Ask for the control plan before you ask for the certificate of analysis

A 2 mL autosampler vial lot arrived with a certificate of analysis showing septum thickness of 1.02 mm against a 1.00 mm nominal. The lab accepted it. Six weeks later, a 96-injection sequence on an Agilent 7890B produced three split peaks at retention time 7.4 minutes, and the investigation traced back to a 0.04 mm variance in the crimp seat that changed the needle penetration depth by roughly 0.3 mm. The certificate had been technically accurate and operationally useless. That is the failure a lab vials supplier audit checklist is meant to prevent, and most checklists I have reviewed would have missed it because they ask whether a CoA exists, not what the CoA measures.

The checklist below is the one I use when a lab asks me to help qualify a new vial vendor or re-qualify an existing one. It focuses on the quality-system items that predict trouble, the evidence you can demand before a sample ever ships, and a scoring method that produces a defensible yes or no. It deliberately skips the factory walk-through and the contract language, both of which are covered elsewhere and are not where supplier failures usually originate.

A CoA tells you what the vendor measured on the lot you received. A control plan tells you what they measure on every lot, at what frequency, with what gauge, and what happens when the result falls outside the limit. I have seen vendors with impressive CoAs and no control plan at all, which means the CoA is a snapshot of a process nobody is steering.

Request the control plan as a document, not a conversation. For a 2 mL crimp vial, the plan should name at minimum: neck OD, neck ID, crimp seat height, body OD, body height, wall thickness at three stations, septum thickness, septum durometer, and closure crimp dimensions. Each line needs a nominal, a tolerance, a sample size, a frequency (per shift, per lot, per hour), the gauge type (contact, optical, air gauge), and the reaction plan when a point trends toward the limit.

Two things in that document predict trouble better than anything else. First, whether the gauge is calibrated against a traceable standard and how often. Second, whether the reaction plan is specific. “Notify supervisor” is not a reaction plan. “Hold lot, quarantine, re-gauge 30 pieces from the same cavity, escalate to QA within 4 hours” is.

What a control plan should actually contain

• Dimensional stack control: neck OD held to ±0.10 mm, crimp seat height to ±0.15 mm, body height to ±0.25 mm for a 32 x 11.6 mm vial.
• Septum control: thickness tolerance no wider than ±0.05 mm, durometer to ±3 Shore A, and a defined needle-penetration test at 50 or 100 punctures per lot with a coring acceptance criterion.
• Glass defect control: a documented AQL sampling plan, typically AQL 0.65 on critical defects and AQL 1.5 on major, with the defect classification list attached.
• Gauge list: every instrument identified by asset number, calibration interval, and last calibration date.
• Reaction plan: a written escalation path with named roles and time limits.

If the vendor cannot produce a control plan within five business days, that is your first data point. A supplier who manufactures vials has one. A supplier who buys and repackages vials may not, and you need to know which you are dealing with. This is also where you separate a manufacturer from a trading house, and the difference matters for everything downstream.

Interrogate the dimensional data, not the pass/fail stamp

A CoA that says “conforms” is worthless for audit purposes. What you want is the raw measurement distribution: the mean, the standard deviation, the sample size, and the min/max for each critical dimension. With those four numbers you can compute a process capability index and see whether the vendor is running comfortably inside the tolerance or hugging the limit.

Ask for Cpk on neck OD and crimp seat height. A capable process should show Cpk at or above 1.33. If the vendor reports Cpk between 1.0 and 1.33, the process is marginal and you should expect periodic excursions. Below 1.0, the process is not in control against its own specification, and no amount of incoming inspection will fix that. I have seen a vendor report Cpk of 0.87 on neck OD and describe the lot as “within specification,” which was true and also the reason their vials leaked on a Waters Alliance autosampler.

If the vendor cannot produce Cpk because they only record pass/fail, that tells you the measurement system is a go/no-go gauge and no distribution exists. For dimensional characteristics on a vial, that is not good enough. A go/no-go gauge cannot tell you the process is drifting toward the limit until it has already crossed it.

Evidence package to request in advance

Before you schedule anything, request the following as a single package with a return date. This is the evidence that lets you decide whether a site visit is even worth the travel.

• Control plan, current revision, signed and dated.
• Three consecutive lots of raw dimensional data with Cpk calculations.
• Septum coring test data: puncture count, needle gauge used, acceptance criterion, and the actual result per lot.
• Extractables or leachables summary relevant to your application, referenced to the appropriate USP chapter or your own specification.
• Glass hydrolytic resistance classification per USP <660> or ISO 4802, with the test method stated.
• Calibration certificates for the gauges named in the control plan.
• Change-notification procedure, including the lead time and the definition of a “significant change.”
• Deviation and CAPA log for the last 12 months, with root-cause categories.
• Certification to ISO 9001 and, if the vendor claims it, ISO 15378 for primary packaging.

That last item is where a lot of vendors get exposed. ISO 15378 is the GMP standard for primary packaging materials for medicinal products, and it imposes requirements ISO 9001 does not: change control, contamination control, and a formal quality agreement structure. A vial vendor selling into regulated labs should hold it or be able to explain why not. If they hold ISO 9001 only, ask what their change-control process looks like in practice, because ISO 9001 does not mandate one in the way 15378 does.

Score the supplier on a weighted matrix, not a gut feeling

The audit checklist has to produce a number, because a number is what survives a procurement review. I use a weighted matrix with five categories. The weights reflect how much each category predicts downstream failure, not how easy it is to assess.

Score each category 1 to 5, multiply by the weight, and sum. A vendor below 3.5 weighted should not be approved for a regulated application without a corrective action plan. Between 3.5 and 4.2, approve conditionally with a re-audit in six months. Above 4.2, approve. The exact thresholds are less important than applying them consistently across vendors, so that your procurement team is comparing like with like.

The weighting is the part people argue about. I weight dimensional control at 30% because a vial that is dimensionally off will fail on the instrument regardless of how good the paperwork is. I weight logistics at only 10% because a late shipment is recoverable and a drifting crimp seat is not. If your lab runs a single autosampler with no backup, raise logistics to 15%. If you are qualifying a vendor for a validated method, raise documentation to 25% and drop logistics to 5%.

The septum is where the audit finds the most hidden risk

Of all the components in a vial, the septum is the one with the widest gap between what the specification says and what the process actually controls. I have audited vendors whose septum specification listed durometer and thickness and nothing about coring, and whose production line had no puncture test at all. The septum is usually the weak link in the chain, and it is the item most likely to be under-specified.

Demand three things. First, a coring test protocol with a stated needle gauge (typically 22 or 23 gauge for autosampler use), a stated puncture count (100 is a reasonable floor for a 2 mL vial), and a stated acceptance criterion (zero visible cores, or a defined particle count). Second, durometer control data across lots, because a 5 Shore A drift changes the reseal behavior and the puncture force. Third, PTFE facing thickness and bond integrity, because a PTFE facing that delaminates is a silent source of extractables. If you source septa separately, the same questions apply, and the septa and cap specifications should be reviewed against the same control plan logic.

The coring test is also where you catch a vendor who is buying septa rather than molding them. A molder controls durometer at the press. A reseller receives a CoA and passes it along. Ask to see the durometer data by lot and by cavity, not just by shipment. If the vendor cannot break it down by cavity, they are not molding it.

Field case: the lot that passed at 50 punctures and failed at 100

A pharmaceutical QC lab qualified a septum vendor on a 50-puncture coring test, which passed with zero cores. Three months into production, their HPLC sequence started showing a low-level artifact peak at 3.1 minutes in roughly one in forty injections. The lab pulled the septum lot and ran the coring test to 200 punctures. Cores appeared between puncture 70 and 90. The vendor had tested to 50 because that was the internal standard, and the standard had been set years earlier for a different needle gauge. The fix was a revised specification requiring 100 punctures with a 22-gauge needle and a defined particle-count acceptance criterion. The artifact peak disappeared on the next lot. The lesson is that the puncture count on the audit checklist has to match your actual injection count per septum, not the vendor’s historical default.

Traceability has to reach the glass tubing, not just the lot number

Most vial vendors can trace a finished vial to a lot number and a date. Far fewer can trace it to the glass tubing lot and the tubing supplier. That matters because the dimensional ovality of the vial begins at the tubing station, and a change in tubing source is one of the most common causes of a slow drift in neck OD that no finished-goods inspection catches until it is a problem.

Ask for the traceability chain: finished lot to forming lot to tubing lot to tubing supplier to glass batch. If the chain breaks at the tubing lot, you cannot investigate a dimensional excursion back to its source, and you are left replacing whole shipments instead of identifying a root cause. I have seen a vendor change tubing suppliers to save cost, and the neck OD distribution shifted by 0.06 mm over two months. The vendor’s finished-goods data stayed within tolerance the whole time. The lab only noticed when their crimper started producing inconsistent seals.

This is also where you check the hydrolytic resistance classification. Type I borosilicate is the baseline for a regulated application, documented per USP <660> or ISO 4802. If the vendor cannot produce the classification test data for the tubing they use, the documentation chain has a hole in it that no amount of finished-vial testing fills.

Run an incoming inspection that tests what the audit predicted

The audit is a prediction. Incoming inspection is the verification. The two have to be linked, or the audit is theater. For each vendor you approve, define an incoming inspection plan that samples the characteristics the audit flagged as marginal. If the audit found Cpk of 1.2 on crimp seat height, your incoming plan should measure crimp seat height on every lot, not just check the CoA.

A workable incoming plan for a 2 mL autosampler vial:

• Dimensional: sample 30 pieces per lot, measure neck OD, crimp seat height, and body height against the tolerances above. Reject the lot if any dimension exceeds the tolerance or if the sample mean has shifted more than one standard deviation from the qualified baseline.
• Septum: puncture test 10 pieces to 100 punctures with a 22-gauge needle; inspect for cores under magnification; reject on any visible core.
• Visual: AQL 0.65 on critical defects (cracks, chips at the neck, incomplete crimp seat), AQL 1.5 on major (scratches, dimensional outliers within tolerance).
• Functional: run 10 injections of a known standard on your instrument and check peak area RSD against your method’s acceptance criterion, typically ≤ 2.0% for a well-behaved analyte.

That functional check is the one most labs skip, and it is the one that catches the failures the dimensional plan misses. A lot can pass every dimensional check and still produce a 3% RSD because the septum durometer drifted and the needle seal is inconsistent. The instrument is the final gauge, and the autosampler and consumables documentation from your instrument vendor usually specifies the acceptance criteria you should be applying.

Field case: the RSD that tracked to a durometer shift

A contract lab running EPA method work on a Thermo Trace 1310 saw peak area RSD climb from 0.8% to 2.6% over three lots of vials from the same vendor. Dimensional checks passed. Coring test passed. The lab requested durometer data by lot and found the vendor had shifted septum compound suppliers between lot two and lot three, moving durometer from 48 to 53 Shore A. The harder septum changed the needle penetration force and the reseal behavior enough to shift the injection volume reproducibility. The vendor had not flagged the compound change because their change-notification procedure only covered dimensional changes. The fix was a revised quality agreement requiring notification of any compound or sub-supplier change, plus a durometer check in incoming inspection. The RSD returned to 0.9% on the next qualified lot.

That case is the reason change control is weighted at 20% in the matrix. A vendor with excellent dimensional control and weak change control will still surprise you, because the surprise comes from a direction the dimensional data does not cover. If you source across multiple product lines, the same discipline should apply to your lab vial catalog qualification, and to specialized formats like the VOA vial, where the closure and septum interaction is even more sensitive to compound changes.

Score the documentation the way you score the product

Documentation quality is a leading indicator. A vendor with a clean deviation log and a specific CAPA process is a vendor whose process is being watched. A vendor whose deviation log shows the same root-cause category recurring quarter after quarter is a vendor whose CAPA process is decorative.

Ask for the last 12 months of deviations, categorized by root cause. Look for the ratio of dimensional deviations to material deviations to process deviations. If dimensional deviations dominate and the CAPA responses are specific, that is a vendor actively managing a known weakness. If the log shows only “operator error” and “supplier issue,” the vendor is not finding root causes. If the log is empty, the vendor is not looking.

The change-notification procedure deserves its own line item. Ask for the lead time (90 days is a reasonable floor for a regulated application), the definition of a significant change, and a recent example of a notification actually issued. A procedure that has never been exercised is a document, not a process. If the vendor cannot name a single change notification they issued in the past two years, assume the procedure is dormant.

Finally, check the CoA against the control plan. The CoA should report the characteristics the control plan names, at the frequency the control plan specifies, with the actual measured values. If the CoA reports a subset, or reports “conforms” instead of numbers, the documentation system is not connected to the manufacturing system. That disconnect is the single most reliable predictor of a surprise lot.

The decision rule

Approve a lab vials supplier only when the weighted audit score clears 4.2, the control plan names every critical dimension with a calibrated gauge and a specific reaction plan, the septum coring data reaches 100 punctures with zero cores on a 22-gauge needle, and the change-notification procedure has been exercised within the last 24 months. If any one of those four conditions fails, approve conditionally with a written corrective action plan and a re-audit date, and hold incoming inspection at full sampling until the re-audit clears. The checklist exists to make that decision repeatable, not to make it comfortable. A vendor who cannot produce the evidence before the first shipment will not produce it after the first failure.

References & further reading

Related resources from our lab consumables network:

• Lab Vials at labvials.com
• Aijiren Brand at aijirenvials.com
• Voa Vial at voavial.com
• Septa at septacaps.com

External references and standards:

• Agilent chromatography consumables and columns
• Thermo Fisher chromatography and sample handling
• U.S. EPA SW-846 test methods for waste and materials
• Restek technical resources for chromatography