Supplier risk monitoring, explained.

An approved API maker gets an FDA import alert: the questions that start that morning

The five steps of a supplier's life with a drug company, and where monitoring sits

1. The supplier is approvedAudit, test batches, a quality agreement, a place in the approved supplier list and often in the product's filing.
2. Supply runs under contractOrders, deliveries, certificates of analysis and periodic audits under the supply and quality agreements.
3. Something changes at the siteAn FDA action, a hazard, a downgrade, a trade measure or a new owner. Someone has to notice and match it to the right site.
4. The impact is worked out and a person decidesProducts and markets on the path, weeks of cover, second sources and filings, then a signed response with owners.
5. The response is carried out and closedOrders placed, supplements filed, the supplier answered, the site watched until the cause is gone.

This guide is about steps 3 and 4. Approval at step 1 has its own guide, supplier onboarding; the dates and money in supplier contracts have another.

What surprises people about watching approved suppliers

FEI, import alert, weeks of cover, single-source path: four terms this guide uses

Regulator actions, hazards, credit, trade and ownership: the six changes at an approved supplier and who owns each

In shortSix kinds of change matter after approval. Each has its own sources of news and its own owner inside the buying company. Monitoring brings them onto one list, ties each to a site, and sends it to the person who decides.

Supply risk teams tend to group what can happen at a supplier into six families. They differ in how fast news travels, how reliable the first report is, and who must act. A regulator's action is public and dated, but arrives in a format built for lawyers. A storm is forecast days ahead, but its effect on a plant is uncertain until the plant reports. A credit downgrade is a warning that may take a year to turn into a missed delivery, or never do so.

Two things follow. First, a list of suppliers on its own is not enough: each change has to land on a site, a material and a product before anyone can judge it. Second, every family needs a named owner, because a warning that reaches a shared mailbox reaches nobody.

ICH Q10, the international guideline on pharmaceutical quality systems, asks companies to monitor and review "the quality of the material from the provider" and to check that incoming materials come "from approved sources using the agreed supply chain".5 It leaves the method to you.

FDA and EU supplier oversight rules in November 2026: what each asks of you after approval

In shortNo rule names "supplier risk monitoring", yet several require its parts: oversight of raw material risk as part of CGMP, a system for evaluating critical suppliers, traceability to starting materials, monitoring of providers, and an FDA notice when an interruption is likely to disrupt US supply. The trade rules add sanctions, export controls and, once its limits apply, BIOSECURE.

In the United States, the Food, Drug, and Cosmetic Act itself was widened in 2012. Its definition of current good manufacturing practice "includes the implementation of oversight and controls over the manufacture of drugs to ensure quality, including managing the risk of and establishing the safety of raw materials".7

FDA's drug GMP regulation lets a manufacturer accept a supplier's report of analysis only with an identity test of its own, and only if it "establishes the reliability of the supplier's analyses through appropriate validation of the supplier's test results at appropriate intervals".8 That is monitoring in all but name.

ICH Q7, the GMP guide for APIs, asks API makers for "a system for evaluating the suppliers of critical materials", purchases from suppliers "approved by the quality unit(s)", the name and address of the real manufacturer when buying through a trader, and change control for any change of source.4 ICH Q9(R1), revised in 2023, added a section on product availability: it says GMP problems "are a significant cause of product availability issues", calls for "an effective monitoring strategy for supply chain partner performance", and says a pre-qualified alternative may sometimes be needed.9

In the European Union, Chapter 5 of the GMP guide says supervision of starting material suppliers "should be proportionate to the risks", that staff "should have a current knowledge of the suppliers, the supply chain and the associated risks", and that API traceability back to starting materials "should be formally assessed and periodically verified".3 The directive on medicines requires the holder of a manufacturing authorization to verify an API maker's GMP "by conducting audits at the manufacturing and distribution sites".10

Chapter 7 covers outsourced work: the contract giver monitors and reviews the contract acceptor.11 For devices, FDA's Quality Management System Regulation, in force since February 2, 2026, brought in ISO 13485's purchasing clause, which includes monitoring suppliers.12

The dates behind supplier oversight rules, from ICH Q7 to BIOSECURE's first list

Two other bodies of law reach the same suppliers from a different side: sanctions and trade rules, covered in section 10, and BIOSECURE, which limits federal contracting and grants once its list and rule change are out. None of these rules prescribes a tool or a frequency. Inspectors look for evidence that you knew your suppliers, saw the risk and acted on it in proportion.

From FDA inspection to import alert to posted warning letter: about six months, on our count of FDA's letters

In shortFor a foreign drug site, FDA's sequence usually runs inspection, then import alert listing, then warning letter, then the letter's posting. On our count of 165 letters that name Import Alert 66-40, the alert came a median 38.5 days before the letter, and the letter reached FDA's website a median 8 days after it was issued. Watching the import alert page gains weeks over watching the letters.

When FDA inspects a foreign drug plant and finds serious GMP problems, several public records can follow. The inspection is classified: no action indicated, voluntary action indicated, or official action indicated. The site can be added to the "Red List" of Import Alert 66-40, under which "Divisions may detain, without physical examination, the indicated drugs or drug products from the foreign establishments on the Red List".2

A warning letter sets out the violations and asks the firm to reply in writing. Each of these is a warning a buyer can act on, and they appear on different FDA pages at different times.

To see the usual order, we read every warning letter in FDA's index that names Import Alert 66-40, 165 letters issued from 2021 to November 3, 2026. We read, in each letter, the sentence that gives the date FDA placed the addressee on the alert, and the inspection dates where the letter states them, and checked 25 letters by hand.

158 letters give the addressee's own listing date. Five letters to US buyers date a supplier's listing instead, and two give no date; those are left out. The results are our count, from FDA's own records, and they cover only letters that mention the alert.1

In 154 of the 158 letters that give the listing date, the listing came first; in the other four it came on the same day. In none did it come after. A quarter of the letters followed the listing by more than 78 days. Letters were posted a median of 8 days after they were issued, and 163 of the 165 were posted on a Tuesday. So the warning letter is usually the second public warning, and often a late one.

Leaving an import alert takes longer. FDA's Regulatory Procedures Manual says firms placed on detention for GMP reasons "may generally be removed from DWPE", detention without physical examination, "following a reinspection", or, in some instances, on documents that show corrective actions are in place, with the Center's agreement.20 The alert itself says removal may wait "until FDA has confidence that future shipments will not appear violative", for example after an inspection.2 FDA publishes no typical time to removal, so a plan should assume months.

There is one exception that matters for supply. When a listed site makes medicines in shortage, FDA can leave named products off the alert under conditions.

In June 2023 FDA wrote to Intas Pharmaceuticals that all drugs from its Sanand site were subject to refusal under Import Alert 66-40, except a list of "medically necessary drugs for which there are shortage implications", on conditions including "batch certification by an independent third-party" and triplicate testing of held batches.21 A buyer facing a listed sole source can ask whether such an exclusion is possible, with no certainty of the answer.

Where the APIs come from: India, China and the EU in USP's and FDA's numbers

In shortMost API sites for US medicines are abroad. By volume, India and the EU lead; by new drug master files, India and China. FDA's own inspection outcomes differ by region. The concentration is why one listing in Gujarat or Zhejiang can reach many products.

FDA does not publish how much API each country supplies. Two other sources come close. The US Pharmacopeia's Medicine Supply Map, which ties products to the sites that make their ingredients, estimated for 2024 that the EU supplies 43% of branded API volume used in the US, that about 12% of all prescription API volume is made in the US (leaving out IV fluids), and that China contributes 8% of total volume.22

USP's count of drug master files, the confidential dossiers API makers file with FDA, gives a different picture: of active API master files filed in 2023, 50% were held in India, 32% in China, 10% in the EU and 4% in the US.23 Master files count filings, which show where makers are preparing to supply, rather than volume.

A US government analysis put it another way: as of August 2024, "only 24 percent of active pharmaceutical ingredient (API) manufacturing facilities for U.S.-marketed drugs were in the United States".24 FDA's quality report for fiscal 2025 found that distributions of manufacturing locations for US-based application products "trended away from the U.S. and Europe and toward China and India" from 2020 to 2025.25

Official action indicated is the outcome that can lead to a warning letter and, abroad, an import alert. FDA's statistical test found China's rate significantly lower than the global 18% and the US rate significantly higher.25 Import Alert 66-40's Red List shows where listed firms are today. Our parse of the page dated October 27, 2026 finds 472 firm entries, 160 under China and 111 under India.2

FDA has also changed how it inspects abroad. In May 2025 it announced wider use of unannounced foreign inspections.26 By August 2026 its India office had gone from 47% unannounced inspections in fiscal 2025 to 87% in fiscal 2026 to date, and its China office from 19% to 61%.27 An unannounced inspection gives a plant less time to prepare, which makes the outcome a better guide to everyday practice.

Matching a warning letter or import alert to the right supplier site, unit and FEI

In shortMatch on the FEI first, then the street address, then the legal entity and its parent. Record why every near miss was set aside. Keep sister units of a listed site on watch, because they share a quality unit and often a management.

An FDA warning letter is addressed to a named person at a legal entity and states the inspected site's address and FEI. The Red List of Import Alert 66-40 lists each firm with its address and the products covered, often "All Drug and Drug Products".2 Your own records describe the same plant in other ways: a vendor number in ERP, a supplier name in the quality system, a site name in the regulatory filing and perhaps a trading company on the purchase order. The match has to cross all of them.

The example at the top of this page shows the common trap. Hanvar Fine Chemicals runs Unit II and Unit IV in Vapi. The letter names FEI S009817742 and Plot 214/2; Unit IV has FEI S011094418 and Plot 88. Unit II is a match and Unit IV is not, though both carry the group name. Unit IV still deserves watching: it shares a quality unit with Unit II, so a weakness found in one unit's quality system may also exist in the other.

A morning's reading of feeds produces far more items than matches. In the fictional example, one day's reading looks like this:

The one in between is the near miss: the same group, a different FEI and a different address. Recording why each item was set aside matters as much as the matches. An auditor or a regulator may ask how you knew a letter to a sister plant did not concern you, and "it was not on the list" is a weak answer without the reason written down.

Counting weeks of cover for one API: released, in test, held at the port, and finished goods

In shortWeeks of cover is usable API divided by planned weekly use, plus the weeks of finished product already made. Lots held at the border do not count until they are released. Compare the result with the time each option needs to restore supply, market by market.

Cover answers the first question a risk lead asks: how long do we have? The answer has to use material you can actually turn into product for the affected market. In the fictional example, the plant that makes the tablets holds 412 kg of talvoren sodium, of which 388 kg are released by quality and 24 kg are in testing. A further 96 kg sit at the US port, shipped before the alert. The tablets use 29 kg of API a week, and 9.1 weeks of finished tablets are already in the warehouse.

Counting the in-test 24 kg is a judgment: if testing fails, those 0.8 weeks go. One way to show it is to give cover twice, with and without material still in test. Finished goods also need care: if part of the stock is allocated to another market or near expiry, it comes out of the count.

Cover only means something beside the time to recover. Each option has its own clock: a second source already approved for the market, a filing to add a source, a request to FDA to exclude the product from the alert, or waiting for the supplier to be cleared. In the example, the cover is 23.3 weeks for the 20 mg tablets and 26.8 for the 40 mg, against these estimates:

Option B looks close, but its range runs from 9 to 20 weeks and its outcome is uncertain, so it serves as a fallback beside option A. When cover falls short of every option's time to recover, the decision moves on to allocation between markets and strengths, and to the shortage notice described in section 9.

Adding a second API site: prior approval supplement, CBE-30 or an EU variation

In shortIn the US, a new API manufacturing site is generally a supplement filed 30 days before distribution, and a prior approval supplement when the site lacks a satisfactory FDA inspection for that operation. FDA's review goals run from 4 to 10 months depending on the application type. In the EU, adding an active substance site is a Q.I.a.1 variation, notified immediately on conditions or a type II where the dossier changes a lot.

A second source helps only once the product's registration allows it. In the US, 21 CFR 314.70 sorts changes to an approved application by their potential to affect the product: major changes need a supplement approved before distribution, and moderate ones a supplement filed at least 30 days before.28

FDA's 2004 guidance on changes applies this to manufacturing sites. A move to a different site for the manufacture of a drug substance is a "Supplement - Changes Being Effected in 30 Days", known as a CBE-30, unless the new site "does not have a satisfactory CGMP inspection for the type of operation being moved", in which case FDA recommends a prior approval supplement.29

So the inspection history of the second source decides the route, and it is worth checking during monitoring, long before a crisis. A site FDA inspected recently with no action indicated for the same kind of operation may need only a 30-day notice. A site FDA has never inspected for that operation needs prior approval, and the review may wait for a pre-approval inspection. The quality, stability and comparability data needed are the same either way; only the timing of distribution differs.

FDA's review clocks come from its user fee agreements with industry: PDUFA for brand-name drugs and biologics, now in its seventh round, and GDUFA for generics, in its third.30,31

Review goals are targets for FDA's action, which may be an approval or a list of deficiencies. Add the time to prepare the supplement, often several weeks, and the time to make and release the first lots from the new source. For a generic, FDA's GDUFA goals also set shorter clocks for priority supplements, four or eight months depending on when the facility information arrives.31

In the EU, the Commission's variations guidelines that apply from January 15, 2026 code a change of active substance manufacturing site as Q.I.a.1. "Addition or replacement of a manufacturing site of an active substance" is type IA IN, notified immediately, when its conditions are met, and type II where it "requires significant update to the relevant active substance section of the dossier", for example a different route of synthesis.13

A second source approved in the EU only may still need a US filing before its material can go into US product, and the reverse.

When a supplier problem becomes an FDA shortage notification under section 506C

In shortMakers of certain prescription drugs must tell FDA of an interruption likely to cause a meaningful disruption in US supply, including an interruption in making the API: six months ahead, or, if that was not foreseeable, as soon as practicable. For an interruption in making the finished product, FDA's regulation adds a limit of five business days after it begins. The duty sits with the applicant or finished product maker, and the API maker's problem is often the reason.

Section 506C of the Food, Drug, and Cosmetic Act covers drugs that are "life-supporting", "life-sustaining" or "intended for use in the prevention or treatment of a debilitating disease or condition". Their makers must notify FDA of a permanent discontinuance or "an interruption of the manufacture of the drug that is likely to lead to a meaningful disruption in the supply of that drug in the United States".

Since 2020 the same applies to an interruption in making the API. The notice must give the reasons, and where the API is a reason, "the source of the active pharmaceutical ingredient and any alternative sources".6

The statute asks for notice at least six months ahead or, if that is not possible, "as soon as practicable".6 FDA's regulation, 21 CFR 314.81, adds a hard limit for an applicant's interruption in making the drug product: "in no case later than 5 business days after the permanent discontinuance or interruption in manufacturing occurs".16

The statute itself sets no five-day limit, and for an API interruption it asks only for notice as soon as practicable; FDA's draft guidance reads it the same way.6,17

That revised draft guidance of February 2024, still a draft in November 2026, says that "third-party API manufacturers and suppliers" are not required to notify; the applicant or finished product maker is.17 A "meaningful disruption" is a reduction in supply "that is more than negligible and affects the ability of the manufacturer to fill orders or meet expected demand".6

This is why weeks of cover matter to regulatory teams. A supplier on import alert with no approved second source is an interruption in API supply. If cover will run out before supply returns, the product is heading for a disruption, and the clock for the notice may already be running. Many teams set an internal line, such as cover under 26 weeks on a single-source path, to start the assessment early. The statute sets no such line; the decision is regulatory's.

FDA uses the notices. In calendar 2025 it received 1,424 notifications of potential shortage situations from 167 manufacturers, helped prevent 330 shortages, and counted four new ones, against a peak of 251 new shortages in 2011.32 FDA can write to a firm that fails to notify and post the letter; its page of such letters lists seven.33

In the EU the rule differs in form. A marketing authorization holder must tell the authority when a product "ceases to be placed on the market", temporarily or permanently, "no less than two months before" except in exceptional circumstances.10 EMA's shortage steering group, set up by Regulation 2022/123, coordinates responses to major events and keeps lists of critical medicines.18

Sanctions lists, export controls, tariffs and BIOSECURE as risk indicators for an approved supplier

In shortA supplier cleared at onboarding can become blocked later, through its own listing or its owners'. OFAC adds up blocked owners to 50%. The Commerce Department's affiliates rule, suspended for a year, is due back on November 10, 2026 unless extended. BIOSECURE's first list is due by December 18, 2026, and its limits start only after a later rule change.

Sanctions screening has to be repeated for as long as a supplier is used. The Treasury's Office of Foreign Assets Control treats an entity as blocked if one or more blocked persons own 50% or more of it in aggregate.34 A supplier can therefore become blocked when an owner is designated, with no change at the supplier itself. Civil penalties under the main sanctions statute reach the greater of $377,700 per violation or twice the transaction, at the 2025 adjusted level; a law firm note reports no adjustment for 2026.35

Export controls added a similar ownership rule in 2025. The Commerce Department's Bureau of Industry and Security extended its Entity List restrictions to companies 50% or more owned by listed parties, then suspended that "Affiliates Rule" from November 10, 2025 to November 9, 2026, with the rule returning on November 10, 2026.36 A law firm alert of October 22, 2026 reports that the Treasury Secretary said on September 23 the suspension would be extended to January 10, 2027, and that BIS had published no notice.37 Check the Federal Register in the week this guide is dated.

Import rules matter too. The Department of Homeland Security's list under the Uyghur Forced Labor Prevention Act held about 210 entries on October 28, 2026, some of them under pharmaceutical and chemical names.38 Under the Act, goods made by a listed entity are presumed to be made with forced labor and are barred from entry unless the importer shows otherwise.39

The presidential proclamation of April 2, 2026 set tariffs on imported pharmaceuticals and ingredients under section 232, and left generics and biosimilars out "at this time".40 A tariff changes cost, which a category manager weighs; a sanctions or forced labor listing can stop the purchase.

BIOSECURE is law, as section 851 of Public Law 119-60, approved December 18, 2025. Once its limits apply, federal agencies may not buy biotechnology equipment or services from a biotechnology company of concern, or contract with entities that use such equipment or services in performing a federal contract; loan and grant money is limited in the same way.14

The Office of Management and Budget must publish the list within a year of enactment. Guidance follows within 180 days, a revision of the Federal Acquisition Regulation within a year after that, and the limits 60 or 90 days after the revision. Contracts entered before then get five years on two of the limits.14 No list had appeared by November 3, 2026.

The Defense Department's yearly list of "Chinese military companies", kept under section 1260H of the defense authorization act for fiscal 2021, is one route to BIOSECURE's list. A listing on it, such as WuXi AppTec's of June 8, 2026, carries Defense contracting limits but "does not, by itself, impose the broader procurement prohibitions".41

For a monitoring team, the practical work is to know which approved suppliers, and which of their owners and service providers, could appear on any of these lists, and which of your contracts are federal. A drug company with no federal contracts, grants or loans is not directly reached by BIOSECURE, though a federal customer or partner may still ask about exposure.41

What a lost supplier means for supply: shortage counts and durations from FDA and HHS

In shortSupplier failures turn into shortages that can last years. HHS counted 2,063 shortage events from 2018 to 2023; injectables made up about half and lasted a median 4.6 years. Generics, with thin margins and few makers, are most exposed.

The Office of the Assistant Secretary for Planning and Evaluation at HHS analyzed FDA's shortage data for 2018 to 2023. It found that 1,986 drugs went into shortage 2,063 times. Generic drug shortages (1,391) outnumbered brand shortages (600) by more than two to one, partly because generics are more common. Injectables were half of all shortages, though most drugs on the market are oral.24

The same analysis explains why: in markets with generic competition, low prices leave "limited information that can be used to assess the manufacturers' quality systems, back-up manufacturing capabilities" and reward makers "that achieve lower costs by sacrificing investment in resilient manufacturing practices".24

Recovery is slow because adding production often needs approval from several regulators. For a company, the cost of a lost supplier includes lost sales while cover runs out, expedited freight and testing, the work of a supplement, and sometimes a market allocation that disappoints customers. No public source puts a typical dollar figure on one supplier event, so section 19 helps you find your own.

Eight ways supplier monitoring misses a problem it was set up to catch

In shortMost misses are timing and matching: waiting for the warning letter, matching on group names, not knowing tier-2 sources, and counting stock that cannot be used. The rest are hand-offs: a filing need found late, a 506C question raised late, an ownership change unseen, an alert with no owner.

Reading feeds with software: what can be automated, what supplier quality must sign, and what regulators have said

In shortReading regulator pages and news, pulling out firm, FEI, address and dates, matching against a site register, tracing bills of materials and counting cover are well suited to software, because each result can be checked. Choosing a response, approving a source, choosing a filing and notifying FDA stay with named people. FDA's draft guidance on AI leaves internal operational uses out of its scope; the EU's draft GMP annex on AI is still a draft.

Most of the hours in supplier monitoring go on finding and joining facts: opening each new FDA page, reading a letter for its FEI and address, looking up the site in three systems, tracing which materials and products depend on it, and pulling stock figures. Software can read every source every few minutes and do the joins, provided the site register carries good identifiers. The checks a person would make, such as whether the FEI matches and why a near miss was set aside, can be shown beside every result.

Regulators have said little about AI used this way. FDA's January 2025 draft guidance on AI for regulatory decision-making for drugs says it does not address AI used "for operational efficiencies (e.g., internal workflows, resource allocation, drafting/writing a regulatory submission) that do not impact patient safety, drug quality, or the reliability of results from a nonclinical or clinical study"; it is still a draft.42

Supplier approval is a GMP decision for the quality unit, and an AI step that feeds it falls under the GMP rules on computerized systems. The EU's draft GMP Annex 22 on AI, consulted on in 2025, says generative AI and large language models "should not be used in critical GMP applications". It had not been adopted on November 3, 2026, when EudraLex Volume 4, the EU's GMP guide, still listed Annex 11 at its 2011 revision and no Annex 22.43,44 An EMA workshop report of 2026 says the drafting group has discussed widening the scope under a risk-based control strategy.43

FDA has also warned a firm about unchecked AI: "If you use AI as an aid in document creation, you must review the AI generated documents", and failing to do so violated the quality unit rule.45 The EU's AI Act, as changed by the AI Omnibus in force July 27, 2026, applies its high-risk rules later than first planned.46 The lesson for supplier monitoring is simple: let software read, join and draft, show every source, and keep each decision with a named person who signs it.

How sourcing, supplier quality and regulatory CMC run supplier risk monitoring today

In shortFive or six people share the work, each holding one piece: the risk lead, the API category manager, external manufacturing, supplier quality, regulatory CMC and supply planning. By hand, one regulatory action at a single-source API site takes two to five days to turn into a decision, most of it spent finding and joining facts.

Who holds which piece of a supplier warning

Spreadsheets, subscriptions, consultants and software: four ways teams watch suppliers

Northwind Bio's import alert at Hanvar Vapi Unit II, from 6:12 am to a signed response

In shortAI agents, software that each does one defined job, read FDA's pages, match the letter and the alert to Hanvar's Unit II by FEI and address, trace the path to $1.2 billion of US tablet sales, count 23.3 weeks of cover and propose three responses. Omar Haddad, director of supply risk, chooses one and signs. Six people get their tasks.

1

The dependency graph, with every warning pinned on its site

Omar's home screen is a map of what Northwind makes and where it comes from: tier-2 suppliers on the left, approved supplier sites, critical materials, then products with their yearly sales. Thick lines are single-source paths; dashed lines are second approved sources. Warnings already read sit as tags on their sites: a typhoon 58 km from a starting material plant in Taizhou, a CCC+ rating on a glass supplier, a proposed 25% duty, a six-day port delay. $11.3 billion of sales sit on single-source paths. Two new FDA items wait on the news strip at the top.

2

Two FDA items read, and matched by FEI

One click reads the two items. The feed reader pulls the event, firm, FEI, address and dates from warning letter 320-26-841 and the Import Alert 66-40 entry. The site matcher lands both on Hanvar Vapi Unit II by FEI S009817742 and the plot address, and notes that Vapi Unit IV, with a different FEI, is not named: a near miss.

3

The site turns red and the path lights to $1.2 billion

Hanvar Vapi Unit II turns red with an "IA 66-40" tag. The thick line lights through talvoren sodium to Talvoren 20 mg tablets, $0.7 billion of US sales a year, and Talvoren 40 mg tablets, $0.5 billion. Unit II is the only US source of the ingredient, so $1.2 billion of US sales sits on this one path. Everything else on the map fades.

4

Alert A-1042 opens, ready to assess

The alert writer raises A-1042, "FDA warning letter and import alert, Hanvar Vapi Unit II", score 91, owner Omar Haddad, raised at 6:12 am. Before anything is worked out, the screen says what will happen: seven agents will read the letter and the alert, confirm the exact site, trace the products, work out cover, check filings and propose responses with the evidence.

5

Seven agents at work, each step in view

The dependency mapper traces Unit II to talvoren sodium and both tablet strengths, US and EU. The impact and cover calculator reads 412 kg on hand, 96 kg held at the port, 29 kg a week and 9.1 weeks of finished goods. The alternate source finder finds Meridian Química in Tarragona, approved for the EU, with 180 kg available by November 30. The regulatory impact checker finds that the US filing names Unit II only, and flags cover under 26 weeks for a shortage notification assessment.

6

The cited assessment beside the letter itself

"What happened" says Unit II is on Import Alert 66-40 from October 5, is the only source of talvoren sodium in the US filing, and that both tablet strengths, $1.2 billion a year, have 23.3 weeks of cover. Each statement carries a numbered citation. The letter opens on the right, its passages highlighted. The site match is shown as 99%, on FEI and address.

7

Impact by market, and cover against time to recover

The impact table separates what is hit from what is not: Talvoren 20 mg in the US, 23.3 weeks, affected; 40 mg in the US, 26.8 weeks, affected; both strengths in the EU, supplied from Tarragona; the oral solution, made at Unit IV, not affected. Below, cover is drawn against each option's time to recover. The 96 kg at the port are not counted until FDA releases them.

8

Three responses, one suggested, six tasks

A: bring Tarragona into the US filing, with a supplement now and a 180 kg order, first US lot release about week 22. B: ask FDA to exclude talvoren sodium from the alert with independent batch testing, outcome uncertain, 9 to 20 weeks. C: wait for Hanvar, which the screen puts at a year or more. A is suggested.

Its six tasks name owners and dates: Dana Okafor orders 180 kg by October 9; Priya Ranvelle files the supplement by October 23 and decides on a shortage notification by October 14; Dr. Maya Chen confirms Tarragona in the quality system by October 16; Lena Ortiz holds the 412 kg by October 10; Sam Patel asks Hanvar for its response by October 8.

9

Nine sources behind the alert

The evidence tab lists everything the assessment rests on, each with the passage that matters: the letter, the alert entry, the filing register's section 3.2.S.2.1, the stock snapshot, the supplier register record for Unit IV, the approved supplier list ("EU only"), Meridian's capacity email, the supply agreement's clause on second-source information and a trade press item.

10

A letter to the supplier that cites the agreement

The alert writer drafts a message to Hanvar's managing director for Sam Patel, the external manufacturing lead, to send. It cites clause 9.3, which asks for written notice of any regulatory action within five business days, notes none has arrived, and asks by October 14 for Hanvar's response to FDA and its corrective action plan, the status of the two lots held at the port, and, under clause 14.2, the technical information needed to qualify a second source.

11

Omar signs option A with his reason

The sign dialog states what he is approving, "Bring Tarragona into the US filing", and that six tasks will go to their owners. The reason is prefilled for him to edit: cover is 23.3 weeks; Tarragona recovers US supply in about 22 weeks if the filing goes in this month; the exclusion request stays as a fallback. He signs with his password, and the meaning of the signature is stated: "I approve this response plan."

12

Signed, and the alert moves to Mitigating

A-1042 moves from Assessed to Mitigating. The six tasks open with their owners, and the alert will be checked again on every new warning about the site. The activity tab keeps each step: the feed reader at 6:12 am, the site matcher at 6:13 am, the alert raised at 6:14 am, the assessment and the signature.

13

Every step on the activity trail

People and agents appear on one trail, each line with its time. The assessment and the signature are logged at 9:20 am, about three hours after the alert was raised.

Beyond one alert: the supplier risk register, site pages, warning log, dashboard and alert rules

In shortBeyond one alert, the risk lead works from a register of open alerts, a list of supplier sites with their risk factors, a log of every warning read with its reason, a dashboard of exposure, and rules that decide when a warning becomes an alert. Tier-2 sources appear on the same map.

1

The risk register: six open alerts

Each row gives the alert, its type, the site, products, sales, score, weeks of cover, stage and owner. A-1042 tops it at 91. Below it: a credit downgrade to CCC+ at Grauvel Glass (Veltrimab pen, 31 weeks), a typhoon near Kelbrook Pharmachem in Taizhou (Dravenzo tablets, 19 weeks), an earthquake near Seiryo Bio Media in Kumamoto, a proposed duty affecting Tanmore Biochem, and a six-day port delay at Quillmar Devices in Penang (12 weeks).

2

Suppliers and sites, with the last inspection or audit

Twenty critical sites of the 214 watched, each with tier, country, what it supplies, its risk score, its last FDA inspection classification or supplier audit, and its status. Single-source materials are marked.

3

The sister unit, on watch with its reason

Hanvar's Unit IV keeps its own page: risk 46, on watch, FEI S011094418, Plot 88, last FDA inspection in February 2025 with no action indicated. It makes talvoren hydrochloride for the oral solution, with 31 weeks of cover and no second source qualified. Its history notes that it was not named in the letter or the alert.

4

Every warning read, with the reason it was kept or set aside

In 24 hours the feed reader read 41 items from 96 feeds in six languages: 9 matched to six sites, 1 near miss explained, 31 set aside. A statement of GMP non-compliance at another company's plant in the Czech Republic is "not ours: not in the supplier register, nor a known sub-tier source". A warning letter to an outsourcing facility in Texas is not a Northwind supplier.

5

The supply risk dashboard

Warnings read over 30 days, alerts by risk type, sales on single-source paths colored by weeks of cover, a country-by-risk heat map and the time from a feed publishing to a cited alert, with a 60-minute target line.

6

Alert rules that show what they would catch today

Hazard distance (150 km), earthquake size (M5.0 within 50 km), and the cover below which an alert on a single-source path is high severity (26 weeks) are settings. Each says what it catches today: "3 open alerts are high at this threshold". The same-group check, tier-2 matching and the filing check can each be switched on or off. Owners are set per alert type. Rules can be described in a sentence and approved before they apply.

7

Tier-2 paths on the same map

The tier-2 filter shows the suppliers behind the suppliers. Kelbrook Pharmachem in Taizhou is the only maker of KSM-7, a starting material Calder Synthesis in Linz turns into dravenzo besylate for Dravenzo tablets, $2.6 billion a year.

8

A natural hazard alert, watched through landfall

A-1040 is the typhoon. Its response was signed the evening before: watch through landfall. Dravenzo tablets have 19 weeks of cover, and the weather bulletin is open beside it.

Seven agents read and calculate; the risk lead, supplier quality and regulatory CMC decide

In shortEach agent has one job and a line it does not cross. No agent places an order, files with a regulator, notifies FDA or writes to a supplier on its own. A named person signs every response, supplier approval stays in the quality system, and map changes wait for the category manager.

Sign-offs in the example: the risk lead, the category manager, supplier quality

Omar Haddad, the risk lead, chooses and signs each response, with a stated meaning of signature. Dana Okafor, the category manager for APIs, accepts each change to the dependency map before it takes effect and owns financial and trade alerts. Dr. Maya Chen keeps supplier approval and GMP decisions in the quality system; an alert cites the approved supplier list and never changes it. Priya Ranvelle, the regulatory CMC lead, owns filings and the 506C decision. Sam Patel sends supplier letters.

Every agent step, warning, decision, task and setting change is on the audit trail with who, what and when, and rule changes are versioned. These controls support your own compliance and audit work, and you validate your own use.

What Supplier Risk Monitoring reads, what it hands back, and its design targets

In shortIt reads your bills of materials, supplier register, stock, plan and filing register, plus public regulator, hazard, credit, trade and sanctions feeds. It hands back a live dependency map, warnings pinned to sites, cited alerts with cover and options, and signed responses with tasks. The figures below are design targets, to be measured in your own pilot.

The ERP, quality, regulatory and planning systems it reads from

ERP for bills of materials, vendors and stock; the quality management system for approved suppliers and audits; regulatory information management for filed sites; supply planning; the contract repository; and your existing subscriptions. It reads them, and supplier approval, orders and filings stay in the systems that own them.

What a late-found supplier problem costs a drug company in cover, filings and sales

In shortNobody publishes the cost of one supplier event to one company, so your case comes from your own records. The public numbers show the stakes: import alerts arrive weeks before the letters that teams wait for, and shortages of injectables last years. A week of your own data on last year's events will tell you more than any benchmark.

Pricing last year's supplier events from your own records

Costs of a late supplier warning that no calculator counts

Valuing earlier warning: analyst days, supply gaps avoided and expediting, in a calculator you fill in

In shortThree levers: fewer people-days per event, supply gaps avoided because the response starts weeks earlier, and less spent on rush freight and testing. The first you can measure this month. The second is the largest and the least certain, so test it on your own past events. Replace every default with your own figure.

One formula each for analyst time, supply gaps and expediting

Your yearly value from earlier supplier warnings

The gap lever carries most of the value on these defaults and rests on the least certain inputs. Read the line without it too: if analyst time and expediting alone do not cover the cost, your case rests on avoiding gaps, and a pilot should replay past events to test that.

Can you name every site behind your top products? Score your supplier risk monitoring

In shortScore each question 0 to 2. The total points to your next step: build the site register first, run a pilot, or plan the rollout. Nothing you choose leaves this page.

Questions for any supplier risk monitoring vendor about matching, cover, filings and sign-off

In shortBring a real FDA action from last year and your own supplier list to every demonstration. Ask us these too. A good answer shows the site, the source and the working; a weak one shows a red dot.

Replay last year's FDA actions: a 12-week supplier risk monitoring pilot on one product family

In shortStart with history whose answers you know. Build the site register for one product family, replay last year's FDA actions and hazards, compare the times with your own record, then run live in parallel. Decide on measured results.

Measures that show whether supplier risk monitoring works for you

Import alerts, FEIs, weeks of cover, 506C, BIOSECURE and AI: common questions on supplier risk monitoring

In shortEach answer stands alone. None is legal or regulatory advice; your own regulatory and legal teams decide.