As the deadline for compliance with the FDA’s Quality Management System Regulation (QMSR) approaches, medical device manufacturers must take a closer look at their purchasing controls. These controls are critical to ensuring that all products and services sourced externally meet the necessary quality and risk requirements. With new expectations introduced under ISO 13485 and the transition from 21 CFR Part 820, organizations must update their supplier management processes to remain compliant and inspection ready.

Under the current requirements defined in 21 CFR Part 820, Subpart E, manufacturers must:

• Create and maintain procedures to ensure that all purchased and received products and services conform to specified requirements.
• Evaluate and select potential suppliers based on their ability to meet specified requirements, define the types and extent of control, and establish and maintain records of acceptable suppliers.
• Establish and maintain requirements that must be met by their suppliers, contractors, and consultants.
• Maintain documentation that clearly describes or references the specified requirements for the purchased products and services. Where possible, there should be agreements requiring suppliers to notify the manufacturer of changes to products or services to determine if changes could affect the quality of the finished device.

While ISO 13485 includes similar supplier evaluation requirements, there are two additional requirements that do not exist within Part 820. The evaluation and selection of suppliers must now also:

• Be based on the effect of the purchased product on the quality of the medical device.
• Be proportionate to the risk associated with the medical device.

These changes require a more rigorous and risk-based approach to supplier management. A thorough review of components and purchased subassemblies will be required to assess the impact they can have on the quality of the device and the associated risks. This process can take a significant amount of time, as does the re-evaluations of suppliers and contractors based on these additional criteria.

Frequently companies have criticality levels based on lead times, costs, stock levels, and other criteria that relate to production scheduling, but do not take into consideration quality and risk. They may also have supplier evaluations and score cards that include factors like on-time delivery, cost effectiveness, response to issues, and percentage of defects that impact production, but do not account for their impact to device quality or risk. These processes must all be updated to reflect new compliance requirements.

With the deadline for FDA QMSR compliance now less than four months away, it is important that the engineering, purchasing, and quality teams:

• Establish a plan for the review.
• Update quality system procedures relating to supplier management and management of nonconforming materials and services.
• Begin using the updated procedures to create records of the evaluation, monitoring, and performance.
• Ensure objective evidence of compliance is available for FDA inspections next year.

CieloWorks can help your organization navigate these regulatory changes with confidence. Our team of quality and regulatory experts specializes in aligning supplier management systems with FDA QMSR and ISO requirements. Whether you need support updating procedures, conducting risk-based evaluations, or preparing for inspections, CieloWorks provides tailored solutions to ensure your purchasing controls are compliant and effective. Let us help you stay ahead of the curve and maintain the highest standards of quality and safety. Contact us today to schedule a consultation.