The First-Order Pack: Nine Files Buyers Actually Need
Share
The first shipment arrives. Inside the carton there is a drum, and inside the email there is one attachment: a certificate of analysis. The purchasing manager files it. Six weeks later the quality team tries to qualify the supplier and discovers that the specification has no version number, the safety data sheet is for a different grade, and nobody can say whether the material is animal-derived.
None of these gaps is difficult to close. All of them are much easier to close before the order than after it, because before the order you have leverage and after it you have a drum on the floor.
The nine documents
| # | Document | Who reads it | What it settles |
|---|---|---|---|
| 1 | Certificate of analysis, batch specific | Receiving, QC | What this batch tested at |
| 2 | Specification, versioned and dated | QA, regulatory | What future batches promise |
| 3 | Safety data sheet, current, matching grade | EHS, warehouse | How it is handled and stored |
| 4 | Non-confidential process flow | QA, technical | Where quality is controlled |
| 5 | Origin statement, including TSE/BSE position | Regulatory | Whether the file can be accepted at all |
| 6 | Allergen and GMO statement | Regulatory, customers' customers | Downstream declarations |
| 7 | Residual solvent and elemental impurity position | QA, regulatory | Whether ICH Q3C and Q3D are addressed |
| 8 | Packaging and storage statement | Warehouse, logistics | Whether the warehouse can hold it |
| 9 | Quality agreement or its technical annex | QA, legal | What happens when something goes wrong |
Nine files, one of which is usually present. The interesting question is not why the other eight are missing but why the industry has settled on a norm in which one document is treated as the whole pack.
Three documents that carry different promises
The certificate, the specification and the safety data sheet are frequently treated as three versions of the same thing. They are not.
The certificate is a statement about one batch. It says what was tested, by which method, with what result, against which limit. It expires with the batch.
The specification is a statement about the process. It says what any future batch will be released against, and it has a version number precisely because it changes. A specification without a version is a document that cannot be cited in a regulatory file, because the file has to say which version was in force.
The safety data sheet is a statement about handling, not quality. It can be correct while the quality documentation is thin, and it can be out of date while the quality documentation is excellent. Its most common failure is a mismatch of grade: a sheet for the technical grade attached to a shipment of the high-purity grade.
The origin statement is the one that stops a file
Most bile acids have an animal origin somewhere upstream. That single fact triggers a set of declarations that a customer's regulatory team cannot avoid: the TSE/BSE position, the species, the tissue, and increasingly the country of origin of the starting material.
If the answer is "animal-derived, porcine", the customer needs it in writing, on letterhead, with a date. If the answer is "synthetic" or "vegetal", they need that in writing too, because a claim of non-animal origin is itself a regulatory statement that has to be supported.
This is the document that most often turns a two-week qualification into a two-month one. It is also the cheapest to prepare, which makes its absence hard to explain.
The process flow, and what "non-confidential" means
A customer's technical due diligence needs to know the unit operations: where the starting material enters, where purification happens, where the material is dried, milled, blended and packed, and at which points the specification is applied. That is a flow diagram with boxes and arrows.
It does not need the solvent identities, the temperatures, the catalyst, or the yields. A supplier who declines to provide even the box-and-arrow version is protecting something that is not in the diagram, and the customer is entitled to draw their own conclusion about why.
The order of operations
The pack should be assembled before the purchase order, not before the shipment. The sequence that works is: enquiry, technical exchange, draft pack, customer review, open points closed, then order.
The sequence that fails is: order, shipment, arrival, qualification, discovery. In that sequence every missing document becomes an urgent request against a supplier who has already been paid and has no particular reason to prioritise it.
A useful discipline is a single page that lists the nine documents, the version or date received, and the reviewer's initials. It takes ten minutes to maintain and it is the first thing an auditor asks for when they want to know how the supplier was qualified.
What cannot be provided, and how to say so
Some requests are unreasonable: full process details, the identity of upstream suppliers, customer lists, internal audit reports. A supplier should decline those clearly and offer the nearest thing that serves the same purpose.
Declining without an alternative reads as concealment. Declining with an alternative reads as a professional boundary. The difference is one sentence: "we do not release the process description, but here is the unit-operation flow and the control points, which is what your technical review needs."
Where this leaves a supply-chain partner
Our pack is assembled at quotation stage rather than at shipment stage, because the questions it answers are the ones that decide whether a quotation becomes an order. Where a document does not exist yet, we say which one and when it will, instead of sending eight files and letting the customer discover the ninth is missing at their audit.
If you are buying a bile-acid raw material for the first time, ask for the nine before you ask for the price. The supplier who can produce them in a day is a different supplier from the one who cannot, and the difference will show up again in every subsequent batch.
When a document genuinely does not exist
Some of the nine will not exist at the first enquiry, and the way a supplier handles that is more informative than the documents themselves.
Three responses are possible. The first is to send a document from a different product and hope nobody reads the header. That is the worst option and it is common, because it is fast. The second is to say nothing and answer only the questions that were easy. That produces a qualification that stalls three weeks later when the customer notices the gap. The third is to name the missing document, say why it is missing, and give a date.
Only the third survives contact with a customer's quality system. A specification that is being revised, an origin statement that is waiting on a supplier declaration, a safety data sheet that is being updated to a new format: each is a legitimate state, and each is acceptable if it is declared. What is not acceptable is discovering it at the audit, because at that point the customer has to assume the supplier did not know, which is worse than the document being late.
The FDA guidance library and the ICH Q6A specification framework describe what a complete technical file contains for a regulated material. The EDQM site is where a European customer will check whether a monograph exists at all, which decides whether some of the nine are mandatory or merely useful.
A one-page tracker
The tracker is the least glamorous document in supplier qualification and the one that prevents most of the failures. One row per document, five columns: document, version or date, received yes or no, reviewer, open question.
It does three things that memory does not. It makes the gap visible before the order rather than after. It records which version was reviewed, which is the question an auditor asks and nobody can answer from an inbox. And it survives the departure of the person who built it.
Ten minutes to set up, two minutes per update, and it replaces a recurring conversation about whether the SDS was ever received, which otherwise gets reconstructed from memory three weeks after the order. For a customer qualifying several suppliers, the same page across suppliers becomes a comparison, and the comparison is where the differences show: one supplier returns eight of nine in a week, another returns four in a month.
Two companion checks belong beside it. The certificate reading guide covers what to look for on the document that always arrives, and the specification gap analysis covers the comparison that matters most once the specification is in hand. The internal consistency checklist is the five-minute test that catches most certificate errors before they reach the tracker.
Frequently asked questions
Is a COA enough to receive material?
It is enough to open the box, not enough to close the qualification. A COA describes one batch against a specification. Receiving needs the specification itself, with a version and an effective date, plus the safety data sheet for handling and the storage statement for the warehouse. Three documents, three different readers.
Why do I need the specification if the COA quotes limits?
Because the COA quotes the limits that applied to that batch, and the specification is the promise about future batches. They can differ if the specification was revised and the COA was issued before the revision took effect. A COA without a specification version number cannot be checked against the document it is supposed to implement.
What is a TSE/BSE statement and do I need one?
It is a statement about transmissible spongiform encephalopathy and bovine spongiform encephalopathy risk, relevant because many bile acids are derived from animal tissue. If your material is animal-derived, your customer's regulatory file will require the statement, and its absence stops a qualification rather than slowing it. If the material is vegetal or synthetic in origin, the statement should say that instead.
Can the supplier refuse to provide a process description?
Yes, and often should. What the customer needs is a non-confidential flow diagram showing the unit operations and the points at which quality is controlled, not the proprietary details. A refusal to provide even that is a different matter, and it usually means the documentation does not exist rather than that it is secret.
Should documents arrive with the shipment or before it?
Before, in draft, so that receiving knows what to check. The final signed set travels with the batch. A pack assembled after arrival is a pack assembled under time pressure, and that is when version numbers get missed and the wrong SDS gets filed.
What does a quality agreement add on top of the documents?
It converts documents into obligations: who notifies whom, within what period, when a specification or process changes, how a complaint is investigated, and which laboratory settles a dispute. The documents describe one moment. The agreement describes what happens between moments.