Information for Medical Device Manufacturers - Understanding and Implementing the Supplier Management Regulatory Requirements
'Failing to plan is planning to fail.' This adage applies to Medical Device Manufacturers in several ways. Many Medical Device manufacturers have failed in planning their vendor evaluation and management process well. As a result, they have faced devastating quality issues and received FDA warning letters.
The regulators hold the medical device manufacturers responsible and verify their controls through inspections and audits. The manufacturers need to understand and implement the regulatory requirements for supplier management. They should pass the audit or inspection.
This article helps the medical device manufacturers understand the regulatory expectations placed on them and directs them to the effective techniques of supplier evaluation and management process.
Medical Device: The regulatory expectations for Quality management systems, purchasing controls
21 CFR Part 820 : Medical device manufacturers must have a quality management system. Manufacturers must develop and maintain procedures that ensure all purchased and otherwise received products and services meet the specific set of requirements.
Purchasing controls: (Section 820.50)
'Evaluation of suppliers, contractors, and consultants'. Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants. Each manufacturer shall:
- Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented.
- Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results.
- Establish and maintain records of acceptable suppliers, contractors, and consultants.
Purchasing data. Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received product and services. Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device. Purchasing data shall be approved in accordance with B' 820.40.
Establish means define, document (in writing or electronically), and implement. 21CFR 820.3
Evaluating suppliers, vendors, and contractors - A five-step process
- Define and document requirements, develop questions for potential candidates
- Essential service providers who handle customer data and customer interactions
- Customer facing suppliers who don't handle customer data, but interact with customers.
- Customer data service suppliers who handle customer data but don't interact with customers
- Back office suppliers who provide core services but don't interact with customers
- Non-essential suppliers who don't provide core services or products
- Manufacturing/production capabilities
- Quality standards and certifications
- Regulatory and compliance requirements
- Technological capabilities
- Customer service standards
- Delivery and cycle times
- Product lifecycle management
- Compile potential suppliers and evaluate capabilities
- Is the supplier open to an explanation on how the requirements can be satisfied?
- Does the supplier have full documentation to support these claims?
- Do they have reasonable customer response time?
- Are they already on the approved list?
- Has someone else worked with them?
- Do they have good reviews online from other reputable sources?
- Organize the suppliers in order of priority choice
- Conduct a comprehensive/supplier audit
- Deployment and performance monitoring through periodic audits
Before evaluating the supplier, it is best for the manufacturer to evaluate and document requirements. Then put together a list of potential suppliers. Categorize them by critical vendors, non-critical vendors, critical 4th party vendors, and develop questions and risk reviews.
While compiling the list, consider the following areas:
It's not hard to make decisions when you know what your values are. Roy Disney. So ensure requirements are documented well.
On defining and documenting the manufacturer's requirement, start engaging potential suppliers to evaluate their interest in partnering with you. Find those open to a potential partnership and present your requirements.
Some factors to consider while compiling and evaluating capabilities:
If a product is involved, request a sample and assess it yourself. The list of suppliers can become a long list. Shortlist more than five companies from the list. To perform a thorough assessment, evaluate each of the top potential candidates to make sure their documentation meets every requirement.
The next step is to build an evaluation sheet based on your engagement with potential suppliers (which again reflect your requirements). By weighing each requirement against each supplier capabilities, arrive at a total score per supplier. This allows you to compare the suppliers.
On identifying a top potential supplier, perform a thorough on or off-site audit depending on the nature of the product or service. Ensure that both critical and noncritical suppliers are audited against a list of predetermined criteria that require verification. In the case of critical suppliers, an onsite audit is a must.
Now it's time to make the choice. The base for selection should be the evaluation sheet. Look at the total scores and make a ranking of the vendors.
On qualifying a supplier, ensure that the performance is monitored periodically on a regular basis. While monitoring performance, the manufacturer must decide when to praise them and when to issue a red flag. Show appreciation for good performance and provide additional business for excellent performance.
Supplier Management
- Classify suppliers by risk level and accordingly prioritize performance quality assessments
- Be cautious while developing new supplier relationships
- Be precise in quality agreements
- Include standards or regulations that suppliers are expected to meet. These may include FDA Quality System regulations, ISO Standards, European Regulations, etc.
- Define the roles and responsibilities with regard to the quality controls and deliverables to meet quality requirements
- Include Plans and schedules for periodical assessments by the contracting company
- Include Design Change Control Update
- Include Business Process Specification Maintenance
- Exercise due diligence
- Review the key foundation of the supplier
- Principals, owners
- Financials
- Performance
- Insurance, third-party coverage
- The supplier's knowledge of the industry and regulatory requirements
- The supplier's ability to keep pace with the legal and regulatory changes
- Oversee and monitor
- Monitor vendor performance, contracted terms and conditions
- Establish the process to ensure supplier compliance with regulatory requirements, adherence to contract provisions, maintaining appropriate security, and their financial ability to perform.
- Perform ongoing risk reviews
- Low risk, moderate risk vendors - Annually/bi-annually
- Medium risk vendors - Semi-annually/annually
- High-risk vendors -Quarterly/semi-annually
One of the significant components of any risk-based system is organizing suppliers. Categorize them based on the criticality of the component or ingredient to the final product rather than considering 'risk' as the likelihood of the occurrence of a problem. If a component or ingredient that a supplier provides is absolutely essential to your finished product, then the supplier should be categorized as a high-risk supplier. What would happen if the supplier shut shop tomorrow? Components or ingredients that are categorized under the low-risk to product safety, but are essential to the manufacturing process also need to be managed closely to prevent potential supply issues.
Highest risk suppliers - Suppliers with the highest level of supply and or quality risk. These are suppliers with a critical impact on the quality or availability of the product.
Heavy Risk suppliers - The second level of supply and or quality risk. They have a direct impact on the product but with the availability of alternatives.
Moderate Risk suppliers - Suppliers under this classification are "category" with a "minor" quality risk and have indirect an impact on the product.
Low-risk suppliers - The lowest level of supply and or quality risk. Suppliers that are in this classification have no significant impact on the final product.
Ensure suppliers understand requirements precisely. Have a detailed contract/agreement with quality and regulatory where risk is higher. Where supplied parts include sub-tier suppliers, have provisions to identify controls at sub-tier level. Don't let cost be the primary driver.
Perform risk reviews according to the classification of risk levels
Attend the seminar 'Supplier Management for Medical Device Manufacturers' to gain a clear understanding of the underlying principles of supplier management, using exercises to help illustrate the points and solidify understanding. Also, the course uses FDA Warning Letters to raise issues and help you learn from others. As part of the practical implementation, the course includes supplier evaluation and selection; measuring, monitoring, and re-evaluation; outsourced processes; supplier auditing techniques; and supplier issues in management review.
The speaker Daniel O'Leary has more than 30 years' experience in quality, operations, and program management in regulated industries including aviation, defense, medical devices, and clinical labs. Mr. O'Leary is an ASQ certified biomedical auditor, quality auditor, quality engineer, reliability engineer, and Six Sigma black belt; he holds an APICS certification in resource management.
