Specification

You need direct or delegated audit access as part of your regulatory obligation.

And fifth, put a quality agreement in place before you place a commercial order, not after the relationship is already running Specification, change notification requirements, nonconformance handling, the audit rights, all of it in writing.

If a supplier resists formalizing that agreement, that reluctance that itself is information about how they'll behave when something eventually goes wrong.

Quality sourcing is slower than price-based sourcing.