Guide to Qualifying New Suppliers in Malaysia for Manufacturing Success
Malaysia is a premier manufacturing hub in Southeast Asia. According to the Malaysian Investment Development Authority (MIDA), “Malaysia, with its extensive trade....
By AMREP | Posted on September 21, 2026
A supplier quality agreement (SQA) is a signed document that defines the quality requirements a supplier must meet, how the buyer will verify them, and what happens when a part or process falls short. It sits alongside the purchase order and drawings and covers what those documents leave out: production approval, change notification, nonconformance handling, corrective action deadlines, traceability, audit rights, and cost recovery.
A well-written SQA turns expectations into obligations both sides can measure. A weak one gets signed, filed, and forgotten until the first quality escape.
This guide covers what an SQA is, which standards expect one, what to settle before drafting, the clauses every agreement needs, a worked example for a die-cast component supplier, the drafting mistakes that cause disputes, and how to enforce the agreement after signature.
An SQA is the quality chapter of the buyer and supplier relationship. Commercial contracts deal with price, volume, liability, and payment. Drawings deal with dimensions and materials. The SQA deals with the mechanics of quality: how parts get approved, how changes get controlled, and how problems get contained and fixed.
Each document controls something different, which is why none of them can replace the others.
| Document | What it controls | What it usually leaves out |
|---|---|---|
| Purchase order | Part number, revision, quantity, price, delivery date | How quality is verified or enforced |
| Drawing and specification | Dimensions, tolerances, materials, finishes | Process approval, change control, sampling |
| Master supply agreement | Commercial terms, liability, IP, warranty | Day-to-day quality procedures and deadlines |
| Supplier quality agreement | QMS expectations, approval, change control, NCR and CAPA, audits, records | Pricing and volume commitments |
The buyer's supplier quality team usually drafts the SQA. The supplier's quality manager and an officer with authority to bind the company sign it. Procurement then references it in the master supply agreement or purchase order terms so the quality obligations carry commercial weight.
No major manufacturing standard mandates a document titled "supplier quality agreement." Each one does require the buyer to define and communicate requirements to external providers, and a signed SQA is the clearest evidence an auditor can see that this happened.
| Standard | Relevant clauses | What it expects from the buyer |
|---|---|---|
| ISO 9001:2015 | 8.4.1, 8.4.2, 8.4.3 | Controls proportionate to risk, and communicated requirements for approval, competence, interactions, verification, and any on-site verification |
| IATF 16949:2016 | 8.4.2.2, 8.4.2.3, 8.4.2.4, 8.4.2.5, 8.4.3.1 | Flow-down of statutory and regulatory requirements, supplier QMS development, performance monitoring, supplier development, and special characteristics |
| AS9100D | 8.4.3 | Flow-down covering right of access, counterfeit part prevention, notification of nonconforming product, process change approval, and record retention |
| ISO 13485:2016 | 7.4.1, 7.4.2 | Risk-based supplier controls and, where applicable, a written agreement that suppliers notify changes before implementing them |
| FDA 21 CFR Part 820 (QMSR) | Incorporates ISO 13485:2016 by reference | Since the QMSR took effect on February 2, 2026, medical device purchasing controls align with ISO 13485 clause 7.4 |
| FDA guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements (November 2016) | Entire guidance | Written quality agreements defining responsibilities between drug owners and contract facilities |
Medical device buyers face the most explicit requirement. The written change notification language in ISO 13485 clause 7.4.2 is one reason device companies treat the SQA as a controlled document, a topic we cover in more depth in Managing Supplier Quality in ISO 13485.
Starting with a template before settling these points is how companies end up with agreements that fit no supplier well.
A packaging supplier and a supplier of safety-critical castings should not sign identical agreements. A practical structure is one master SQA for all suppliers plus part-specific or commodity-specific appendices for higher-risk items. The appendices carry the critical characteristics, capability targets, and test methods.
State which document wins when the SQA, drawing, purchase order, and supplier procedures conflict. A common order is drawing, then part-specific appendix, then master SQA, then purchase order terms, then supplier procedures. Without this clause, suppliers default to whichever document is easiest to meet.
When suppliers operate in Spanish, Mandarin, Vietnamese, or Thai, decide which language version controls and translates the operational sections the production floor actually uses. An English-only agreement signed in a front office rarely reaches the operators running the process.
Cost recovery and chargeback clauses are only enforceable when the commercial contract references the SQA. Settle this with procurement and legal before negotiating quality terms.
Define the parts, sites, and processes covered. Define terms that cause arguments later, such as "nonconformance," "deviation," "critical characteristic," and "change." List named quality contacts and an escalation path up to a site manager or executive.
Specify the certification the supplier must hold and maintain, for example ISO 9001, IATF 16949, AS9100, or ISO 13485. Require notification within a set period if certification is suspended, withdrawn, or changes scope. Certification proves a system exists, and the SQA defines how that system must serve your parts.
State the approval method before production shipments begin. Automotive and industrial buyers typically require a Production Part Approval Process submission at a defined level, while aerospace buyers usually require a First Article Inspection to AS9102. Include capability targets for critical characteristics, such as Cpk of 1.67 or higher for initial approval and 1.33 or higher for ongoing production, which follow common AIAG convention.
This is the clause that prevents the most expensive escapes. Require written notice and buyer approval before any change to materials, sub-tier sources, processes, equipment, tooling location, or manufacturing site. Assign notice periods by change type, because a plant relocation needs far more lead time than a new gauge.
| Change type | Examples | Typical notice period | Typical approval route |
|---|---|---|---|
| Site or line relocation | Moving a die to another plant or press | 90 to 180 days | Full requalification or new PPAP |
| Sub-tier source change | New resin, alloy ingot, or heat treat vendor | 60 to 90 days | PPAP or FAI on affected characteristics |
| Process parameter change | Cycle time, cure temperature, weld schedule | 30 to 60 days | Engineering review, possibly a capability study |
| Inspection method change | New gauge, reduced sampling frequency | 30 days | Supplier quality engineer approval |
| Administrative change | Contact or document owner updates | 10 business days | Notification only |
These ranges reflect what appears in automotive and industrial agreements. Set your own based on how long your requalification actually takes.
Reference the sampling standard, such as ISO 2859-1 or ANSI/ASQ Z1.4, and the AQL for each defect class. Define what the supplier must check before shipment and what your team checks on receipt through the incoming quality control process. State whether certificates of conformance, material certifications, and test reports must accompany each lot.
Describe how rejected material gets documented, segregated, and dispositioned, and who pays for return freight. Require written deviation approval before shipping any known nonconforming part, with the deviation quantity or date limit stated. Align the supplier's documentation with your Non-Conformance Report process so both sides record the same data.
Name the method, usually 8D, and set deadlines for each stage.
| Corrective action milestone | Common requirement |
|---|---|
| Acknowledgement and containment | Within 24 hours of notification |
| Root cause and planned actions | 5 to 10 business days |
| Actions implemented and verified | Within 30 days |
| Closure with effectiveness evidence | After enough production data shows no recurrence |
Add escalation for missed deadlines, such as controlled shipping, third-party containment at the supplier's cost, or new business hold.
Define the traceability chain, for example from finished part to production lot, shift, machine or cavity, and raw material heat or lot number. Specify retention periods. IATF 16949 clause 7.5.3.2.1 sets a baseline of the active production and service life plus one calendar year for records such as PPAP and tooling. ISO 13485 clause 4.2.5 requires at least the lifetime of the device, with a minimum of two years from release. Aerospace retention periods are usually set by customer contract.
Require the supplier to pass relevant requirements to its own suppliers and to control them. Special processes such as heat treatment, plating, and welding often happen at sub-tier sources the buyer never sees, which makes this clause central to controlling hidden risk.
Grant the buyer, its customers, and regulators access to the supplier's facilities and records, including sub-tier sites where feasible. State the notice required for scheduled audits and whether unannounced visits are allowed after a quality escape.
List the metrics and review cadence. Common metrics include PPM, calculated as rejected units divided by received units multiplied by 1,000,000, along with on-time delivery, on-time CAPA closure, and premium freight incidents. State the consequences of sustained red scores, such as a mandatory improvement plan or supplier development program.
Itemize recoverable costs: sorting and rework labor, re-inspection, line-down time, third-party containment, expedited freight, and an administrative fee per NCR if applicable. Vague phrases like "all associated costs" invite disputes.
Require declarations and supporting evidence for applicable regulations, including EU REACH SVHC content, EU RoHS Directive 2011/65/EU, conflict minerals reporting through the CMRT, PFAS restrictions, and rules-of-origin documentation for USMCA claims.
Set an effective date, a review interval, and triggers for revision such as new part families or site changes. Define what happens to tooling, inventory, and records if the relationship ends.
The following is an illustrative example that combines issues commonly found in supplier audits. It is not a single client case.
A US maker of industrial motor drives sources an aluminum die-cast, CNC-machined heat sink housing from a supplier in Monterrey, Mexico. Three characteristics matter most: flatness of the mounting face for thermal contact, porosity in the gasket sealing area for ingress protection, and thread integrity on the mounting bosses.
The part-specific appendix includes clauses like these:
Now consider a common failure scenario. Midway through the program, the casting supplier's purchasing team switches to a cheaper ingot source without telling its own quality department. Porosity in the sealing area rises, and several housings fail leak testing at the buyer's assembly line.
Because the SQA required ingot lot traceability, the buyer could limit containment to lots cast from the new ingot source instead of quarantining all inventory. Because the change notification clause named ingot sources explicitly, the supplier could not argue the change was minor. The 24-hour containment clause and the cost recovery appendix settled who paid for the sort without a separate negotiation.
The lesson for drafters is that each clause did its job only because it was specific. A generic "notify buyer of significant changes" clause would have produced an argument about what "significant" means while bad parts kept shipping.
Signature is the starting point. Enforcement depends on what happens after.
Walk through the agreement clause by clause at supplier kickoff with the supplier's quality and production leads, not only the sales contact. Fold the SQA into your supplier onboarding checklist so no supplier ships production parts before signing and completing approval.
Translate the operational appendices into the local language and confirm that work instructions, control plans, and inspection records on the floor reflect SQA requirements. Verify compliance during supplier audits by sampling traceability records, change logs, and CAPA files against the agreement's terms.
Review scorecards quarterly and revisit the SQA at least once a year. Update appendices whenever a drawing revision changes a critical characteristic.
The gap between a signed agreement and supplier behavior is where most escapes happen. Buyers who close that gap usually have someone physically present at the supplier during launches, change implementations, and containment events.
It can be, depending on how it is incorporated into the commercial contract and the governing law. An SQA referenced in the master supply agreement or purchase order terms carries more weight than a standalone document. Have legal counsel review the linkage, since enforceability varies by jurisdiction.
Yes. ISO 9001 certification confirms the supplier runs a quality management system. It does not tell the supplier your critical characteristics, notice periods, sampling plans, or response deadlines.
A standard master agreement with a cooperative supplier can be signed within a few weeks. Negotiations run longer when cost recovery rates, change notification periods, or audit access for sub-tier sites are contested. Starting early, before the first production order, gives you leverage.
Yes, with scaled content. Distributor agreements focus on traceability to the original manufacturer, counterfeit part prevention, storage and handling conditions, shelf life, and ESD protection rather than process controls.
Find out which clauses cause the objection. Suppliers often accept most terms and resist uncapped cost recovery or short notice periods. Negotiating those points is usually better than dropping a capable supplier, though refusal to accept change notification or audit access is a serious risk signal.
AMREP Supplier Management Services has spent more than 35 years helping OEMs make supplier requirements stick. Our engineers draft and review SQAs, verify compliance on site, and follow up on CAPA items across our locations in Mexico, China, Vietnam, India, Thailand, Malaysia, the Philippines, Indonesia, Poland, and the United States. If you need someone at your supplier who can confirm the agreement is being followed, our supplier quality engineering services put a qualified engineer on the floor. Contact the AMREP team to discuss your supplier base.
Contact Us To See What We Can Do
Call Us
Mon - Sat 9.00 - 18.00
Sunday Closed
12 - May 2025
12
May
2025
Malaysia is a premier manufacturing hub in Southeast Asia. According to the Malaysian Investment Development Authority (MIDA), “Malaysia, with its extensive trade....
22 - April 2025
22
April
2025
Healthcare is rapidly evolving, ensuring consistent and high-quality patient care. Total Quality Management (TQM) in healthcare is more than just a buzzword—it is a powerful....
16 - April 2025
16
April
2025
Total Quality Management (TQM) is a mindset that involves everyone in the organization working toward a common goal: achieving excellence through quality. From....