Peptide Supplier Audit Checklist: Time the Retrieval

An annual supplier audit built on a questionnaire the supplier fills out is evidence of nothing. Only a timed retrieval test, run against lot numbers already sitting in the buyer's inventory, forces a supplier to produce documentation that had to exist before the request was made.

Most peptide supplier audit checklists in circulation are questionnaires. Thirty to eighty questions, emailed to the supplier, answered by the supplier, signed by the supplier, and filed by the buyer as the annual requalification record. The document that comes back is a statement of intent produced by the party whose performance is under review. It has the same evidentiary weight as a reference letter a job applicant writes about himself.²

The alternative takes a single quality-contact phone call and a stated deadline, and it produces something a buyer can actually put in a file: a timed retrieval test, run against lot numbers the buyer already holds, scored on how fast and how completely four specific document types come back. What follows is the mechanics of that test and the enforcement record that explains why the clock, not the questionnaire, is the instrument.⁴

Why a self-reported audit questionnaire proves nothing

A supplier qualification questionnaire asks whether batch production records are maintained, whether deviations are investigated and closed, whether complaints are logged against lot numbers, and whether analyst raw data is retained. Every one of those questions has an obvious correct answer. A supplier that cannot produce a single batch record still knows that the answer to "are batch production records maintained?" is yes. The questionnaire therefore separates suppliers who read the question from suppliers who did not, and nothing else.²

The FDA warning letter archive is, read one way, a list of firms whose self-assessments would have come back clean. Records were reconstructed, lost in a move, or declared confidential and unwritten — and in each case the firm had operated for years under contracts with buyers who had presumably asked the standard questions and received the standard answers.^2,4,6,7

• "Are batch records retained for each lot?" — establishes that the supplier understands the word "retained."
• "Are deviations documented and closed?" — establishes nothing about the deviation file for the lot in the buyer's warehouse.
• "Is a complaint log maintained?" — establishes nothing about whether the buyer's own prior complaint appears in it.
• "Is analyst raw data retained per procedure?" — establishes that a procedure is claimed to exist, not that data is behind it.

None of this argues against having a questionnaire. It argues that the questionnaire is a scoping tool — it tells the buyer what the supplier claims, so the retrieval test can be aimed at the claims. Treated as the audit itself, it is a signature on a page.²

What FDA found when it asked the same questions Unexo Lifesciences had already answered favorably

In a warning letter dated November 6, 2024, FDA described what its investigators found at Unexo Lifesciences, Private Limited. Batch production records for the firm's patch product were located torn and discarded in plastic bags on a rooftop. Records that should have been available at inspection were missing.⁴

Executive management at the firm admitted it did not have all batch records for released drug products, and further admitted that batch production records had been retrospectively prepared for the FDA investigators. FDA also found the firm lacked raw data — including peel strength and rolling ball analysis data — to support release of a specific batch.⁴

Now run the standard questionnaire against that firm. Batch records maintained: yes. Raw data retained: yes. Records available on request: yes. Every answer defensible in the sense that a document with the right title existed or could be made to exist. A paper audit conducted by email in the month before that inspection would have returned a clean requalification file, and the buyer relying on it would have had no reason to look again for another twelve months.⁴

Records prepared after the fact look identical to records prepared on time — until you time the retrieval

A batch record written six months late, with the same pen and the same signatures, is indistinguishable on inspection from one written contemporaneously. This is the structural problem with document review as an audit method: the artifact carries no reliable timestamp of its own creation, and a buyer reviewing a scanned PDF is looking at the least informative possible view of it.⁴

FDA made this point directly in the Unexo matter, stating it could not be assured of the validity of the firm's reconciled records because the firm had no method to detect non-contemporaneously prepared records — some of which had been created during the inspection itself. The agency did not object to the appearance of the documents. It objected to the absence of any mechanism that would distinguish a record made at the time from a record made afterward.⁴

A buyer cannot install that mechanism at a supplier's site. What a buyer can do is impose a constraint the supplier cannot satisfy retrospectively: a short, fixed window between the request and the delivery. A document returned the same business day, before there is time to draft anything new, was already assembled before the request was made. A document that arrives four days later, cleanly formatted and complete, tells the buyer only that four days were available.⁴

When a supplier says the process is not written down at all

The retrieval test has a floor case, and it is worth naming because buyers assume it does not happen. In a warning letter dated May 2, 2019, FDA recorded that a representative of Kadesh International told investigators the firm's actual manufacturing process was confidential and not written down.⁷

That is a complete answer to a retrieval request and it takes no time at all to produce. There is nothing to retrieve. A questionnaire would never surface it, because no supplier writes "not written down" in the box next to a question about master production records. It surfaces when a specific lot is named and a document is demanded within a stated window, at which point the supplier must either produce paper or explain its absence on a recorded call.⁷

Confidentiality is the usual framing of the refusal, and it is worth separating two things. A supplier withholding a synthesis route from a reseller is ordinary trade-secret behavior. A supplier that cannot produce a redacted batch record showing lot identity, dates, quantities, in-process checks and release signatures is not protecting a trade secret; it is reporting that the record does not exist in retrievable form.⁷

Designing the test: name three lots already in inventory before the call is placed

Lot selection is the entire methodology. If the supplier picks the lot, the supplier picks a lot whose file is complete, and the exercise measures the supplier's best case. If the buyer picks lots from material already received, weighed in, and shelved, the supplier has no ability to stage the response, and the buyer additionally holds physical inventory against which the returned paperwork can be reconciled.⁹

FDA has treated batch-number-specific retrospective retrieval as a reasonable demand. In a June 13, 2019 warning letter, the agency required Akorn to reject a specific lidocaine hydrochloride lot and to produce a summary of past processing videos for all batches with leak problems over a three-year span, each identified by batch number and date. That is the shape of the request: named lots, defined lookback, itemized response.⁹

1. Pull three lot numbers from received inventory: the oldest lot still on the shelf, the most recent lot received, and one lot that generated any prior quality contact — a short-fill, a label discrepancy, a temperature excursion on arrival.
2. Do not pre-notify. The requalification calendar can be published; the lot numbers cannot.
3. Place the request in writing to the named quality contact, with the request timestamp recorded, and state the four document types and the response window in the same message.
4. Set the window at one business day for retrieval — short enough that a supplier cannot draft a new record inside it — and five business days for anything requiring redaction review, matching the turnaround a legal or quality review of a redacted document actually takes. Record which of the two applies to each item.
5. Log every follow-up contact with its own timestamp. The number of prompts required is a scored field, not an administrative detail.
6. Reconcile the returned batch record against the physical inventory: lot number, strength on the vial label, quantity shipped, expiry date, and the certificate already on file.

A single lot that comes back slow is noise — it could be one person out of the office. The same gap across three separately chosen lots — oldest on the shelf, most recent received, and one with a prior quality contact — is not noise. It is a finding about the system, not about one file.⁹

The four documents that must exist before the phone call

The test scores four document types, chosen because each one is independently verifiable against something the buyer already holds and because each corresponds to a category FDA treats as either present or missing, with no partial credit.^3,9

The analyst raw data item carries the most weight and is the one most often skipped. In a warning letter dated July 16, 2019, FDA found that Indoco Remedies had released a tablet batch on handwritten batch records showing in-range values, while the programmable logic controller data for the same batch and the same time period recorded out-of-limit values. The summary document and the underlying data disagreed, and only the underlying data was informative.³

The complaint log line is the cheapest check on this list, because it requires no cooperation from the supplier to score. A buyer that has previously filed a written complaint against a product already knows whether that complaint should appear. If it does not appear in the supplier's extract, the buyer has learned something about the supplier's whole complaint system from a single lookup.³

Scoring retrieval latency and completeness as a written record, not a pass/fail

The deliverable from a retrieval test is not a grade. It is a dated file containing the request timestamp, the delivery timestamp for each of twelve items — four document types across three lots — the number of prompts required, and a plain-language note on what was missing. That file is the artifact that replaces a signed self-assessment in the requalification record.⁶

Retention windows give the latency score a legal floor. FDA cited Bingbing Pharmaceutical Co., Ltd in a warning letter dated October 3, 2019 for failing to maintain batch-associated production, control, and distribution records for at least one year past the batch's expiration date, the period required under 21 CFR 211.180(a). A supplier that cannot retrieve records for a lot still inside that window is not slow; it is outside a stated requirement, and the retrieval file documents exactly when the request was made and what came back.⁶

• Latency, per item, in business hours from request timestamp to receipt of the document itself — not to receipt of an acknowledgment.
• Completeness, scored as delivered, delivered partial, or not delivered, with the missing element named.
• Prompts required, counted per item.
• Reconciliation result: does the returned paperwork match the physical lot and the certificate already on file.
• Explanation offered for any gap, recorded verbatim from the supplier's written response.^6,3

Reconciliation deserves the last word in the score because Indoco shows what a clean-looking document is worth when nothing independent is checked against it. Two records covering the same batch and the same time window disagreed, and the discrepancy was only visible because both were placed side by side. A retrieval file that logs delivery times but never compares the batch record to the vial in the warehouse has automated the questionnaire rather than replaced it.³

Using the retrieval file to renew, terminate, or defend a sourcing decision

The retrieval file has three uses, and only one of them is internal. Renewal is the ordinary case: latency inside the window, four of four documents on all three lots, reconciliation clean, file dated and closed until the next cycle. Termination is the case where a supplier cannot produce records for lots still inside the retention period, and the file is the substantiation for ending the relationship without argument about price.⁶

The third use is the one that justifies the exercise. If a lot is later challenged — by a customer, by a downstream recall, by a regulator asking how the material was sourced — the buyer is asked what it did to qualify the supplier. A signed questionnaire answers that question badly. A dated retrieval file showing that specific lot numbers were named, a clock was run, and documentation was produced within a recorded window answers it as well as a buyer can.^6,4

Any gap the retrieval file records — a missing deviation index, a complaint that does not appear, raw data withheld — should generate a supplier corrective action request naming the specific lot, the specific document type, the original request timestamp, and the response actually received, not a general description of the problem. That converts the finding into a tracked item with a due date instead of a line in a spreadsheet. A supplier that closes those requests inside the same window used for the original retrieval test is demonstrating the capability the questionnaire only asserted.⁶

An onsite audit finds what email cannot: Unexo's own investigators located batch production records torn up and discarded in plastic bags on a rooftop, a fact no remote review would ever surface. But few peptide buyers will send an inspector to a contract manufacturer's facility, and the paper-versus-onsite choice is not the one most of them are actually making. The question in front of them is whether a remote audit measures anything at all. Timed retrieval against buyer-selected lots does. A questionnaire does not.⁴