliance. She checks the documents suppliers provide against your policy and prepares the decision. To see how that works on your own suppliers, book a call.

Frequently asked questions

This article is for information and is not legal advice. Practices and references are for the United States; check what applies to your contracts and your state.