Supplier Packet Diligence Standard

Upstream of your quality system. Before anything is accepted.

Upstream of the quality management system (QMS), the ERP and the laboratory information system (LIMS). Those systems keep what a team has already accepted; packet review decides what the packet actually supports before it is accepted.

The supplier sends the packet
Through its standing link from the pharmacy (one link per supplier, its door), with no account, no login and no cost, or by email to the workspace's own address. Most risk starts here: a seller named as the maker, a lapsed accreditation, a certificate with no tie to the lot.
Veritura reads and checks it
Every certificate faces up to 20 named checks. Every credential says how it was verified and when. The file itself is read for 17 document-integrity signals. The result says what is present, what conflicts and what could not be verified.
A person decides
Qualified, qualified with written conditions, or not qualified, signed by a named person. Qualified is refused while a gap is open.
The system of record stores the decision
The signed decision is what the QMS or ERP keeps. The original documents stay on file in Veritura, as received, with their fingerprints.

FDA warning letterMay 1, 2026

… identified your firm, “…,” as the manufacturer of API rather than (b)(4), the firm from which you purchased …

A certificate can name the seller and leave the maker off.

Six dated elements. One living file per supplier.

One living file per supplier, with six elements, each dated and shown as current, due or overdue.

Element	What is asked	How it is verified
Manufacturer identity	Who made the substance, and where.	Read from the certificate. A seller printed under a seller label is never counted as the maker.
Accreditation	The testing laboratory's accreditation, such as ISO/IEC 17025.	The certificate is read: the accrediting body, the effective and expiry dates it states, and its scope matched to the tests each certificate of analysis reports, a test outside the scope named. Renewal due 30 days out; expired after, which holds.
FDA registration	The maker's FDA establishment registration.	Searched in FDA's registry: registered to manufacture passes, with its FEI; registered only to relabel or repack does not.
Quality agreement	The agreement between the pharmacy and the supplier.	On file and dated, with the date it falls due.
Documentation specifications	The panels each certificate from this supplier must carry.	Every certificate on file checked against them. A certificate missing a panel counts as partial, and the missing panel is named.
Ongoing monitoring	The supplier, the maker and the laboratory against public enforcement records.	Re-matched against openFDA enforcement records at check time and on an hourly cycle, with a review cadence and the date of the last review giving the file one status: current, due or overdue.

Every open gap carries a named owner and a due date, shows Overdue past it, and keeps its reassignment history.

Aurora Pharma Supply's file in a sample pharmacy: pinned, 5 documents owed and not asked for yet; its activity, newest first, from qualified by Dana Reyes, PharmD on Sep 30 and the file reviewed every 365 days to certificates read and lots signed off with the laboratory, report ID and lot number matching the receiving record; and about the supplier: an API manufacturer in Parsippany, NJ, its registration, the maker named, the next expiry, the recall watch and its first lot — One living file per supplier: what is owed, every dated act on it, and the facts it rests on.

Up to twenty named checks per certificate. Each naming its standard.

Against up to 20 named checks in four groups, each naming the standard it rests on. Which apply depends on the document: on 26 published bulk-substance certificates, 11 to 13 applied, 12 on the median one.

Group	The checks	What they rest on
The certificate itself8 checks	Names the substance and the lot Issued by a named laboratory with a report ID Signed for the quality unit by a person, not a role Addressed to this pharmacy Dated, with dates in a possible order and inside the retest or expiry date Its own figures agree with each other Every result inside its own printed limit A distributor's reissue references the original	21 U.S.C. 353a(b)(1)(A)(iii); ICH Q7 11.41 to 11.44 and 17.63
The substance4 checks	May be compounded under 503A: a USP or NF monograph, a component of an FDA-approved drug, or the 503A bulks list States the monograph it meets, where one exists The original manufacturer is named That manufacturer is registered with FDA	21 U.S.C. 353a(b)(1)(A)(i) and (ii); FDA's 503A lists as printed May 14, 2026; FDA's establishment registry
Published limits4 checks	Endotoxin limit no looser than USP <85> allows for the recorded dose Microbial counts inside USP <1111> Residual solvents inside ICH Q3C, a table of 63 solvents with their PDEs Elemental impurities inside ICH Q3D, and with the dose recorded, the share of each PDE	USP <85>, <1111>, <61>, <467>, <232>; ICH Q3C(R9); ICH Q3D(R2)
Outside sources4 checks	No recent FDA enforcement record matches the supplier Identity agrees with FDA's substance registry on name, UNII, CAS, formula and molecular weight The laboratory confirms it issued the report Agrees with every earlier certificate for the lot	openFDA enforcement and FDA warning letters; FDA GSRS; the issuing laboratory's recorded reply

The arithmetic is shown

When the pharmacy records its route and dose, the endotoxin line reads, for example, K / M = 5 EU/kg/hr / 0.028571 mg/kg/hr = 175 EU/mg, and the certificate is held to that number rather than the one it printed.

A methanol or lead result can sit inside the supplier's own printed limit and still fail ICH Q3C or ICH Q3D. Both are checked, and a check that cannot run says what it needs instead of passing.

All 20 checks on certificate COA-NC-3318 for sodium chloride lot NC-3318 from Aurora Pharma Supply, in four groups, each row with the line it read, the rule it is held to and its result — Each certificate in the packet read against the twenty named checks, each naming its standard.

Every item says how it was verified. And when.

Every item says how it was verified and when. Verified is never a state on its own.

The verified file goes further than the six elements: 37 items in five groups. Who they are (8), accreditation (8), FDA and enforcement history (8), quality evidence (9), and the records the law asks for (4), from state license and pharmacist in charge to sterility, endotoxin, cold chain and 503A eligibility.

How an item was verified	What that means
Matched at the source	A lookup ran against the issuer's public record, captured and dated.
Confirmed by the issuer	The issuer confirmed in writing, and the reply is kept.
Checked at the source by a person	A named person opened the issuer's own record on a date and recorded what it said.
Read from the issuer's document	Number, holder, dates and scope read from the document, with the holder matched to this firm.
Computed	The document's figures checked against a limit computed from the law or a standard, or against its own figures and the other documents.
Claimed	A person typed it. Nothing was checked, and the file says so.

Negative results are results: not found, name differs, expired, contradicted. A finding such as a recall, a warning letter, a Form 483 or an exclusion counts as verified information and is listed first. Completeness is the share of applicable items verified and still fresh. It is never a rating of the firm.

Lookups run automatically only where a source's terms allow it, such as FDA, openFDA, the NPI registry and the OIG exclusion list. LegitScript, NABP, most state boards and ACHC are checked by a named person, with a capture.

The document is a witness. Seventeen signals read it.

The document is read as a witness: 17 document-integrity signals, 7 in the file and 10 across your records, beside seven findings from the PDF's own metadata, thirteen signs of a generated document, and a comparison with the supplier's own past paperwork.

What is read	What it can raise
The PDF's own bytes	Created after the date it claims; modified after creation with a re-save; a creation date in the future; an image editor as the producer; an incremental edit stack; a creator and producer that disagree; chromatography claimed with no trace attached.
Signs of a generated document	A content-credentials (C2PA) AI assertion; language-model boilerplate; an unfilled template placeholder; a sample disclaimer; impossible, placeholder or malformed phone numbers; a ZIP code in the wrong state; an accreditation number in the wrong format; an unregistered lab with no anchor; uniformly round values; inconsistent units; contradictory sterility statements.
The supplier's own history	Eleven structural features compared with the supplier's earlier documents on file: field order, label vocabulary, header, footer, date style, units style, line shape, lab name, phone, address and email domain.
Reuse	The same file, report ID or lot where it should not be, across the workspace. Strong identifiers are also compared across every Veritura account, and a workspace sees only a count of the others, never their names, files or lots.

Document-integrity findings speak in signals for a person, never in verdicts, and never call a document forged, fake or fraudulent. Two signals hold the lot on their own: a high metadata contradiction, and a document whose own content credentials say it was generated by AI.

Document-integrity signals on certificate COA-NC-3318, 5 read and 2 not checked: its dates agree with each other; edited after it was issued, not checked, because a text file carries no edit history; and the rest of the signals on the file, its laboratory and the outside records, each with what it read and what it found — The file as a witness: each signal with what it read and what it found, for a person to judge.

An owner, a date, a drafted request. For every gap.

Each gap gets an owner, a due date and a drafted request. The supplier answers through one standing link.

Requests are drafted from what the review left open, in the supplier's terms, with no typing. By default Vera, the AI desk assistant, drafts and a person sends; she never makes a first contact or a release on her own.
The supplier answers through its door, with no account and no cost. The reply it sees is facts: received, read, and which asked items it satisfies. Never a grade, and never a document-integrity finding.
A document answered through the door files itself to the lot, and the review runs again.
A supplier can keep every pharmacy's door in one free supplier account.
Qualification ends in one of three outcomes, signed by a named person: qualified, qualified with written conditions, or not qualified. An unsigned decision reads recorded and never signed, so it does not stand.

Vellora Chemical's file: pinned, lot NX-2291 of naltrexone hydrochloride ready to review, cleared on receipt and not yet signed off, and 5 documents owed, not asked for yet; about the supplier: a bulk distributor or repackager in Indiana, the maker named as Vellora Pharmachem on 1 of 1 certificate, the recall watch on and not checked yet, first lot Oct 13, 2026 — Every gap with what is owed and the next step, on the supplier's own file.

Narrow words only. Documentation reviewed, nothing more.

Only what the documents support, in narrow words.

A partner may describe a packet as documentation reviewed once a completed review exists. The words stay narrow: documentation read and checked, with no product approval and no safety or quality certification, and never a statement about the product itself.

May say	Never says
Documentation read and checked by Veritura.	Any word of approval, certification or safety about the supplier or the product.
The certificate for lot BM-5520 was read and cited to its lines.	That the substance was tested, or that it is pure.
This supplier publishes its verified file, findings first.	A rank, a score or a badge for the supplier.

A pharmacy or supplier may publish its verified file. It is published whole, findings first. A finding the firm answers stays on the file, marked retired, with its date. No one can pay to change what a file says.

Where packet review stops.

It reads documents and public records. It does not test material, inspect a facility or audit a supplier on site.
A clean packet is not a supplier approval, and a completeness figure is not a rating of the firm.
No match is a fact about the sources that answered. Absence of a public-source match is not proof of absence.
A document-integrity signal is a prompt for a person, never proof that a document was altered.

Review one supplier packet with us.

Bring a packet you already hold. We read it on a call: every certificate checked, every credential's route stated, every gap given an owner.

Book a demo Open the live demo

Packet diligence: Review the packet before a supplier enters the system of record.

A packet is what a supplier sends to be trusted.