ISO 13485 from zero, episode five: purchasing and supplier control in proportion to risk.

Why does supplier control matter?

This is episode five of ISO 13485 from zero. Almost every medical device company depends on suppliers for materials, components, sterilisation, testing, calibration or complete devices. ISO 13485 expects you to control them in proportion to the risk their products carry.

Template for this step: the supplier evaluation scorecard and quality agreements are in the ISO 13485 Supplier Control Kit ($79).

What criteria should you use?

Write down how suppliers are evaluated and selected: their ability to provide product that meets your requirements, their performance, the effect of what they supply on the quality of your device, and the risk associated with it. A supplier list without recorded evaluations will be the first finding in this area.

How do you classify suppliers by risk?

A practical scheme uses three levels. Critical suppliers provide product or services that directly affect device safety or performance, such as an implant-grade material, a sterilisation service or a contract manufacturer. Major suppliers provide items that affect quality but where failure would be detected or is lower risk. Minor suppliers have no meaningful effect on the device. The level drives how you approve them, what agreement you need, how you check incoming product and how often you review them.

When do you need a quality agreement?

For critical suppliers, and often for major ones, put a written quality agreement in place. It defines responsibilities, the specifications that apply, records to be kept and provided, the right to audit, and above all the requirement to notify you before any change to the product, process, materials, subcontractors or site.

What must purchasing information say?

Each purchase order or specification must describe the product clearly, including acceptance criteria, any requirements for procedures, equipment or qualification of personnel, and quality management system requirements where relevant.

How do you verify purchased product?

Decide the checks for each item, based on supplier performance and risk: a certificate of conformity checked against the specification, dimensional inspection, testing, or reliance on the supplier's own controls for a well-proven critical supplier, backed by periodic audit. Record what was checked and the result.

How do you monitor suppliers?

Review supplier performance at planned intervals, using data: nonconformances, delivery, responsiveness and audit results. Where a supplier fails to meet requirements, act in proportion to the risk, and feed the information back into the supplier evaluation.

The ISO 13485 Supplier Control Kit includes the procedure, the supplier evaluation forms, the approved list and a quality agreement template. Previously: design controls. Next episode: production and process validation.