You didn't mention if your are in the Automotive, Medical, or other supply chain.
Reactions are very different from one field to another and take for instance within the Automotive supply chain of GM the reactions will vary from location to location and whithin the supply chain it self from Tier to Tier.
The systems are more difficult the closer you are to the OEM.
For example here is a real life occurance this month with GM for a service part which they must have considered us a Tier 1.
We recieved a PRR (Problem Reporting and Resolution) from GM Plant X for missing components on an assembly.
We mold a Thermoset component that is assembled at another supplier then sent to GM service Plant.
The supplier that did the assembly went out of business and we were notified to send the part to GM Service.
GM uses a system call Covisint which has evolved over time from a materials management system to let's beat up the supplier system in some cases.
In fact it is difficult to follow the system without taking liability even before the investigation is complete. Guilty until proven innocent.
Of course their system was trying to order a component thinking it was an assembly - the aggravating fact is that this PRR is given to us every few years for an error in their system.
They eventually take the parts and say they will fix the error.
Taking time and money in wasteful manner over and over.
Sometimes a little common sense should prevail.
Sorry getting off track...
The common sense approach in my opinion is to confirm the non-conformance, contain the suspect product, perform the investigation with the suppliers help to reveal the root cause, develop counter measures with the supplier to reduce or eliminate the root cause - if the liability falls to the supplier work with the supplier to impliment cost effect methods to reduce the probabilty of a repeat.
Then write the ticket for liability.
Tom