Regulatory Open Forum

 View Only
  • 1.  Critical supplier question

    Posted 28-Jan-2020 10:31
    Hello,

    Critical suppliers receive the highest scrutiny.  I also notice that most suppliers are ISO 9001 certified rather than ISO 13485 certified. Sometimes a critical supplier does not have a QMS.  ISO 9001 tells us they have a quality management system at minimum, but we'd prefer to go with an ISO 13485 certified vendor. For critical suppliers with 9001 certification or who do not have a QMS, what is the best approach to qualify them?  Without the ability to audit them since many are overseas, is the next best thing a quality agreement? 

    Thanks.

    ------------------------------
    Karen Zhou
    ------------------------------


  • 2.  RE: Critical supplier question

    Posted 29-Jan-2020 04:47
    ​Dear Karen, I agree with you that the critical suppliers (=suppliers / subcontractors of critical components and services) deserve the highest scrutiny. That seems to be somewhat inconsistent with your statement that you do not want to audit them since many are overseas.

    I presume that in your QMS you have identified the criteria for evaluation, selection, monitoring and re-evaluation taking into account the 4 criteria as identified in ISO 13485:2016 clause 7.4. This is a risk based approach, so in the end it is your own QMS which tells you what measures are to be used for the control of your suppliers and subcontractors. This can be quality agreements, a certified ISO 13485 QMS, supplier audits, incoming inspection, certificates of analyses, etc., etc. Your monitoring results should give evidence of the performance of your suppliers and whether your measures to control them are satisfactory.

    It is not stated in ISO 13485:2016 that (critical) suppliers and subcontractors have to have a certified QMS and supplier audits have to be performed, it is also not stated that you can preclude supplier audits because your critical suppliers are overseas. Your own supplier control procedures are leading.

    ------------------------------
    Peter Reijntjes
    Principal Consultant Regulatory & Quality Affairs
    Arnhem
    Netherlands
    ------------------------------



  • 3.  RE: Critical supplier question

    Posted 29-Jan-2020 16:43
    Hi Karen,

    I have been in a similar situation before, as an ISO 13485 certified manufacturer utilizing an ISO 9001 certified contract manufacturer.  Ideally, they would also be ISO 13485, but as you mentioned, most seem to have ISO 9001.  

    Since the risk of this supplier was high, I created a supplier audit checklist identifying the clauses of ISO 13485 we needed them to comply with.  This touched on everything from document and record control, to purchasing and nonconforming product.  In this particular situation, I was able to audit them on-site to see their production, but still requested copies of their internal procedures to review off-site.  Any gaps that were raised were covered in a supplier quality agreement (e.g. our record retention time was 5 years, but theirs was only 2.  The agreement stated that for records related to our product, they were retained for 5 years or transferred to our site after their 2 year retention period). It's important to consider gaps between both the supplier and ISO 13485, and the supplier and your particular requirements. 

    I've also had this happen with overseas suppliers where an on-site audit is not feasible.  In these situations I ask for the company's quality manual, and SOPs related to the activities they're conducting.  Similar to the above, gaps were addressed via a quality agreement.  

    For critical suppliers it was also important to define how they're to be monitored - whether a full re-qualification audit is necessary annually or quarterly, maintaining accurate/up to date copies of their certifications etc.,  and defining how you handle changes with that supplier.

    I hope this helps!

    Best,
    Brittany

    ------------------------------
    Brittany Gibson BSc
    Director, Quality and Regulatory Affairs
    Winnipeg MB
    Canada
    ------------------------------



  • 4.  RE: Critical supplier question

    Posted 29-Jan-2020 17:23
    How is it that an org can be comfortable accepting material from a NEW and CRITICAL supplier without an onsite audit, even if inconvenient? In my experience, many orgs looks the same on paper. It is the face-to-face relationship and asking probing questions that reveals any inconsistencies or concerns. Yes, your process can accommodate acceptance of the supplier material, but there may be legitimate concerns on the ground. For example, is it OK, if the supplier is sorting the material so you only receive the material that passes (this points to yield or process control issues)? Is it ok for the supplier to do cursory inspections and provide a CoC with presumed confidence (this points to vague inspection criteria)? Is it OK for the supplier to report on only the passed units (This points to statistical sampling and methodology)? I have seen all of this happen, unfortunately. 

    My recommendation is twofold:
    1. If the supplier is indeed CRITICAL (As justified in your risk assessment), visit and communicate with them regularly. Make sure your quality/supplier agreement includes the terms you need, i.e. advance notice, days onsite, access to personnel, response times. I had a client recently travel to Taiwan from US to visit a prime supplier only to be turned away. This actually happened.
    2. Make sure your requirements to the supplier are robust, clear, and complete. Also, make they understand how you will be verifying they are met.

    Hope it helps.

    ------------------------------
    Adam Atherton
    Farragut TN
    United States
    ------------------------------



  • 5.  RE: Critical supplier question

    Posted 31-Jan-2020 13:20
    ​Similar to what Brittany touched on, your organization needs to define what is the requirement for critical suppliers based on the risk to what they are supplying. Why they may not be ISO 13485 certified, you may require certain requirements to be met, such as a quality agreement. We also ask for their quality manual table of contents, organizational chart, master list of procedures and certifications in addition to a supplier survey. It is also built into our system that if an audit is not feasible for some reason, the supplier may go through a probationary period where the first three lots are inspected at incoming using tightened rules. If all are within specification, they can be considered as an approved supplier. Then they fall into the routine monitoring and supplier surveillance process.

    As a side note, there are organizations out there who have the ability to audit your international suppliers (these companies should also be treated and qualified as a supplier/consultant). While these are not cheap, their SMEs are more familiar with the culture and their audit reports tend to be very thorough.

    ------------------------------
    Stacey Benser
    Quality/Regulatory Manager
    York PA
    United States
    ------------------------------