ISO 13485 from zero, episode five: purchasing and supplier control in proportion to risk.
ISO Cloud Consulting editorial teamISO 13485 expects you to control suppliers in proportion to the risk their products carry. Write evaluation criteria, classify suppliers as critical, major or minor, put quality agreements in place for critical ones, define purchasing information and incoming checks, and review performance at planned intervals.
Why does supplier control matter so much?
This is episode five of ISO 13485 from zero. Almost every medical device company depends on suppliers for materials, components, sterilization, testing, calibration or complete devices. ISO 13485 expects you to control them in proportion to the risk their products carry. This episode shows how.
Template for this step: the supplier evaluation scorecard and quality agreements are in the ISO 13485 Supplier Control Kit ($79).
What criteria should you use to evaluate suppliers?
Write down how suppliers are evaluated and selected: their ability to provide product that meets your requirements, their performance, the effect of what they supply on the quality of your device, and the risk associated with it. A supplier list without recorded evaluations will be the first finding in this area.
How should you classify suppliers by risk?
A practical scheme uses three levels. Critical suppliers provide product or services that directly affect device safety or performance, such as an implant-grade material, a sterilization service or a contract manufacturer. Major suppliers provide items that affect quality but where failure would be detected or is lower risk. Minor suppliers have no meaningful effect on the device.
The level drives everything that follows: how you approve them, what agreement you need, how you check incoming product and how often you review them.
When do you need a quality agreement?
For critical suppliers, and often for major ones, put a written quality agreement in place. It defines responsibilities, the specifications that apply, records to be kept and provided, the right to audit, and above all the requirement to notify you before any change to the product, process, materials, subcontractors or site.
What must purchasing information say?
Each purchase order or specification must describe the product clearly, including acceptance criteria, any requirements for procedures, equipment or qualification of personnel, and quality management system requirements where relevant.
How do you verify purchased product?
Decide the checks for each item, based on supplier performance and risk. That might be a certificate of conformity checked against the specification, dimensional inspection, testing, or reliance on the supplier's own controls for a well-proven critical supplier, backed by periodic audit. Record what was checked and the result.
How do you monitor and re-evaluate suppliers?
Review supplier performance at planned intervals, using data: nonconformances, delivery, responsiveness and audit results. Where a supplier fails to meet requirements, act in proportion to the risk, and feed the information back into the supplier evaluation.
By the end of this episode's work you should have documented criteria, a classified approved supplier list with evaluation records, quality agreements for critical suppliers, and defined incoming checks. Next episode: production and process validation.
Where can you get supplier control templates?
The ISO 13485 Supplier Control Kit includes the procedure, the supplier evaluation forms, the approved list and a quality agreement template. Browse the ISO 13485 templates collection or see our ISO 13485 consulting services.
