Whether your company is a small ten person start-up, working hard on the design and development of the company's first product, or your company is a large multi-national with thousands of employees and many released products, IVD manufacturers must establish effective and documented processes for identifying and managing all products and services that are obtained from suppliers. Defining, documenting and implementing purchasing controls and supplier management processes is a required aspect of your quality system, and failure to establish effective processes in this area can result in very serious quality and regulatory problems for your company.

In today's blog post, I'll provide a brief overview of the following topics related to managing your suppliers: (1) key concepts, (2) regulatory requirements/current status and (3) references for further information.

Key Concepts

Supplier: Anyone that is independent from the manufacturer's quality management system, and who provides a product or service to the manufacturer. This includes a supplier that may be part of the manufacturer’s organization but operates under a separate quality management system. In a contractual situation, a supplier is sometimes called a "contractor".

Products/Services: Examples relevant to IVD manufacturers include:

• services (transport, consulting, design, sterilization, kitting)
• software (data analysis, operating system, manufacturing processes)
• components (raw material, substance, piece, part, firmware, labeling, assembly, manufacturing materials, processed material)
  
  

IVD Manufacturer: The organization who designs and/or manufactures an IVD device with the intention of making the finished IVD device available for use, under the organization's name, whether or not the IVD device is designed and/or manufactured by the organization or by a third party. The concept of manufacturer is quite broad and can include organizations that perform any of these tasks (specification development, production, fabrication, assembly, processing, packaging, repackaging, labeling, relabeling. sterilization, installation, or remanufacturing).

Outsourced Process: A process that the IVD manufacturer needs as part of the quality management system, and chooses to have performed by a supplier. Relevant IVD examples might include: (1) mixing of bulk reagents by a supplier or (2) electrical safety testing for an electro-mechanical device design by a third-party test lab. As with all obtained services, outsourced processes must be controlled through the manufacturer’s purchasing controls/supplier management system, and the responsibility for meeting quality system requirements lies with the manufacturer.

Regulatory Requirements

Of specific interest to IVD manufacturers are the regulatory requirements defined in FDA 21 CFR Part 820 Quality System Regulation/Good Manufacturing Practices for Medical Devices and in the ISO 13485:2003 Quality System Standard. As in other key elements of Quality Systems requirements, the US and EU requirements relating to Purchasing Controls/Supplier Management are very well harmonized, and that means that common processes and documentation can be established by an IVD manufacturer to comply with both sets of requirements.

The specific references are as follows: 21 CFR Part 820.50 and 820.50(a) "Purchasing Controls (a) Evaluation of suppliers, contractors and consultants" corresponds to ISO 13485:2003 clause 7.4.1 "Purchasing process", and 21 CFR Part 820.50(b) "Purchasing data" corresponds to ISO 13485:2003 clause 7.4.2 "Purchasing information".

Here is a brief summary of these regulatory requirements and current status:

1. Each manufacturer must establish procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.
2. Each manufacturer must establish requirements (including quality requirements) that must be met by suppliers, contractors and consultants.
3. Suppliers, contractors and consultants must be evaluated and selected based on their ability to meet the specified requirements.
4. Each manufacturer must define the type and extent of control to be exercised over the product, services, suppliers, contractors and consultants, based on the evaluation and selection.
5. Purchasing data, including specified requirements, must be established and maintained and approved by the manufacturer.
6. Purchasing documents, where possible, must include an agreement that suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that the manufacturer may determine whether the changes may affect the quality of the finished device.

It is important to note that within the current regulatory framework, the medical device manufacturer (and remember the broad concept for this term discussed above) is primarily responsible for meeting the regulatory requirements of the quality management system. This means that the device manufacturer cannot relinquish (contractually or otherwise) its obligation and responsibility over any or all functions within the quality management system. The responsibility for complying with the quality management system requirements cannot be delegated to any supplier of products or services. During an audit or inspection by a regulatory agency or notified body, it is expected that the device manufacturer will provide documented evidence of appropriate control of all suppliers of product and services. Failure to demonstrate appropriate supplier control will result in audit observations and possible regulatory actions against the device manufacturer (not the supplier)!

The FDA/CDRH has recently indicated that a more focused review of purchasing controls/supplier management processes will be included in standard inspections of medical device manufacturers. Training is currently underway for FDA device inspection personnel to ensure consistent and appropriate coverage of this key aspect of regulatory compliance during upcoming inspections.

References for Further Information

1. GHTF/SG3/N17:2008 Quality Management System - Medical Devices - Guidance on the Control of Products and Services obtained from suppliers. I discussed the importance of the GHTF (Global Harmonization Task Force) in an earlier blog post, and this particular guidance of controls of products and services is a "must have" on this topic. The FDA participated actively in the development of this guidance, and the result is a highly relevant and useful document. The guidance is available at no charge through the link above.
2. Guidance for Notified Bodies auditing suppliers to medical device manufacturers, Notified Body Operations Group, Best Practices Guide, #2010-1, March 2010. Establishing an ISO 13485:2003 certification for your Quality System typically requires an audit by a Notified Body to confirm compliance to the requirements of the standard. This guidance provides you with the specifics of the audit approach that your Notified Body will likely use to assess your Purchasing Controls/Supplier Management system. As with the GHTF document noted above, this NBOG guidance is well written and helpful and is available at no charge through the link above.
3. Supplier Controls and Supply Chain Management Course: AAMI Quality Systems Training Programs. The Association for the Advancement of Medical Instrumentation (AAMI) is an organization highly regarded by the medical device community for developing and conducting Quality System courses. A recently developed course provides excellent instruction on the requirements of Supplier Controls and Supply Chain Management. An important aspect of these AAMI courses is the regular participation of CDRH personnel, who co-present the material along with industry experts, and provide the current FDA view of the regulations.

Remember – Let the Buyer Beware! Medical device manufacturers are required to control products and service obtained from suppliers. The responsibility for complying with the quality management system requirements cannot be delegated to any supplier of products or services. If you obtain product or services from a supplier, contractor or consultant, then you are responsible for ensuring quality system and regulatory requirements are met.

Stay tuned for more blog posts on this important topic.