1

Essentials for Quality in

Supplier Management

By: CiNQ systems, LLC

Author: Brian Dense, CBA
President
Email: briand@cinqsystems.com
Website: www.cinqsystems.com
Updated: October 20, 2014

Take-A-Ways from This Event

FDAs true intent behind purchasing controls

How to apply these principles to non-medical device industries

Common pitfalls in compliance or trying to short-cut requirements

Why pitfalls in compliance would also be a pitfall for non-medical device
organizations.

Applying a risk based approach

Simplified take-home example provided
This is a smart approach, even if you are not in the medical device industry

Use of Quality Agreements

What they really are
A sample Table of Contents is provided as an abbreviated illustration of
requirements

Audits
Short-cuts to avoid
Challenge as to what you really need

Essentials for Quality in Supplier

Management

Overview of regulatory requirements

Establish requirements
Evaluate Suppliers
Balance controls with capabilities of the suppliers
Capabilities:
Technical
Quality
Others, if you as a customer require them

Does this make sense for non-medical device companies as well?

Essentials for Quality in Supplier

Management
Where does this requirement come from?
The Preamble to 21 CFR Part 820
Specifically (Subpart E) Purchasing Controls, paragraphs 98 & 99

Essentials for Quality in Supplier

Management

Paragraph 98:
Comments solicited from the industry
One comment stated that the proposed cGMP regulation omits any
discussion of contract reviews, such as that contained in ISO 9001

Essentials for Quality in Supplier

Management
Paragraph 98:
FDA agrees with the concepts underlying the contract review
requirements of ISO 9001:1994, but believes these principles are
already reflected in requirements in the regulation, such as
Sections. 820.50 Purchasing controls and 820.160 Distribution.

Essentials for Quality in Supplier

Management

Paragraph 99:
One comment stated that the requirements in Sec. 820.50 amount
to overregulation. The comment stated that components are
purchased by providing a specification sheet. They are then inspected
upon receipt, and defective components are returned.

Essentials for Quality in Supplier

Management
Paragraph 99:
Another comment stated that the cost of the quality assurance
documentation program is going to be significantly higher for a
company that runs a Just In Time (JIT) program than what FDA
estimated.
FDA disagrees with the comments.

Common Pitfalls
Inspecting quality into the product
Assuming FDA expects thorough inspection of all
products/components immediately after receiving.

*Remember: the basis for the regulation is balance of

controls.

Essentials for Quality in Supplier

Management

10

Risk Based Approach:

Assess categories of risk associated with:
Product categories
Volume of product and potential frequency of Detectability of potential
defects
Level of compliance in the Quality System of the supplier, and to what
standards

Business risk ($ and Lead Times)

Common Pitfalls

11

Mimicking FDA product classifications as your categories of

risk
DO NOT establish risk categories based on Class I vs. Class II
vs. Class III.

Establishing requirements such as must be certified to ISO

13485.
This is NOT necessary! (Although it may suggest a lower level of
risk)
Even non-medical device organizations may unnecessarily
require ISO 9000 registration. Why do this? (It shows a lower
risk with that supplier, but it does not need to be an absolute
requirement.)

Common Pitfalls
Not sharing your requirements with your suppliers or
partnering with them
We are not trying to beat the supplier at poker, we are trying to
get them to deliver what we want.

Not keeping it simple

12

Essentials for Quality in Supplier

Management

13

Quality Agreements:
Conceptually, what is a Quality Agreement and what does it do?
A Quality Agreement does two things:
Establishes the OEMs (customers) quality requirements that the supplier must
meet
Delineates responsibilities between the parties bound by the contract/agreement.

Essentials for Quality in Supplier

Management
Quality Agreements:
Another way to look at it.
Drawings or specifications define requirements of individual
product/component/material being supplied.
Quality Agreements define quality requirements applied to all
products/components/materials.

14

Essentials for Quality in Supplier

Management
Quality Agreements:

Quality Agreement (Establish this first!)

Supply Agreement
Product Specifications / Drawings

* From the standpoint of negotiation with suppliers, this gives power and
leverage to the customer, medical device and non-medical device alike.

15

Essentials for Quality in Supplier

Management

16

Quality Agreements:
Example See a sample Table of Contents in Exhibit B (hand-out)
Note: the one requirement that MUST exist in any/all Quality Agreements:

SUPPLIER agrees to notify CUSTOMER of all

proposed changes, CUSTOMER requires this
notification prior to the supplier implementing the
proposed change to facilitate CUSTOMER
assessment of all the affects of such changes on
any and all CUSTOMER programs.

Common Pitfalls

17

Negotiating and signing Supply Agreements before signing the

Quality Agreement
Making it all about the SUPPLIER
Remember, balance of controls.
Undefined requirements, even on the CUSTOMER side, provides room for
SUPPLIERS to claim ignorance. (Usually the CUSTOMER has made an
assumption in this case.)

CUSTOMER or SUPPLIER not adjusting their quality systems after

agreeing to requirements not already considered.

Essentials for Quality in Supplier

Management

18

Auditing:
Definition (ASQ)
The on-site verification activity, such as inspection or examination, of a
process or quality system, to ensure compliance to requirements. An
audit can apply to an entire organization or might be specific to a function,
process or production step.

Common Pitfalls

19

Using an FDA Establishment Inspection Report or ISO Certificate in lieu

of an audit.
Believing the myth that Process audits are better than systems audits.
What about management review, risk management, internal audit procedures,
etc.?

Using an audit checklist based entirely on 21 CFR Part 820 or ISO

13485.
What are YOUR requirements?

20