Chapter 22: Supplier Nonconformance and Development: Closing the Loop

You've identified a problem: a supplier shipped 200 units of a machined bracket, and dimensional checks show 12 are out of tolerance on a critical hole. Or a reagent vendor's delivery was five days late, disrupting your production schedule. Or a contract manufacturer changed a sub-supplier without notifying you, and you discovered it during receiving inspection.

This is where most plants break the loop. They issue a purchase hold, maybe send an email, and move on. Six months later, the same supplier makes the same mistake. By then, you've passed nonconforming material to customers and spent money on rework.

ISO 9001 demands a different response: documented, verified corrective action tied to root cause.

The SCAR (Supplier Corrective Action Request) Process

A SCAR is a formal request that the supplier identify the root cause of a problem and implement action to prevent recurrence. Here's what a defensible SCAR process includes:

1. Issue documentation

   - What happened (nonconformance description) - When it was discovered - Quantity affected and impact (scrap, rework, customer notification?) - Root cause hypothesis (if you have one)

2. Supplier notification

   - Written request (email is fine, but keep it in your quality system) - Clear statement of what you expect: root cause analysis, corrective action plan, implementation date, verification method - Response deadline (5–20 days depending on severity and supplier tier)

3. Root cause investigation

   - Supplier conducts 5-Why analysis or fishbone diagram (you can require this format) - Supplier explains what happened and why—not just "operator error" (which isn't a root cause, it's a symptom) - Examples of real root causes: "Machine maintenance schedule was missed due to staffing shortage and no backup operator" or "Change order was received but not entered into work instruction system, and old procedure was used"

4. Corrective action plan

   - Supplier describes specific action(s) to address root cause - Includes timeline, responsibility, and resources - Must be preventive (stops it from happening again), not just one-time fix (scrap the bad parts and start over)

5. Verification and closure

- Supplier confirms action is complete and describes how effectiveness is verified - You may require follow-up evidence: updated procedure, training records, next shipment inspection data, or a follow-up audit - You accept the SCAR only when you're satisfied the root cause was addressed

A typical SCAR might take 4–6 weeks from issue to closure. Tracking this is critical—create a SCAR register in your quality system with columns for:

• SCAR number (unique ID, e.g., SCAR-2026-001)
• Date issued
• Supplier name
• Issue description
• Root cause (once confirmed)
• Corrective action
• Verification method
• Closure date
• Status (open, pending verification, closed)

Connecting SCAR Data to Supplier Performance and Management Review

This is where the closed loop becomes visible. Every month or quarter, pull your SCAR register and ask:

• Which suppliers have open SCARs? Are they overdue?
• Have any suppliers received multiple SCARs for the same issue? (That's a sign corrective action didn't work, or wasn't truly implemented.)
• What categories of issues appear most? (Delivery delays, dimensional nonconformance, documentation gaps?)
• Is a previously critical supplier now receiving frequent SCARs? (Trigger a re-evaluation.)

Roll this data into your management review (Clause 9.3.2). Present the supplier performance trends to leadership. This makes supplier quality visible at the executive level, not just in the quality department.

Some Canadian manufacturers we've worked with have implemented quarterly supplier performance reviews with their most critical vendors—a conference call or site visit where both parties review SCARs, scorecard metrics, forecasts, and mutual improvement opportunities. These relationships shift from transactional (you buy, they supply) to collaborative (we're solving problems together).

The goal of supplier management is not to punish vendors or accumulate paperwork. The goal is to build a supply chain that delivers what you need, on time, at target cost. Supplier quality management is how you make that real and sustained. By 2026, market volatility and supply chain fragmentation are normal. The manufacturers winning are those with visibility and control over external providers, tied to documented systems that work.

Your next step: Audit your current supplier list. Classify them into tiers. Pull your incoming inspection records from the past 12 months and calculate actual defect rates by supplier. That data becomes the foundation for your risk-based controls. Then, build your scorecard.

If your organization operates in automotive, the IATF 16949 framework aligns closely with ISO 9001 supplier management requirements and adds additional automotive-specific controls—we cover the integration in our IATF 16949 implementation services.

For statistical sampling methods, the ANSI/ASQ Z1.4-2024 standard and ISO 2859-1 provide detailed sampling tables and inspection level guidance. These standards are referenced in sector-specific requirements and are essential for defensible risk-based acceptance plans.

Ready to strengthen your supplier quality management system? Let's talk about how to implement these practices in your operation. Schedule a consultation with our ISO 9001 and supplier management specialists.

Designing an ISO Internal Audit Program That Finds Real Problems (Not Just Ticks Compliance Boxes)

Your internal audit program is supposed to be the safety net between what you think is happening in your QMS and what's actually happening on the floor. Yet in most Canadian manufacturing plants, internal audits have become a checkbox exercise: auditors schedule visits, collect signatures, file reports, and by the time a certification body walks in, everyone's confident the system is sound. Then the nonconformance notice arrives, and the finding points to something your auditors walked right past three months earlier.

This isn't a failure of auditors—it's a failure of program design. The difference between an internal audit program that detects real system gaps and one that merely documents compliance lies in how you structure the program, train the auditors, and connect findings to corrective action. This chapter walks you through building an ISO internal audit program implementation strategy that actually works.