A lot of 2 mL vials arrived in February with a certificate of analysis showing septum thickness at 3.05 mm against a 3.00 ± 0.10 mm spec, and a microplate reader running 96 samples flagged eleven short injections in the first plate. The certificate was technically honest. The problem was the vendor had no documented control over the compression set of the butyl rubber, no incoming inspection on the septum stock, and no record of the molding press that ran the lot. That is the gap a 2ml vial supplier audit checklist exists to close: not to confirm the vendor can pass a CoA, but to confirm the vendor knows why a CoA passes or fails. I have run this audit on more than forty suppliers across three continents. The vendors that fail in routine use almost never fail on the certificate. They fail on the quality system that produced it.

This is not a piece about walking a factory floor or negotiating contract terms. Those are separate exercises with their own checklists. What follows is the paper audit: what to request before you visit, which quality-system items actually predict field failures, and how to score a vendor so the decision is defensible when procurement pushes back.

An audit that starts with a site visit wastes a travel budget. The paper trail filters 70% of marginal vendors in under two hours of reading. Ask for the following as a single package, dated, and refuse a drip-feed response. A vendor that cannot assemble eleven documents in five business days has a document-control problem that will show up as a missing lot record eighteen months from now.

• Current ISO 9001 certificate with the accreditation body named and the scope statement covering “manufacture of glass vials and closures” (not “trading”).
• ISO 15378 certificate if the vendor claims pharmaceutical primary packaging. If they supply to a pharma customer, they should hold it. If they do not, ask why.
• Control plan for the 2 mL vial line, by process step, with the characteristic, the method, the sample size, the frequency, and the reaction plan.
• Measurement system analysis (MSA) records for the three critical gauges: neck ID, septum thickness, and crimp diameter.
• Process capability studies (CpK) for neck ID, body OD, and septum thickness, minimum 30 subgroups over at least three lots.
• Incoming inspection records for glass tubing, septum stock, and aluminum shell stock, last six months.
• Change-control procedure plus a log of the last twelve approved changes, with customer notification dates.
• Nonconformance and CAPA log, last twelve months, with root-cause statements and effectiveness checks.
• Complaint log with the field-failure category coded (coring, leakage, dimensional, cosmetic, other).
• Extractables or leachables summary for the septum compound, with the supplier’s own data, not a generic industry statement.
• Retention sample policy and the last three lots’ retention records.

Read the control plan against the capability study. If the control plan calls for a sample of five vials per hour on neck ID but the CpK is 0.9, the sampling plan is theater. A CpK of 0.9 means roughly 0.35% of parts fall outside spec on a two-sided tolerance, and a five-piece hourly sample will miss that shift most of the time.

The three quality-system items that predict field failure

Every audit checklist has forty lines. Three of them carry most of the predictive weight. I weight these at 60% of the total score because the correlation with field failures is that strong.

1. Gauge R&R on the neck ID and septum thickness gauges

Neck ID on a 2 mL vial is nominally 11.0 mm for the 11 mm crimp finish, with a tolerance that typically runs ±0.15 mm. That is a 0.30 mm window. If the gauge repeatability and reproducibility consumes more than 30% of that window, the vendor cannot distinguish a good lot from a marginal one, and neither can you. Ask for the G&R study and check the %GRR number directly. Anything above 30% on neck ID is a fail. Above 20% on septum thickness (nominal 3.00 mm, ±0.10 mm) is a fail. I have seen suppliers using a handheld caliper on the neck ID with a %GRR of 47%. Their CoA means nothing.

2. Closed-loop control on the forming station

Glass tubing is drawn, cut, and formed into the vial body at temperatures around 1,150 to 1,250 °C. The dimensional envelope that matters downstream (neck ID, body OD, height) is set at the forming station. A vendor that inspects at the end of the line but does not control the forming parameters in a closed loop is running open-loop manufacturing. Ask one question: what parameter is measured in-process on the forming machine, and what does the machine do when it drifts? A good answer names a specific measurement (neck ID by laser, body OD by camera), a control limit, and an automatic adjustment. A bad answer names a final inspection.

3. Change control with customer notification

Most field failures I have investigated trace back to a change the vendor made and did not tell anyone. A glass tubing supplier changed the boron content. A septum molder changed the curing time. An aluminum shell supplier changed the alloy temper. Each change was internally approved and externally silent. Ask for the change log and check whether any change in the last twelve months touched a material, a process parameter, or a sub-supplier. Then check whether the vendor notified affected customers. If the log shows changes and the notification column is empty, the change control is a filing exercise, not a control.

I weight change control heavily because it is the failure mode that no incoming inspection catches. You cannot test for a change you do not know happened. The 2ml vial you receive in March looks identical to the one you received in January, and the difference only shows up as a ghost peak in April.

What the certificate of analysis should actually contain, and what most do not

A CoA that lists “conforms” against a spec is a pass/fail document. It tells you the lot met a limit. It does not tell you where in the distribution the lot sat. Two lots can both conform and one can be at 2.95 mm on septum thickness while the other sits at 3.09 mm. The first will seal. The second will core after 40 punctures.

Demand the following on the CoA, per lot:

• Actual measured values, not pass/fail, for neck ID, body OD, height, and septum thickness.
• Sample size and sampling plan (e.g., 32 pieces per lot per characteristic, per ISO 2859-1 general inspection level II).
• Gauge identification so you can trace the measurement back to a calibrated instrument.
• Lot traceability from glass tubing lot to septum lot to shell lot to finished vial lot.
• Test method reference for each characteristic, with the method number and revision.

The traceability line is the one that matters most and the one most often missing. If a vial fails in the field, you need to walk back to the tubing lot and the septum lot to see whether the failure is isolated or systemic. A vendor that cannot do that walk-back in one afternoon has a traceability system that exists on paper only.

Score the vendor on a weighted matrix, not a gut feeling

I use a 100-point matrix with six categories. The weights are not arbitrary. They reflect what actually predicts field failure, based on my own complaint data across roughly 2.4 million vials per year over a decade.

A score below 70 is a fail. Between 70 and 85 is a conditional approval with a re-audit at six months. Above 85 is approval. I do not approve a vendor on a score above 85 if any single category is below 50% of its weight, because a weak category is a future failure regardless of the total.

The CAPA category deserves a note. Read the last twelve nonconformances and look for repeat root causes. If three of them trace to “operator error” on the same process step, the CAPA is a label, not a fix. Real CAPAs change a procedure, a gauge, a fixture, or a training record. Fake CAPAs change a signature.

Two field cases where the audit predicted the failure

Case 1: the coring that started with a gauge

Symptom: a customer running 96-well autosampler plates reported coring on 6 to 9 septa per plate after 30 punctures with a 0.63 mm OD needle. The septa were silicone-lined butyl, 3.00 mm nominal.

Measurement that identified it: we pulled retention samples from three lots and measured septum thickness with a calibrated micrometer at five points per septum. Lot A averaged 3.02 mm. Lot B averaged 3.09 mm. Lot C averaged 2.98 mm. Lot B cored at 30 punctures; lots A and C did not. The difference was 0.07 mm, well within the vendor’s ±0.10 mm spec, but enough to push the needle through more rubber per puncture and accelerate the tear.

Fix: the vendor’s gauge R&R on septum thickness was 34%, which meant they could not see the drift. We required a new gauge (a digital snap gauge with 0.001 mm resolution) and a %GRR study under 20% before the next lot shipped. Coring dropped to under 1 per plate within two lots.

Case 2: the ghost peak that traced to a tubing change

Symptom: an HPLC method running at 210 nm showed a reproducible ghost peak at 4.2 minutes, present in blanks prepared in vials but absent in blanks prepared in glass autosampler vials from a different supplier.

Measurement that identified it: we ran the vial wash solvent through GC-MS and found trace 2,6-di-tert-butylphenol at 0.8 µg per vial, a known antioxidant used in some glass-tubing coatings. The vendor’s change log showed a tubing sub-supplier switch eleven weeks earlier with no customer notification.

Fix: we required the vendor to revert to the prior tubing source and to add a wash-and-bake step (deionized water rinse, then 400 °C for two hours) to the process for the affected product line. The ghost peak disappeared. The audit lesson: the change log, read carefully, would have flagged this before the first shipment.

This is why I insist on reading the change log before the site visit. The HPLC consumables you buy are only as clean as the tubing they were formed from, and the tubing source is a change-control item, not a purchasing detail.

Questions to ask on the phone that reveal more than the documents

Documents can be prepared. Answers to unscripted questions cannot. I ask four questions in a fifteen-minute call before I request anything, and the answers tell me whether the paper audit is worth the effort.

• “What is the last field failure you had, and what did you change as a result?” A vendor that cannot name one is either not tracking complaints or not being honest. A vendor that names one and describes a specific fix is a vendor with a working CAPA system.
• “Who is your septum supplier, and when did you last audit them?” The septum is the most failure-prone component in the assembly. A vendor that does not audit its septum supplier is outsourcing its quality to a company it does not inspect.
• “What does your forming machine do when the neck ID drifts out of control?” The answer should describe an automatic adjustment or an alarm with a documented reaction. “The operator adjusts it” is a fail unless the operator has a documented control chart and a reaction plan.
• “How long does it take you to trace a finished vial lot back to the glass tubing lot?” Under one business day is acceptable. “We would have to check with the warehouse” is a fail.

I have disqualified vendors on the second question alone. A molder buying septa from an unqualified source is a molder whose CoA reflects only the assembly, not the component.

How to handle the vendor that passes the audit and still drifts

An audit is a snapshot. The vendor that scores 88 today can drift to 74 in eighteen months if nothing forces them to maintain the system. I build three requirements into every approved vendor file, and they are the operational half of the checklist.

Annual re-audit on the paper trail only, not a full site visit, focused on the change log, the CAPA log, and the G&R studies. If any of the three shows drift, escalate to a full audit.

Lot-release data in a fixed format, with actual measured values and gauge IDs, sent with every shipment. I reject lots that arrive with pass/fail certificates. The rejection rate for non-compliant certificates is a useful leading indicator of the vendor’s document discipline.

A quarterly review of your own complaint data against the vendor’s, coded to the same failure categories. If your coring complaints rise and the vendor’s complaint log does not show a corresponding entry, the vendor is not capturing field data, which means the CAPA loop is open.

For vendors that supply across a broader portfolio, I also check whether the 2 mL vial line is representative of their overall quality system or an outlier. A vendor with a strong 2 mL line and a weak 4 mL line has a system that does not scale, and the next product you buy from them will inherit the weakness. The chromatography supplier you consolidate onto should show consistent scores across product lines, not a single strong line.

Reference standards to cite in the audit report

An audit report that cites standards is harder to argue with than one that cites opinion. I reference the following, and I expect the vendor to know them.

• ISO 9001:2015 for the base quality system, with clause 8.5.6 (control of changes) and clause 10.2 (nonconformity and corrective action) called out specifically.
• ISO 15378:2017 for primary packaging materials for medicinal products, Annex A and B for the specific GMP requirements.
• ISO 2859-1 for the sampling plans on incoming and final inspection, with the AQL stated per characteristic.
• USP <661> for the glass classification (Type I borosilicate for most HPLC work) and USP <381> for the elastomeric closure, which is the chapter most vendors have not read.
• GPI 11 mm finish specification for the neck and thread dimensions, which is the reference for crimp and snap cap compatibility.
• EPA SW-846 Chapter 3 for the container and preservation requirements when the vials are used for environmental samples, since the container is part of the method’s quality control.

If the vendor cannot produce a copy of USP <381> from their own files, they have not qualified their septum compound against the standard that governs it. That is a finding, not a question. The EPA SW-846 methods are worth citing when the end use is environmental, because the container requirements in Chapter 3 are specific and auditable.

For vendors that supply through distribution rather than direct, I also check the distributor’s own quality agreement. A distributor that cannot produce a quality agreement with the manufacturer is a distributor whose traceability stops at the loading dock. The OEM vial supply chain is longer than most buyers realize, and each link needs its own audit trail.

What to do with a vendor that scores well on paper and fails in the field

This happens, and it is the hardest case. The vendor passes the paper audit, the first three lots are clean, and the fourth lot cores. The instinct is to blame the vendor. The better move is to check your own incoming inspection first. If you are sampling five vials per lot and the failure rate is 0.5%, you will miss it most of the time. The vendor’s system may be fine and your acceptance sampling may be the weak link.

I run a two-part check. First, pull the vendor’s lot-release data for the failing lot and compare the measured values against the previous three lots. A shift of more than 0.05 mm on septum thickness or more than 0.08 mm on neck ID is a real drift, and the vendor’s system missed it. Second, run a 32-piece incoming inspection on the failing lot and the previous lot side by side. If the failing lot shows a tighter distribution than the passing lot, the vendor has improved their control and the failure is a different mechanism (likely a septum compound change). If the failing lot shows a wider distribution, the vendor’s control has degraded.

The fix in the first case is a supplier corrective action request with a specific measurement requirement. The fix in the second case is a re-audit of the forming station and the gauge calibration. Neither fix is a contract negotiation, which is why the paper audit and the contract belong in separate conversations.

The decision rule

Approve a 2 mL vial vendor only when the paper audit scores above 85 on the weighted matrix, no single category falls below 50% of its weight, the change log shows customer notification on every material and sub-supplier change in the last twelve months, and the vendor can trace a finished lot to its glass tubing lot in under one business day. Below 70 is a fail with no exceptions. Between 70 and 85 is a conditional approval with a six-month re-audit and lot-release data in a fixed format on every shipment. The vendors that pass this bar are the ones whose certificates mean something, and the ones that fail are the ones whose certificates are a formality. For calibration and instrument-side reference material, the Agilent consumables documentation, the Thermo Fisher sample handling resources, and the Restek technical library are useful cross-references when you need to confirm a method or a dimension against a second source. But the audit itself is your job, and the checklist above is the one I use.

References & further reading

Related resources from our lab consumables network:

• 2Ml Vial at 2mlsamplevial.com
• Hplc Consumables at hplcconsumable.com
• Chromatography Supplier at chromatographysupplier.com
• Oem Vial at oemsamplevials.com

External references and standards:

• Agilent chromatography consumables and columns
• Thermo Fisher chromatography and sample handling
• U.S. EPA SW-846 test methods for waste and materials
• Restek technical resources for chromatography