Change, Unannounced: Why Supplier Approvals Need a Living Verification Loop

The list records a decision, not a control

An approved vendor list is often treated as a control in its own right. A supplier is assessed, approved, added to the list and then reviewed annually. Purchasing uses the list to place orders. Quality uses it to demonstrate that due diligence took place. The document is tidy, signed and available for audit.

But an approval is a point-in-time decision. It confirms that a supplier was considered capable on the day of assessment. It does not confirm that the supplier is still using the same material, the same sub-tier sources, the same process route or the same tolerances today. Between approvals, suppliers change. Some changes are notified. Many are not. The approved vendor list remains accurate as a record of who was approved and increasingly inaccurate as a description of what is being supplied.

That gap is the silent supplier change gap. It rarely announces itself. It surfaces later as a batch failure, a customer complaint, a certification discrepancy or an audit finding that asks why the approved specification and the delivered product no longer match.

Where supplier change hides

The most obvious changes are material substitutions and process moves, but they are not the only ones. A supplier may change a sub-tier source for a casting or a coating. It may relocate a production line, revise an internal tolerance, change a software or firmware version, alter packaging or labelling, or subcontract part of the work to a new facility. Each change may be commercially rational and technically acceptable. The problem is not change itself; it is change that remains invisible to the customer.

Notification clauses are often too vague to help. Terms such as 'where practicable' or 'significant changes' leave room for interpretation. A supplier may genuinely believe that a change is not significant because it has not affected the supplier's own inspection results. The customer, meanwhile, has a conformity requirement that depends on the original approval basis. Without a shared definition, both parties can be acting in good faith and still end up with a nonconforming supply.

Make notification a condition of supply

The first step is contractual, not technical. Purchasing terms should define the categories of change that require prior written notification and approval before implementation. These should include material or material grade, sub-tier sourcing, manufacturing location, process route, key equipment, tolerances, software or firmware, and packaging or labelling where relevant.

The terms should also specify timing, evidence and flow-down. A supplier should know whether notification is required 90 days before the first affected shipment, before the change is implemented, or at another defined point. A simple change notification form — what has changed, why, what evidence supports the change, what the effect on the customer's specification is, and what validation has been done — makes the requirement actionable. The form should flow down to sub-tier suppliers where the change could affect the delivered product.

This is not a reason to burden every supplier with bureaucracy. It is a reason to be precise about which suppliers and which changes matter. Critical suppliers, bespoke parts and safety-related components deserve tighter terms than commodity items with mature and stable specifications.

Scorecards should measure change signals, not just delivery

Supplier scorecards often track delivery, quality and cost. Those measures are necessary but they are backward-looking. A supplier can score well on on-time delivery and ppm while quietly changing a sub-tier source. The scorecard should also capture change signals: whether notifications were made, how quickly the supplier responded to a change query, the quality of the evidence provided, and the transparency of sub-tier information.

These indicators do not need to be complex. A quarterly review can ask a small number of direct questions. Has the supplier changed any material, process, location or sub-tier source in the last 12 months? If so, was it notified and approved? If not, how does the supplier know? Are certificates and declarations still scoped to the approved specification? A supplier that repeatedly answers 'no change' without being able to explain how it monitors change is not providing assurance. It is providing a statement.

Verification routines: sample the reality, not the file

Approved vendor lists are only as good as the verification behind them. Incoming inspection should be risk-based and should check the things that change most often, not only the things that are easiest to measure. Certificate authenticity, material grades, process evidence and revision status all deserve attention. For critical suppliers, periodic visits, remote verification or witness testing can confirm that the approved process route is still in use.

Verification should also compare the actual product and documentation with the approved specification, not simply confirm that a certificate exists. If a drawing has been revised, does the supplier hold the current revision? If a process has moved, is the new line covered by the approval? If a sub-tier has changed, is there evidence that the change was assessed? These questions turn the approved vendor list from a static register into part of a living verification loop.

A practical approved vendor list review checklist

• Is each part linked to the current drawing, specification and revision status?
• Does the approval record state the approved scope, including processes and critical sub-tiers?
• Do purchasing terms define notifiable changes, timing, evidence and approval before implementation?
• Has the supplier declared any material, process, location or sub-tier changes in the last 12 months?
• Are certificates and declarations checked for authenticity, scope and current revision?
• Are incoming verification routines risk-based and recorded against the approved specification?
• Does the supplier scorecard include change notification and evidence quality?
• Are open change requests tracked to closure and linked to the affected parts?
• Is the approved vendor list reviewed at a defined frequency and after incidents or complaints?
• Are purchasing, quality and engineering working from the same list and the same change definitions?

From list to loop

The approved vendor list is not a control. It is a record that supports a control. The control is the loop: approve, monitor, verify and review. That loop needs an owner, a cadence and an escalation route. It needs purchasing terms that make notification a condition of supply, scorecards that reward transparency, and verification routines that sample reality rather than the file.

For UK manufacturers in 2026, supply chains are too fluid for annual paperwork to carry the weight. The companies that manage supplier change well are not the ones with the longest vendor list. They are the ones that know when something has changed, why it changed and whether the approved basis still holds.