How to Respond to a SCAR From a Customer

A SCAR, or supplier corrective action request, is a customer's formal request that you find why something you supplied failed a requirement and prove the fix. To respond, confirm receipt and the due date, contain suspect product, find the cause from your own records, and return evidence on the customer's form.

This guide is written for quality teams at contract manufacturers and component suppliers to medical device OEMs, where a SCAR is read twice: first by the supplier quality engineer who issued it, then by whoever audits your customer's supplier file. Most of it applies in any industry.

What is a SCAR?

A SCAR is your customer's document, raised in your customer's system, usually on your customer's form. It can follow a rejected lot at incoming inspection, a customer complaint traced back to your component, an audit finding or a process change you made without notice. Not every nonconformance earns one, and some customers grade them as critical, major or minor, so check the severity when you read it.

How is a SCAR different from an 8D?

The SCAR is the request. An 8D is one format you might answer in. Some OEMs ask for an 8D by name and others have their own response sections, but the content they want is close to the same. If you are asked for one, our guide to the 8D walks through each discipline.

How is a SCAR different from your own CAPA?

The SCAR lives in your customer's quality system and your CAPA lives in yours. Most shops certified to ISO 13485 open an internal record when a SCAR arrives, since clause 8.5.2 covers nonconformities, complaints included. Cross-reference the two numbers.

Be careful about answering with a CAPA you already closed. If the cause really is the same, that CAPA didn't work, and the response needs to say so.

Why do device OEMs send SCARs?

Your customer can't hand its quality obligations to you. ISO 13485 clause 7.4.1 has it address failures to meet purchasing requirements with the supplier, in proportion to the risk of the purchased product. In the US, FDA's Quality Management System Regulation has incorporated ISO 13485:2016 by reference since 2 February 2026.

There is a practical reason too. Your customer may need your data to finish its own complaint investigation, and only you hold the lot records. It may be on a clock you can't see from your side, so ask what it needs and by when.

What should you do when a SCAR arrives?

1. Confirm receipt, name one owner, and write down the dates. There are often two: one for containment and one for the full response.
2. Read the scope. Which part numbers and lots, which requirement, what severity, and whether a customer complaint sits behind it.
3. Contain suspect product. Your stock, work in process, outside processors such as sterilizers and platers, and lots already shipped. Use lot genealogy to find what shares a resin lot, tool, cavity or production run with the affected lot.
4. Tell the customer about other affected product. A SCAR on one lot often implicates others. Your quality agreement may require this, and it is better coming from you. One published template makes it an explicit requirement.
5. Ask for samples and data. Returned parts, photos, and the failure description from the complaint where your customer can share it.
6. Open your internal record and preserve the evidence. Save process monitoring data and retained samples before they age out.

What goes in a SCAR response?

Forms differ, but a complete response covers these sections:

• Problem description. What failed, against which requirement, how many, which lots.
• Containment. Quantities found at each location, sort results, and how certified stock is identified.
• Root cause. Why the defect was made and why your controls didn't catch it, with the analysis attached. Customers often ask for the 5-why or fishbone itself, not only its conclusion.
• Corrective action. What changes, who owns it, by when, and the first lot it applies to.
• Systemic action. Other parts and processes you checked, and the FMEA rows, work instructions and control plans you updated.
• Effectiveness check. What you will measure, on how many lots, over what period, and what result counts as a pass.

What evidence do OEMs expect behind the root cause?

Records, compared across affected and unaffected lots:

• Device history records and lot travelers.
• Inspection and test data.
• Process monitoring data against your validated process window.
• Maintenance and calibration records for the equipment involved.
• Material certifications and incoming inspection results.
• Deviations and change records around the affected dates.
• FMEA rows for this failure mode, and past SCARs on the same part.

Here is an invented example. An OEM reports short shots on a molded catheter hub across three lots. Every lot ran inside the validated window, so the batch records look clean. Comparing the cavity pressure trend across lots shows one cavity drifting, starting after a skipped nozzle clean. The response that names that drift, with the trend attached, is the one that holds up. "Process ran within validated parameters" answers a different question.

Can you change a validated process to fix the problem?

Check before you do. If the fix touches a validated parameter, tool, material or site, you may need to revalidate under clause 7.5.6, and your purchasing agreement may require you to tell the customer before the change goes in, as clause 7.4.2 anticipates. Some customers go further: one template bars suppliers from implementing proposed actions on its product until it approves them.

Clause 8.5.2 also asks you to verify that a corrective action won't harm safety, performance or regulatory compliance. So a response is often a plan with dates and not a finished fix. Say that plainly, and keep containment running in the meantime.

How long do you have to respond to a SCAR?

It depends on your quality agreement and the SCAR. As one published example, an L3Harris template allows 7 days for a containment response on a product SCAR and typically 30 days for the root cause and corrective action plan.

Ask for any extension before the due date, with the reason. That same template warns that a late response, an inadequate response or a late implementation can all hurt your scorecard.

Why do SCAR responses get rejected?

• The root cause restates the defect.
• The root cause is "operator error," and the action is retraining.
• Nothing explains why your controls missed it.
• Containment leaves out shipped lots or outside processors.
• Actions have no owner, date or first affected lot.
• A process change is proposed with no word on validation or customer notice.
• The effectiveness check has no measure or no pass criterion.
• Evidence is summarized but not attached.

A rejected response comes back for more information, which uses up the time you were trying to save. For why retraining so often fails, see The Recurrence Problem.

What if you don't believe the defect is yours?

Answer with evidence, on time. Test the returned parts and your retained samples from the same lot. Show the conformance data. Then say what would have to be true for the defect to have started downstream, and ask about handling, sterilization, storage and assembly at your customer's site. Propose a joint review if the data doesn't settle it.

A SCAR left open while you argue about ownership still counts as open.

What if the cause sits with your own supplier?

You still own the response to your customer. Ask the supplier for its 8D and data, review them as strictly as your customer will review yours, and attach the evidence. Then look at your own incoming controls, because they may be part of why the defect reached your customer.

What happens after you send the response?

Your customer reviews it, and may send it back or approve it. Keep containment in place until you both agree it can come off. Run the effectiveness check as written and send the results, since many SCARs stay open until that evidence is in. Keep the whole record findable, because your customer's next audit of you may start with it, and repeat failures put your place on the approved supplier list at risk.

How does Lattice help with SCARs?

Lattice is AI investigation software for quality teams. For contract manufacturers and component suppliers, it works each SCAR against your device history records, inspection data and validated process windows, and fills your OEM's response form with every finding cited. Your engineer reviews and signs. The aim is a response back in days, with up to 80% of the hours back. See how it works for suppliers to device OEMs.

---

Sources

1. L3Harris, supplier corrective action request example. Severity grades, deadlines, notice of other affected product, approval before implementation, scorecard effects.
2. Greenlight Guru, How To Approach Supplier Corrective Action Requests. Contents of a SCAR response and the return of insufficient responses.
3. U.S. Food and Drug Administration, Quality Management System Regulation: Frequently Asked Questions. Effective date and incorporation of ISO 13485:2016.
4. International Organization for Standardization, ISO 13485:2016, Medical devices: Quality management systems. Clauses 7.4.1, 7.4.2, 7.5.6 and 8.5.2.
5. Auxiliary Machines (2026), The Recurrence Problem.